4b9a8f02458d6cfab5cc2e5cbf6abcd250978f639bb274d75f50b846567d87a4

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 22:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c1b3d237e3dba25e59826468cd0a39a3_JaffaCakes118.html
Size

11KB
MD5

c1b3d237e3dba25e59826468cd0a39a3
SHA1

7e6c5e86b5f1704f6e320a48cc6852c49addbd25
SHA256

4b9a8f02458d6cfab5cc2e5cbf6abcd250978f639bb274d75f50b846567d87a4
SHA512

66d9d7cc4df65a3d2192a6201b2ec24ba821b684634aee812038dd2d756788ec161e07ebcac4819709bad2c5ebaf41a4782476a509cc8981c89766538e942177
SSDEEP

192:il7vFZ7vTbPuvf2w9G/8U1lXIljNgMZYNZw7LoZL5Zm9Zl9T4OzsDjhVOm/+kmI:kfvs2w9o8qlIl3YXtLbIIKg1

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a01607053cf7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2B4A2191-632F-11EF-B507-C2007F0630F3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430785855"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f0000000002000000000010660000000100002000000052a11fa3d4d887c6fb9ebc5ed530755a0c3ad9d9943feef84e10cf0d20a02239000000000e80000000020000200000008a7a46af6b4f79c373f121d056a13c93affdf6c108e7455b0ab213ff28c0c31b20000000b87b804036c95fb68cf632a06500850f98c25f189e3741810b184370e95d112d40000000c680dca15931e8db3312973a71d2e8ad0956acbe205b14973e6143884b1bb9a7d3c7dc2ccc67226a07152f9101caa9e2f5c21a5ac21150965ac529d78388d1c0	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000008d26bb37715d9f9f04ab043b42e9d58763351c12e301ec062d491b18a7b67651000000000e800000000200002000000094a5a2fd81c9a03ebd642d94b66b950dfda5779ce2ab3ca35dbaefac273c986d90000000137ab931abd8239fd83c8d2c4f3312b36499aef210f8eabeee6008a2118ee0c2b697633a03bbdc7bc12d6856caf407a32b94ea8948df2bad553f3cdb5318b2ba5c4eb066faa8ecffc4288748b23db0220df275d74741137b17c38c65a94df576e45dc93d6d5f71836d8819cb0ec60c0f471809692d4c4ae21433ca6ab29210a3536fd9c01b9e5a48c26a4475db32b210400000008ce11d773fa11d0e0bf838a041341e692981822999776d3dc97084327979b151173c78dfa533b781caa695f78e88792b798426c450b70381d302ba549e2b8166	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3016	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3016	iexplore.exe
3016	iexplore.exe
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2304	3016	iexplore.exe	30
PID 3016 wrote to memory of 2304	3016	iexplore.exe	30
PID 3016 wrote to memory of 2304	3016	iexplore.exe	30
PID 3016 wrote to memory of 2304	3016	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c1b3d237e3dba25e59826468cd0a39a3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3016 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c11e545b40f9a10fa16c95ed50ebf7e

SHA1
fc9aacfdfb707a7bdb1ee0cc0d12b71cdadb2d69

SHA256
1e35709645d944ccc34ca7342f9e14c9eb959f6b9b54f3ae79f105e0a6af4add

SHA512
cf92788eeb5cdc0060b26d41284a5df28ca400d10a911bb6c2ae1e8787f50ba1bf8eb3033ad927f619418d193e28b54e022140acf000af3b452a8b6ce21eeef6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e48e5ee282c63303dc48c755010c9cf

SHA1
88da028214da4b8b460518d5ccbcfed90486012c

SHA256
8e2099aa160d12aab00756ac4fd9a46face8512755bfd6eb529315deef267df2

SHA512
0953d56b7488a039e0261f9430dc84623ee2dfa7db8252b2227613d5801f926aa84aaa3eafacaed23e530b73b77b21062d1974cb5c5bec398e2b905fe21f1400

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6122574368b34c23c13a6cfd625817e

SHA1
c2be9d8071fcaf0b19530be6ac9582b856e69cd3

SHA256
8f8c2bc2a6796fefc588b9b707b2be25b5ecca221c5f61d35a59655c7e4ecad1

SHA512
19fcc5b26382a2eafdc023c453986fc334715c3d7190ce54ecebd65008dd5ebb75a6543971c92e46a18a230d10ac800aea65c3526f4a058e4317fbd899f8a8d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e416c34c2682b882a653b7a98c6ca67

SHA1
dfa435909867e90d121cfa5b1e259d833e5c1c6b

SHA256
4be702c55ec889cc01987e79a1291311a74a5424b791386035f5fc9b08ef2341

SHA512
fdeb9beccaaa55cd1f998b125e717b9da56ce950f61c123618f2a11b6f6c8407d10c2b7876f32af9a6f66603fcbf0559f6a643545cd483fa3243b34fab7a4e17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
904ea38db6f24b4f0e845bb4307317ec

SHA1
1e8f2bfc7b524153b3d57b3bd0744028bd218389

SHA256
135dde74edc54e1f043c7fc5e2a50c764187e88b3ae4284a45622191d6467144

SHA512
dc7d27af490537205508f0d3ea02ff54a9f4bea8a2a1af91bbd68cf5679a083878e4b9e99058d6ccb94997017fba1a68f0234e1097d507d355f782becbeeaef4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54af9744dc8dd9903ddd84ead7007eb3

SHA1
43696d4d167dff2bbe9452c80ef7f97435bdbebd

SHA256
6aec929f5acb9ae261c80f4c16b5ced4abe259a3db074f20e6322707b0327ba3

SHA512
14d0cc13bdbc8e26e1f1a4a7c5127c1551245dadab916d786becf22b88fd2120b66bdbe714422dcc73d7574c77bfeb94b9aa514360b5db5448599a127c3809f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d667db93fc1b3899ffe8a747d58f2caf

SHA1
7e6306868fd3ee7f54ce63d0cdccc9a15ff0ae2c

SHA256
256ae6c21122a085e89ea109c2586d5ac0d04ee81e43fa7c58f8f484b5948115

SHA512
07d728430d4b87322d33b5b2e52ecd3bad8d208ce58d90f306ef4ae5ba21880d5484001dd07fa2bd49a8cb2eed3d5f16e1365e439c47ea8ea808d5bd5f6adddc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
150fae229bf8ab98405e6090bd08a587

SHA1
ae35b9077f2d677b4bb698f8d9a697092ddf3259

SHA256
4b5ddbff3073e539d934d0dc2d36a86a8f178a9dc72722983859cb13373de25f

SHA512
e7e0b7287e1efc0a7d0fbd2ab274245047deec5b25a6e6cf87b1ffbc79c1b0fcb47bbef356f19d78e5070116ff30a3733cb71d2b0e6f70a0c843e31d7c8f6c0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c700a6231bcc9b918cfd1b8624a2407

SHA1
8b28d888e822e481f5fae36a89e8ecfa2ec0cc9f

SHA256
25e193682f9537020e9fbef9a28514b20090db30f5bab95f78723eb698280d83

SHA512
a4321be706395e03f1cc900affb9062937a1a1f957815cebe0b48928dd0206fbf9d4e2770ba83f8d6e0851b6b7d05daba1f31e222c68b0b74ed66f9a3bec9d4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEB3A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1B25.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit