63bb19f401be8f203a835c3a7d8ba52a6765b8c07e0ee2e2a5abc30dc102a27f

Analysis

max time kernel
71s
max time network
132s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
28/08/2024, 21:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c7b531dc4eb76b70e228144b86ce7a0c_JaffaCakes118.html
Size

7KB
MD5

c7b531dc4eb76b70e228144b86ce7a0c
SHA1

2291de276c0c566e719cb6de9a4043baddd96917
SHA256

63bb19f401be8f203a835c3a7d8ba52a6765b8c07e0ee2e2a5abc30dc102a27f
SHA512

82dbd0c483ac5df6d0fc4805cb34575eadcf7cfb5ddd7cdb0a23e5376a76f199ddba5f49b262c60ed5854e16cde17c2b9f2dce56b4a31f310e0c1d363acaaa93
SSDEEP

96:kfqEL3+HsmL8lrYeJp6dLRXX3GwWhWJiuzP:kfx3oQrJpAdXX3GwWoJ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf710000000002000000000010660000000100002000000081c4dfba72c03595759b6a4a00de90a0c9d89dbf1d2237ee15b0fdfad3d6f999000000000e8000000002000020000000cd3803d56d5b13d15d089fcde7dceb7d3869fecdc58fd24c63d26bb3d73021de900000007c93f6dd81294075992c764babaf4ae7af8ce2563eafb58abe1910f5eddf53282551f6d214ab2019813fb109e624a6c52806d836a0ad51c1edffded5798e5d99112fab2f618576da1e77d5504bb1a55b34d62644285f650b8ef418717ef36e4240d8477b57ddfff6c236d6f88eda38dd36bd5b2ffda1c825dd5ecdb012ebbac20f067c2cb528ce50db0a15fe78adf72e40000000986e0af52855fbba0fe6afeeab6cf4f17b7207cf22f8cb1d9361b45377a91572949abc9d789f7a1d7c92fae88cfab9c2ced14babffcad28cf1030eb63244ad00	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A615CE61-6587-11EF-9449-66F7CEAD1BEF} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70338b7a94f9da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431043747"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000079e6a794692fdf0f96c1880471ea6554542e050b15535ba91ebb3a145f7a355000000000e8000000002000020000000f7e4bd7c2b9371fd4f88bc9feee51c88dcf276982c5f1bdf2dba15acdc5db34620000000bc58151689688d623efcd1a5aaf5ad4f1d8d5146ff5e777e1755aa6a427d369540000000b669b75031e19cb1eb89b9c070c75c18c625c6c86da5a21e076b32292756230b359d8db28f94293cbfb12236717e8b27a41185d08241443f6a3558ff5eb1c2db	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2508	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2508	iexplore.exe
2508	iexplore.exe
632	IEXPLORE.EXE
632	IEXPLORE.EXE
632	IEXPLORE.EXE
632	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 632	2508	iexplore.exe	29
PID 2508 wrote to memory of 632	2508	iexplore.exe	29
PID 2508 wrote to memory of 632	2508	iexplore.exe	29
PID 2508 wrote to memory of 632	2508	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c7b531dc4eb76b70e228144b86ce7a0c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2508 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
faa9bc05ca8c167f3e9126e2a5874820

SHA1
8c654d3eba293842fc0d0bd0c9229844663963a2

SHA256
bd40d2e323946d6dcfe54c8bdd022999b89e55ef58a29e133924ef554ccda8c4

SHA512
cc168ebaaedaed75d200e3f8a4c1e2c85480d7646046f0093acd75ac4c3dd8903f8f83ba04479c153db1266f72bf4a5b049b2b24a99d4662e248a6d4744d972c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0894ddeaaf0c7fcc274b51df8f3b4f3

SHA1
b88170696d4dc07cdd9684fe62e613ea99a88d67

SHA256
b6bcb9b66d69e51a00e77ffb0cdec6be127744abdff508a0542fe9cb58b2ee19

SHA512
af41fbeb17f26012b04a6484f413b952ff069ce7bfc1b271b35b06dbd1fc285411d7ff6967aabbaaed7afb76bd779e300f55392d0e09d0f7533276c17acb3d0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bedbb887c5d44f061c7a6f2f44c9a8cd

SHA1
c8776ca00fa000f040f8100bc1d48d51b1218064

SHA256
594a89a63ca6450684fa360697a0463962bb03988ed030137adda3637068b905

SHA512
d24a98aff42b9052e6d5175caba78cbe6086ba95172ded7628b722cc9e832702f82ce299293de259ee5a68f557947baf62e1f12fe92c75ecd22ad2a204e35e00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75e3811ed9a8572066bf52ef72fbcda0

SHA1
a38259b9c0cebae38e4d268548e883d21f99c6b1

SHA256
c68c9d5983b9ea5bf567247051df8caa3cfaa3b6f078e8f46d307f9a1a7a8d0d

SHA512
fa81b72661595d61bcbcc0ac97015ca18e3b74244e7d19a00bb535e028daa01ade4ebe08e63c37579e85d35029ecc4dc86d25582be67f06b3fccd0c051d07f44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee0c86492253f7de9f990a8f472ae41c

SHA1
4565ee60ab6a0b02c4e20b7f1645013af202713b

SHA256
a6c4ea3e8997b3c8da5cb9a79ad62af9920f105fa92cd880963570b1351b866f

SHA512
f9a990349faec6901aecd6397c15be9fb21456eb15ffa724c2e667516223e708e07efdaa83913f3f4f244ab6f181187e6566b1ad5fbb9b63a2cf10c07778723e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
208b7b8885e111148387375f2e694a25

SHA1
222006784a48b94b0c9e88d3a215e701e61cbacf

SHA256
953073128b3a7f42f1e1f16cf5bbb45ee792e5441d165fb2988a4e472bce7780

SHA512
d646f12600f5abe143270a3179f1e1474444292e010bbc48a1c687e875bfc9ac49d0673f5d8a780d5a26cc1bf24db72d6c9ca7bff695bad17d1c97e177949452

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e88708416bb8cd5e0c07af2cbad50ff

SHA1
761fe4cb9066e5e6b7a42644d89d91d69236f066

SHA256
de6a6b988ee5ab37f1d37d959e181140ab5b80ec80115ccd2eb4c47868157ffd

SHA512
6e8586b5a487e9b10864245cfc19bda0c1a644462872db6e574a43d577d2cc2f069e5ec8ed72ad3e83b463c23956da724d1fb04dfdb01b2c42aa83f4bb4b1366

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2c8ce40c1af0b734a1c870c078c676c

SHA1
b6402109dba1d205f11b6ea6434c7d6d7ae103c2

SHA256
25a2a3b00f92265d91ecbaaff93e59937f9f68f870f6fa60d60b4a9186d0f0d4

SHA512
2d7cb70e5824010cc8c3899f63b101d2737682e325e581cd6de7c110ab06e06f9e0335c0d407bae73d2e79c18c34838fd1f24ffed75fb23c1bbcaab09e3bc062

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b922b4ee9c3fce748a9cb35e8e5ed9d7

SHA1
aa9fa40840950cc3fcee08894b6ab06f21849a9b

SHA256
f2468fba28d4a91a9f6415d375bf52a7c989b768dc24a36fd5508ad73850fd77

SHA512
a047f58b1bf8ec518496abe32d7aff1631689f19bae36e641ab5b836d7a209f79de208161d1c81ea85cb8a73255bd2426856f5be664126b7997fddeb737c6e67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac3de8b941c8117d20e07fa1948a97a6

SHA1
823806c9cd62f58e6eb3082ede18f25b366c5d1b

SHA256
a6d740095f995a0e8f431c9df22578f0caa63246c8629b94ecb7046a907cc293

SHA512
d497bca8e1c4904d743b293ce0720298c75682499856c50306938e6edf9459e9d8b6fb2b9b7c3c6db2b09259d2be270b87f1ad0f92d50c23e7b5ac5166cd3808

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a465f68830f5bdeb340c51b2c787c72

SHA1
38c1fe0eb3113aaea7857b580732e8739a23c0ff

SHA256
424dfbf69a453b1adb83cfa263b5b95f14c9cdb8c81a106b0c73312e1fbe76e5

SHA512
13ec23581f1b2290c0d31bc4b14f83d50b40460cdc0cb584f9043c18541029b3b5d1289e1409ce8826bd94b672750512e6226ec709871b7ad2cadf5ae5f00c81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
487ae1521784679d0d0fdd56681ea24e

SHA1
9eefbf9c52ae13ad412261cda97ffcc03ccac61a

SHA256
a2855d21193ef037234caa324688b21e898c3cf256c0a9998a63913dc6b92f52

SHA512
9856970566b270976638af643cff38f5f7788f04e959acf78d1dbe4a4f4732b2a4faccd92f00fd443e05f115474674654aec4ca9ee77b5d59fcc15fd4e8f7eea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ecef34c74f4d56315852fbbb21f5d2e2

SHA1
624a7eb7895e2e7156ebfab7d642e8b6298ca390

SHA256
817c51cd57874a40b3d9b35e5863581086665db46714f868f800ea773583213b

SHA512
c1b569f2388a5c429ac41ed73f67732beff555ef58942f322e6ffd02da21d23bf2bd14e99f9412cfb5c451503b4910bb3427633af3b648b8072c459a6f141a06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9c55a8b35416d67367adfdd7a04f476

SHA1
fab9a69ec58a13522ebe04e85ef821cf52a88f75

SHA256
40b9657f6a3fe263d2cdaf3359d8d66bfaeb1ac896753679ce52faff53b59890

SHA512
59a46d2624a5d0d9a49a63ed700331c27f1797c346afd46cdfb898dce05ab4eb44de3a81d3b84a03857cc3d14a8e78c5d9f2ceecefa8b2b95d702c8027bf3b09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06101e00d9be4cc4e54bfd8222fd2a1f

SHA1
94a0c46267778a4076841e7ea992c9979b4cd62c

SHA256
9c199aa7b5efe185ee8d3db5deb22f9c02abe4ad06cad1eadf5b9b7792be4a3e

SHA512
353a5c2e0ade50e209703a099771ee4f23841c8a6e064605edad98ed446f37b2c8ec06f33dd26772d1d55e37056ca8f903e7f287b26efcc03c17ae022918dc65

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC802.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC8D1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit