5cb45c195d81f54bcb47782bd4df3329c55b7b57e5e753f3e8b9d89d6141fd9c

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/10/2024, 20:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

250b4906781993ca96332defd02922d3_JaffaCakes118.html
Size

23KB
MD5

250b4906781993ca96332defd02922d3
SHA1

441983a5e0a3f0b117fef570cdcf4c5d5f709d37
SHA256

5cb45c195d81f54bcb47782bd4df3329c55b7b57e5e753f3e8b9d89d6141fd9c
SHA512

f4cb662c36299612dc5c82a0831d0f065229a9c5a05c68e730913fd800cb01a959cc9d9d9ba9dfce6278bdf913017337392522bd1ef3cdfba09ca50a5079a5e7
SSDEEP

384:F2G5SBvKKXurAVThcccDA4oeWKvqNCq2JAzxea9LM:F2HBvKKerAVThccYAYvvqAL29K

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ABC73E71-85E4-11EF-A364-FA59FB4FA467} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434602133"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000b0926135fbe181e38e7b4b834eba06e332bd667726faf770d1f9515fb15fa9f2000000000e80000000020000200000000086f9eecb6da91eb3cbe7a51f0e9a5183ad2b7ac831ee126be069b6858235de20000000153cb6bee23422d4674040e7521d48235f36fec9131c59ca9b95b577831c3c7240000000c60510d21f5cbb1d9571bb738794bd2ddbec276c73a456b1dcf9dc43280a8912ceba625676e17c60c24266e93ac8a250ac8d3718126ed3ba376d4d28992d8d45	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c090e581f119db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000791b479f9bc221b465b22c5c7bd4452953dc433e3740cc5a5e5901b3dc6fca58000000000e8000000002000020000000f7673e2358d9069bb0daafe4a80555edc9c3f3d208babf219773b0be7ce179c49000000037aba3031670947d02c6a242c28eb94a642d7cdf058059551e62817cfa1fb1a4dc2f809750c3e5ad5a3119386ecfc28c3376ba67b8335688ad2642577b62b509bc7038fea600c32077522782ec0d3b01523f884217de7168c5a6eaf697198aeaf2fbb52e8ce3713232b493e74957cb20e2eec4d027fa05727bea2e0a8c5b6c9a2989e82d154f3ce6bc13d2d2af128ed04000000000c3904d7fbbe2bd6134af627321403da1d5543783c9b1b67903843bbf1fe8424b0185be7f81bd223580dfa397b9fb9246ef97f7d081cd99147435989dbc67b1	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1924	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1924	iexplore.exe
1924	iexplore.exe
2572	IEXPLORE.EXE
2572	IEXPLORE.EXE
2572	IEXPLORE.EXE
2572	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2572	1924	iexplore.exe	30
PID 1924 wrote to memory of 2572	1924	iexplore.exe	30
PID 1924 wrote to memory of 2572	1924	iexplore.exe	30
PID 1924 wrote to memory of 2572	1924	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\250b4906781993ca96332defd02922d3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1924 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
834c1ac4a1c116e6b1030542a4fbda4e

SHA1
4661d194bdee193445cfcd2a4d8db657fcb4221b

SHA256
3fb4b62f971b6671622f9b66ba5f958760555b6869f97bb7facb80869282559a

SHA512
708f7cf92fc5f1775254e48ea210fda3d5d390b244064b3266545ef6e6b32a2a45546b6c50fcb6051892f908435212287c737836b49f82f6a1fe8b6e283bb395

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26a2c0a52a1882c0ba547c9eeb27ef93

SHA1
e061e3282315ebf2b7acea55a79f461cafc3f34f

SHA256
c0e0888d70f33fca50ca01d1022ba88046df6ff959058bbef3664e86ae85f219

SHA512
2acdcc69bab8578feabc94538096d8c2a52281e00d2cbd6bace080481864d1b9b43a713807460ede8eb60f86fb368a97b6cfa8c156526891c95b026753ccf3c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f8301f734996d72e2eef161e4116bbf

SHA1
b126148ab8cebe8f9d596c53f01f13e903052f37

SHA256
27f3cf1fb0a020a53d77c34f2db77810c78348253bb80da5077f7247a4cc2c08

SHA512
444749a203a367429a40b6298920fc8b5b636b2f831c930bc80bceaa35058ca9ed8a517fac1626e72b0dfbcc704ce6544ef5007d5c14066e0c68ffe4ec63cd7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
008b1749336a86d060af94748bc530f3

SHA1
df3865070e0be2f7f5cd902509bfe18b49a95eab

SHA256
169a7293f4d14d503638657a81a5ff434960e2bef309568587e4bab8ccdb82ec

SHA512
4fc1fe2aaec31ad2d1fb4bd89ce6521e3aa3cdc9c0662667f9e0edb216f7d6c0dd2ad8836ad5064060ee232cdbc4287f7f587d5a6e00958a4572dd64becd9f6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
438d5eef72f647ea5eadcceb0a6b93b8

SHA1
4d02ba24ea81fa31b299b82940b8df5c2e27e0c4

SHA256
77a5102839318d4f5c36e941e60ebcf7159514c70586b7cd0555aed2ca00c82b

SHA512
7da875f2cc46a08edccf9497e0f26d0bbea2802035aee88a5fdaa1be745de4d8c33b4d0244f72035ee4037a06281c99f09568304c6eccbe0c1223743ab7be0ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0dfe854636abd07fbc062590a26f2ff8

SHA1
debb50822e5ca5bd26ecf709ef49f039e3161de1

SHA256
dea68557dcd0701a4517cb04d46264a7e1fe0482b419bbc001461b4fe97b8c02

SHA512
644d5d8730d79481128ad8420d5711ad0e74d325b0e8652906e1ca7485fe3272d5063e218a9bbf01ae67b54aa5db06d3327f01edf47d7dfaf0408895d6b0fb20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c4f846e7d5f08d0747dd62c74a1ccc9

SHA1
337ec3d8dcdb810e29285a3649c8777109463ca4

SHA256
6fffabf7dcdca27651ca9a1593d2b1a3d91941fd9ed9ed10b5434824322cd967

SHA512
859720c74b8abe6a372d3579b04070ed8a6cbaf09a3cdecf19b4162bc31da1090ffc4a27b327a20cdb60f64d281cbad02afc5f5c685b18e0a6abcf29a908a0a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5451d28ebcb6feeb0ec86c00dc178abd

SHA1
23b630d56fb29ed4618b500eb43c46a819c227b0

SHA256
75795c2e8fa2ab94c2247739dc889558ccf6e3c9262e231dbbe3bce569d17915

SHA512
a0772b62f2fdd800d6a71cff6facc5fb568e4e352354f335499b738ad54c4074185533197dfb7b7cf3a682b0760a540b4cf0fd2bd98f06f9373e7e3a9b8d5695

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8fdfe7eab0b6455dba356c5116f9894a

SHA1
002ee311b27f3fc9822fe84e4d1028d434e7c401

SHA256
0bb1a67ab8678345d661845e8261b160edceb99af30c73907e0030717502955d

SHA512
6a8eb74cd8f820efde363c21334910ec06e659cbc542e1b78f00eb437112ef7e46f802c9c59318f23b9e5e0562b14c8a0475e83cdd49b3e0bd78bd69735d79c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b10306d4f64388834dbf54b2d2c953ae

SHA1
69c07f2e7d32cbcb20b9d73c6bb9a0c5020db0b8

SHA256
5969b5a7b4f91aba465403779059cb99680c30a82784f3a736b644a43949448d

SHA512
76a7f9b875e7e0efb163fea331c8087eb5887794b3835eaf7969149aa8975bc08d4e52a895245dc9c193242b3037216668916dd8c8f94cddd1cf45bb1e6c9f42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5588aeb68b5b8c996543bcf490d4d691

SHA1
a526e54a239f1d8665a5f6e93dd920b527ce2e66

SHA256
b3e6bc8ea39ea1fc99dea51391c79eb9accba262726e99ce28542f3fc5160318

SHA512
6f0887d014a02179b94d10eca08e322d77c7ab6fd8d86b4e045ce8422c341b7f95d0dffa70aa64ecdbd2f5619770c99cd0f01eeeeb7a26de1e95c5acfbacdd71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76709d40db6caf65ddf8500ddab76938

SHA1
ebd3603263fe2ea87bc50dc0d5105e51856cfd59

SHA256
6c640f8906e70f4b75571ccaa8b553c1ff599ae0eb93107a39c9428a3f702f16

SHA512
83a594ee7e0075b0bd2e041b00754053fde94298c7aef3c3fc021ed2c9760a968f1359388395549b35f065f3a9da27099dc74205c11a3141725ae007c11b1fe4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51edaaf98a7f8e2ae2b2c392b9d15bb3

SHA1
3a3f3ad38c4076eeb7c26f587fe364eead514121

SHA256
a7c24e1bb81c24e0d6749b34ada5e15affe6702299699d6ebe239776bf62a1ea

SHA512
c623659cb8496a2bc76adaaa37241aae8eaf59e52468f689031cf1b2757c0a7d090a1b0cdaaf043abb152556f8763707b4f3cd256e5210e295344960aa77ee11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8cf9ec49e95cd3da8e47c680660be374

SHA1
26a34dcbc61aabf38e3e6e52470212d0e77fe3d4

SHA256
16896bc3927cb956ffe80923bce5ab187c480b49116f32931c4297aab928d020

SHA512
220399d87fe454557aeb704c0589c72a8ab865693d34ad0a3c52828e03caebcd73f6c40bb2cf33124f6e9507987ebbf048eb1d21d2f878391e2a30b6bb855915

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f057d731835964e2573c34c6670c9c90

SHA1
64012751cbdd17cc92e4790bd9b8d9b515dd3bd6

SHA256
e54c6a2b6bf49fe5e9e69f6cb1dabf72cd43f47f8ad8bd814bfa026d52f4428f

SHA512
79b14e6addc39a86af83d3947320ce1e8b107de8fb1190067199c6c134b4711e92b968c1e41e4b64d8d9cb7bb36fd17e43dfd50158fbfca2445507189ab1d669

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6f779f43cad5d41e3b76e188479ff97

SHA1
2b1f3a60546535285ef83b942d35dca4a6333ab1

SHA256
2f7d035629c5f56b238c8495304950e71343a7260b225a141b8ff9cfe9a80493

SHA512
e3269521407c929a121e6d268109c3a0292d493aa404b13761d70cc850d58be06a8af2ca408932aef7de374c73d55bea1acc81aa6d9b2b1ac97a3a1f2ffc3e8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD0AA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD159.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit