3c080e3488203b343652c30865127cca4d0c92ed9d3238caa2a0784bf5ac5b0d

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 14:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f007ce72405a8dbb07f9dfe360ced4d5_JaffaCakes118.html
Size

23KB
MD5

f007ce72405a8dbb07f9dfe360ced4d5
SHA1

0940031e7f30d14f69f74235a1198b8071f5acc3
SHA256

3c080e3488203b343652c30865127cca4d0c92ed9d3238caa2a0784bf5ac5b0d
SHA512

79652bd5fb3d1012120caf083c592b0e93852f55740d0cd6503fd0d995dfdef6062ea9307804c048582827440320f03631868510670f9295b9f442b7bc8a15ed
SSDEEP

384:GOw/TOihomrLmh+iMH8TBcHSyhXrSy/EPk/ECc/z/YxAJMkp:gV6mvGAH+7yhXrS5kECc/z/YxAJMkp

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E4B4FC51-7828-11EF-8CD4-527E38F5B48B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf600000000020000000000106600000001000020000000c83b11ce5a206bc69c4b966645fb1a5d97ad6c3cc7084d71f1e173f518fc439d000000000e8000000002000020000000dfa8cdf96b8f0d7d6bf3c54a40bf52bc77ea2a3fcd35ca8a0c43f2ddfee11f7f2000000079521666b1e30ae8b5d9fc8f0a4366fef43da70d91ecf6b3bafe5b6916b4ad904000000045454e78b791d8374ebbe98462ccd576f7bdb4e8f88b0e85da57108afb572911d2576aa67febf030123772243687443b1968729d2420b4d31d224da55f720b92	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433092118"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f00db1b9350cdb01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf600000000020000000000106600000001000020000000bd3a9e6fa2e14f834dff78b04e0b2e772a50034ba12f34e9246665e1fa921acc000000000e80000000020000200000005cb4025bcb57c267bf8f97a08c73d7abb737693bde574b2bfaf84c1f0e5684879000000093dedaed27dce5671d2ee2f290af3d29181a5f9022b25547827f51730c6377ab725c6a1af49bc5712a17ff9f4270f94b7c64fe5f0847fe5676e19c5d8c4ebb209a4cc8841a10824da50ae69d98f05841ffac23e86080fb05b6cbd1368c751948d5c16e8e575496e4cb07bef5d6997e5847913f305bd9721a2a7b83b7bbfd1e0fbce49fbe8806f083ba5be8f9fac5c000400000004cc7c3e81542c5cbbc0236c39976c7f5f47e345bffa5b3bedcd402cb614e05c0754d9427237c34c60e063fa2d0ac298a59e5fa8b5540c01c5e8b2d8c1e0a6cd4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2076	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2076	iexplore.exe
2076	iexplore.exe
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2720	2076	iexplore.exe	30
PID 2076 wrote to memory of 2720	2076	iexplore.exe	30
PID 2076 wrote to memory of 2720	2076	iexplore.exe	30
PID 2076 wrote to memory of 2720	2076	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f007ce72405a8dbb07f9dfe360ced4d5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2076 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88c06888ae034b9795a826653ec34ddd

SHA1
fea1d0a3c4b5a09ff790c2627849c7bac8e35ac1

SHA256
eece75915a4d57a9d393ac0457a3317a3b505c7b1a41386302d09e076ef3d7e6

SHA512
d81ab307c5ca94cc5ab868b64ef860502f0253e3eeaf70e025b412e43484c5080d16877643bae63fe238468db5d121383a581ea599d0c4171c05ee86bdcd39ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30e8086e885184064444e5275c6b3959

SHA1
69c0b209e6192bd1e35f730dd7836b216be2d707

SHA256
8cd4479a46673954891f10c88c28af3bb517d795e2cd4a96ca888237497afee4

SHA512
b1085c947e4ca2b0cdf48d8fe6e90c004161431ec1fe480a9e1f0cdb90bb161f568a9b34c4878acdb95c5a93d506a2ac07007bebd505df4dfbd06e65d9ad18b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8aab6404d43d68655d82d1f8e70da7d6

SHA1
6b0c38218dcaf9690cf13b1efebef437ce6b8708

SHA256
e9ee1afbafdf5732eb14e962f649d9a9de31a9260f00b42a46e632b0ad95ae75

SHA512
fb3470a5d899f2bced297d237ba0401e4acbf8e318d0ce7f498b59d9c6c61fb324fee41e21a05431c3471ff868662845d2aa6d24a5dcf76fcee644c664af3cec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb1b6a4e0ca96528fd8f72b29fdbb293

SHA1
5f3976addb1041cf482ff917275c95c41db169e2

SHA256
4aea5ec647e9a07bd30e4d8361907df4f6925a228279212313d1d1e871b1dc22

SHA512
3fc58f431c8632eb4541d4539c507feb1f042ed4cf5f29dedb15f33205317c0e54b27861a13b21b11114242188d3edcb60055fb2f3aa9493e50b1df792a74e54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36044ce3ae7d2cb1e4f36573b098f0e5

SHA1
d22142436cdd1a62bd757f9d8d59aea900a8a5f4

SHA256
a2b47bb25934ab1b9595f422a77d9fd6a068a168656a260f1ef7473378ea6206

SHA512
7e1c17f8df4e390916707e9e9cc449f100302789e6c730f062844594808716d52071211bc3762485eaa668f0f48946b3817d1245e607bbca75302de83c5f5f6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73fef63349d52945e0d88f0991facd05

SHA1
7404c5ebff4c7fb26010e94de8febb5fe94ccd78

SHA256
0aa193a2d44c3fa010fa22844cfbd1581f3d9429096856b84e32dcb097870c89

SHA512
8ee9e16a32c6caea293cca92e1afe81fcf8bb302c4560e3c2a1799db6405218e9824db0ad515e4eeb7eb263c643988a938c61863a46c2ae94cec1bfd23fa5c1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4ba26ba37a01f0c8839ea629d810a03

SHA1
8add67f44d4248073164072153c2121f1fb73364

SHA256
295eee0051937764b93fde1ada2d7535780c0b85004723eb840e5fc3ef2f04da

SHA512
b5fc28fb802a8ccd0ed893d557361cb02d9433c6e500246ca983bb21a923179fecd505398e854bdf198c55fa1bc902f1e0d9a3f34be7ddc1fa79a4ffdb49dc22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31fefe3c099a000301d29835fa4a155b

SHA1
ee3373e9fa5b322a7e175c313e4bd9f1ed917358

SHA256
f04cd72cc73aefdf2fbe3b3759914eab1e361278448fcd9b007a159ecdefa30f

SHA512
0e01d0b73cec3da13babd191fb0c726921faf7f33668124607e28cc979ae5a7a3fc4096f0318935f8204418138d1389ebcb56aeaefe47b871ff7c4753c439772

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
392fdaf392c25ea570bc46a83dc505ca

SHA1
547513102b44aa89b805a6de2a7a47baaa00a5eb

SHA256
705ed066be40ae3ed9da2d24d58ac275cba977106bf3b60fb2d5a67aef489e98

SHA512
fa63ac273f14065ea9b2b4ad1a4e678c2e4fada8e11dccef624ec97a4bf83461a5f32ef7d96d0c7057fe99c3d1b4078c3285f25e83f2fbc23d2a2331740aba6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6412f0dd99a82f7170a871fff2ed2e8a

SHA1
eb0c1b9c16c377a8ef10123d3098f09d47278bda

SHA256
264a272453f3461fd8330eb25323745e7c0688355b777e5eb5f2e05096c79271

SHA512
7363d6f271f0805795ffdfa3e7a10eece9a611ad9fc89f11f996ce7db9d3e42a7862a0c0ca1eb3fca454d2bbdefd02024a7894e375e8c7eafe2bcff244c5ad48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5bf7b55579147b9c6638fd234d63d7aa

SHA1
813db6cd5edf4c486935686df6b088dbc51cc0a1

SHA256
3c9b46294d3ab502ca3aae45bfbd4d7937c655b7c710f9955e1471a72871f30f

SHA512
cb334d406cf95974ca5e7f7c12cbddc3cf45cc661fb94bb5757a9cc9b4e87ec5d62beabb04fe1b829b7471c03896189edab6b1e863ae4a5a9111d02692efa95b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97d92269ae4ca06dced0ea122aa80c03

SHA1
1cfaa0d6e9053e2b85dd5ae0a7d1daf256ff972a

SHA256
d85deec18b3652600f51255e5eeef43db798949421596cba5ad3d4acc81138c9

SHA512
643770e50fd188781908c53408c17636a8d3ad4586f36309cd4da58864606bf799b8c3be63b00d36eef7aa3ec8b51d7af1db16a1c5acf10f19036a1fd40819cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa78494bba69cbe4b1f79252b4a412bb

SHA1
2bb8ce2b567e76965cdfacda6405eda9c02214d7

SHA256
12364dc9fa29913e05a8774dda283f7c4fb2f2b917a38a5cf0cf5bece0f06c3b

SHA512
da00956e48c6cc516f215a66e7699b2d72ebb0f3dc0348b40eb5c056bd30d60d177bab6c2646b45721727d81081f0922328a7747b2234f1585bce716c584dbe8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ab008a1c109e3da42189ade7d4ddd36

SHA1
5798f4f90c5809bbbdf3f9829d5f3bafde67085a

SHA256
8f0a84a9710b1d1c7f9d034f1eb88e81a6b90483ebd96f4691a0d844f29674ae

SHA512
5eb39fe4e504b3abb56206ca6d5a99442d0a01f64eb5745fb94b3e5a09f0e8ff873a364b5cf3b9b4b631b56815b95e7ff7c3ee01c86771918c6113ba36464843

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
245f914a046a80b635376fbef3b8ff5a

SHA1
00361e81ba0129da5ac2cdab58a6718e238fd9e1

SHA256
64c44a5d886e94f24b784ff4ffa6bd62fc5ada4dfe1ddd2b32d7cd9fe2dc888e

SHA512
104e0588c5786f9ac5a1f98411984ae44b1aa8515056a6afa488e786558940f6d759fac929b957f205780e0c1a5006deda161dad41eb093aa193a49dfd0b7754

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
433a3a0a773f47e9e9fa10718c6b225f

SHA1
df01beff6daf77ef6ec702cf15ad92492fd04d92

SHA256
f3723875a798404fa26b065d9bb0723a7b6d22a38d81f5c05851f96c564f2fce

SHA512
8d825fd5b24a898f076b02b908a547f33795864d9fe0db99d48d9f968f81a13bc188a4c6c7388769885f6f2695a6f6b8317f5ac7ee187f0e87ffd0b20b9e24ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4442.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4445.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit