5f21858985e3bcac6a5b2368c78373ad4949cd82101d1c420103fdb46b8694ae

Analysis

max time kernel
70s
max time network
131s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 11:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

be7476d278ea90b00dcb0d36d902b623_JaffaCakes118.html
Size

460KB
MD5

be7476d278ea90b00dcb0d36d902b623
SHA1

c9f6424e5a30ef7b0c2c4f5d327c4cfa0b9dc1cd
SHA256

5f21858985e3bcac6a5b2368c78373ad4949cd82101d1c420103fdb46b8694ae
SHA512

da255ce7afcde8dd536df726194514e71fd81d467a287cc5ac597ca53a40b0d1e72bbc72ab0b8de656895d225573f3e81cfa84434795d3eaec41e523ccba84a7
SSDEEP

6144:SdsMYod+X3oI+YPnQtsMYod+X3oI+YcsMYod+X3oI+YLsMYod+X3oI+YQ:S5d+X3dk5d+X345d+X315d+X3+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c92000000000200000000001066000000010000200000001f65a24929f9741c6363b4fece9160b8854b96bce7130f17ef0bc6501f666e43000000000e80000000020000200000004e649a75f11950591ac46316f54c171e0688b2a792c8536a82c5eda25464045090000000a4c19eaf7dadab665d171a57848e3fe6ed7b2c0c5ef58235bd49691ef7fc9aff87cbd41a40428c25712eb1d45dcfce98f5a5c399ef0c1ba5cc0450f67e24ea807bc5d6e9b1ffd126334284dad1dc1b6e1642005eced51dd3b7df69c5f10dbff76691770242599bb8d12bd316e86390c0beb76c9a01619707fa89362a44a04af4b37190b6ccbfed65c1e743db237247704000000040939c6089a40294c9eb8670a5f65538bf69d1f797f810341ebac1bf38e707e18968013e5730b24b46e783274918e6c166c82a532a7d98532e842af8a6caed75	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c920000000002000000000010660000000100002000000004c3f0708ca17665caf7c24bd30ec4e1b8fdcff63e56ceaae081c4648287c540000000000e800000000200002000000037580a5764a5d2dd249d7d3a4dac79f5fb6ee657b2b8d7f171753039e5ec9e7f200000009fecf30e0f605760989b3fefa9549a087e747c3783e7dfbd19c0fea2c0cf1f7940000000c8394dba1bc8afb693b9325fda18b0fe9eba42d680c331f1b4beb339a32de3f24d8571d28ce2724c4a92fb75f8f6d04737dc13efb81270a8662a1ff678e7c7cb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6A3B5361-6208-11EF-B066-DEBA79BDEBEA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430659246"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 204cc84215f6da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1400	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1400	iexplore.exe
1400	iexplore.exe
816	IEXPLORE.EXE
816	IEXPLORE.EXE
816	IEXPLORE.EXE
816	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 816	1400	iexplore.exe	29
PID 1400 wrote to memory of 816	1400	iexplore.exe	29
PID 1400 wrote to memory of 816	1400	iexplore.exe	29
PID 1400 wrote to memory of 816	1400	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\be7476d278ea90b00dcb0d36d902b623_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1400 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b782bc382085ffcd567a3ebfad833643

SHA1
6469f8eb59afdd52088a2dd9e643618b62e86f39

SHA256
5046e7d501a1b5540063744d517c87c43e123ec6c9809753f5c65946322a4a74

SHA512
e7d0eab34d483349002288b998cc53b252364e4946749a5161af867d74f348b7eedaad43debd398497b70d3b02aa26a51a661f289e85b8aba25be54ec49ea44b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c2257d736f27fc9a31eb1d9f5db5aeb

SHA1
7fda4e0beb3624f04b4daa5bd4fe68752b1c86a5

SHA256
336848e3db7a01b523d8879bd2079a157570d73f8f51b44d92a1b7cdea6f14f7

SHA512
d1f4e3c65add8a409c7cb3cb45e22912e3c65dc5eb05941f9abdb565d0b1845d4c73224d810f6002598d1a1799ea8ed09435edbbf61045650cd3ecaed1234de3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69d09455d55bcefed29261bc1afd0ba6

SHA1
d2514ca4ef37082b8ee1e55531877d03db83aaf3

SHA256
daad3c4816cb6d690729f90a7f858ae131907640cad4000027a54a0500ce8842

SHA512
5d07e9f12e5367ac536e6bf28a018efc08508bf25ce9c92338dcc5077b47972df90a4a608d50a54655b910105798d13b7e5ae628bf263592a98c1bdb0685eac9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dba51a2292809484ed68fc38bbced518

SHA1
789d1a3f7fd216dbfd31f985c19ffa2e98efe3c1

SHA256
37c6857e432df367c08cae15ab2343d6c832ba9b66d370fb4246d3a78576b751

SHA512
5ce4d5b11944e90aa51b3b49680c30e88a4673e54c63ee89846f0ed849d6ce6f07abe60ff93f13c2238026dac589614a207886f1802e7b50511a8b411d5cf3dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24fe37a4df8e23dd10cdd42fd794c578

SHA1
77549562ca67d0974943335c9f1da0a0ac102f13

SHA256
07fa284126c7cbb5d307680f1937941d7e58d2c5102021e88ad51f990fe4085e

SHA512
c92d2d41849d8962204045b3f9a6c1e9880696a9faddadd94ad85ce2e32ad5fc70dc9102da6f65b3ee306ded688f5573ecc20bb4d3bedf2b24d1cd895433b307

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbe6500a25051bf1fe0901365ee44456

SHA1
0cac91f8665dc235463066126591f7879a8dcdee

SHA256
324e5bce05519777faa59e20c1a83ba51d56267026af5c468cd4ae20e2752a08

SHA512
faeae71e7687a3be35df36f84eaed3086669a33b67521d178e10a318ecb5d0abbf7e9dca403e046cb23b1d198cec6884efee348c58b868207899a993a9de7c73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3df7a56af97f15b8f22e5b13d0d1cfc

SHA1
fd2f51b1700cdaa12805186b7a3b4a390ed5adda

SHA256
625012ae74f7065c81ecb4e87524b68c53997a081a7fe2daded1b047983be1d7

SHA512
a37038a45f4b53d0af9bfe12022a958407f36fd9766c6002d7e2c8241ef3c1fbf592958a78c2fe4f5d9713efb9c1910a076da219e1eb84d43ced0ba73b4bd1e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e27eb0d060e5dac5d2016273240d2c0

SHA1
1118408e01c42d645df1dd3a1a16469b8367cc5f

SHA256
ea85a403b566a0d6e2a046db8ad9889ab0ace1f31e03129026cd973f4de4b224

SHA512
c2738c2b91d09aaa5b5dadf193a459375d5caeef7f8400acf43acbec61e435e1c724de355b1e4867da72bbcf44e789d91b654ab0915c4e36594ac222f31c6fc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebf97b1c70205e4a210ec3f321213260

SHA1
2ebf870bde118388dbad06d93680ab798e4db504

SHA256
7a4d216fd1e0244c27c49a97720dc9701503a059ea1be1b31e4497940c7ff423

SHA512
5374668354f8630eb9123f9a895dc981138d752a31e8bc434fde02f4c4b8ae4e71193ba92debf7a342467f49887e6b9a0e21917828763a498ae5016fdac052f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
150e9294e4e9854afcf6e58686aea23e

SHA1
1f218f5059ae77a54f7da553e14d2279bbd2fb1f

SHA256
3f01ffe2fced15b1edccdba026356d6c3f37d268ebf3b86764cf071b3d08f8e6

SHA512
639c13ba816425a00208e8e3557401f6470358bb0c8f80b9a16ea23ff76e75458450d14f1592596cc00c702f99bbc8585cb2bda1867ec2bbb2d925884fefc375

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e8d12d0ad86f2d0757ba9c216148b0f

SHA1
7083fcf3e1b02868c9eda9e8d46b7343c6a1cf98

SHA256
3c2830d07e7a09e8fe9833d74032e18d83a93bed5ab1dc96fcabdef2ccd3ebfe

SHA512
b50efdf57b0bffe2c2225cdf3ab8cbbe53da1f81b654605375b3236ff4fb34d7f93e1fa8d322257652b24ca3639b216308cb079bfc079ef7d98dada73d8d0bd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e1812ea36b085f42a24b3211856faa00

SHA1
e9e8cfc39e95ffc09495e7eda0d3830cd7589900

SHA256
69d262a3f480bed8d6f358df26a787909769e794c2c5933683633d7ee4b26fd7

SHA512
aaea80a9363242ac670a06182d7d7373580d8aa714d5e68d731dc95d1163311d9d15e89d9ea134e221363d4b8cc21dd9067726d248d06b9a47b65ba6c16bdc64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
421a1c81f0af793ff6e101b67c5e2887

SHA1
321c825b9e4b6c68cafcd714ff2309abd55150a2

SHA256
74b2c7640c80a32ce928d8e091e2129927f2a2566b967241cd3284d1697a896e

SHA512
423820c3c90b55edbc1ce5c33a1c2d1911fd82e2a72729adf745384be5258d5b31733914d0d74621728e6478cc0a246c64f0eb8738c515cc7e16c3b0539f2602

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff0100fd123959c80ce7a9f14b720507

SHA1
31c1e839a476a5f079d9391c90d087b3a13b5f62

SHA256
648d18e99eea3fbcaa43e8432e6a5b69d015ffbf2110cb824498a5cc0a24d5d4

SHA512
9e095f74f99692763ad52643f77ded96ff08947e49d04755f324ddf184ba40edcb87cfc292f90dd6373dcc2d8eea58de1b0059410b9affce72fbc4d394274bab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab21E5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar25B0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit