7a71926019836f68857e27a008a6a2e3e50616b9d773291d3d60b3ab9ed16de0

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18/10/2024, 10:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

56e83c5c6b10e28f8305318c45d551f3_JaffaCakes118.html
Size

7KB
MD5

56e83c5c6b10e28f8305318c45d551f3
SHA1

837eef2d250adb8665b7d270c76f2bfc7d0bf401
SHA256

7a71926019836f68857e27a008a6a2e3e50616b9d773291d3d60b3ab9ed16de0
SHA512

6a3237c446eb335de1e8f34a329e689067368b27bbdec772a40f3c7f21d3876da82cd52427f6cedbe9ab481de50cffa509a634ddb686c856eeb9a1c458962d41
SSDEEP

96:uzVs+ux79/LLY1k9o84d12ef7CSTUAzMcEZ7ru7f:csz79/AYS/2b76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E18397E1-8D3A-11EF-A1CA-D22B03723C32} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40eb48b94721db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000235d3b2b1e5b6c46abd19b82ba0ce9b90000000002000000000010660000000100002000000003e6ee5267f87f7b752a21eedccd24f5fe47f7701809bfaf6baf004da1387e7f000000000e80000000020000200000003e725f81808af60e17f408b93d6ccb6486f0a7d3316c8db2bcfbdeb45b087200900000007ce42b0571dc3aa7c41d74958f2fad1aff6cf48ddf5eee2b79ddf57c18c9462c47e3d8af1edd1524f1b5330ad7ae5968e1e64561c087c6cbef2d3604448bd91f579010a4d0070b8af1737c413f016e0eceb2bef51d346dd91c23810a8a7ab734d19d5dc8ffe522aa0aad29e78ae171f9f92c0e13d576ca70ea508d1fe08b5f0ce31b218d5b960145a9f92a44061c6f2440000000bb30081812f99020a547b1349b9ccb0f95a27971fc947cecb76da16f900d5a88be94c1fe2cda89f683e91e12411c5db8b3be9e8faa717a169f23cc01e215c281	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435408818"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000235d3b2b1e5b6c46abd19b82ba0ce9b90000000002000000000010660000000100002000000007dba2f95315ae3be4f044b6f4ba9181c02164a4c45263669d33a20f7a2f67fd000000000e80000000020000200000007b6663ff6e05b1a360dde70e7dd64a7642f5d1ca3fdca8c3d774a19a1ccbfc7f20000000ccbbb4bfb2e7571c9c4132cba602caa943f89b037a5ebd5c43128800afe79c81400000006e6e1db5e743b5b54a255a49193c6b2512252f46756e919ecf569055d787c66eb2a06cdabf06b7463ec3229ea3b246843cb32c59d4bad7da6d47b95a8aff1699	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1604	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1604	iexplore.exe
1604	iexplore.exe
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE
2164	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1604 wrote to memory of 2164	1604	iexplore.exe	28
PID 1604 wrote to memory of 2164	1604	iexplore.exe	28
PID 1604 wrote to memory of 2164	1604	iexplore.exe	28
PID 1604 wrote to memory of 2164	1604	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\56e83c5c6b10e28f8305318c45d551f3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1604
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1604 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc244013db1c7103d7aa4e6b38695da1

SHA1
07943530a46690afb53b9602ef5d13ff925bd2ef

SHA256
cb9c9ae8a31c46ed9743abc24a57c59f4e725d54d632012be4656841727728d3

SHA512
a51fa88399a90e2a627a0f0d49e7103950111adf778fa3a2f61d734fd1d5918198414c55ecba0a2c53257da4b77ba712e90c8b470f03d9d2338fd0be57090aaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4252083b1986f50c32630fba8bab9b9b

SHA1
01679db9be330e725dfc1863679dd554e5d0248c

SHA256
543babfba5454825540688ea7de566fcb0ad144501b381a3067e67baa3992125

SHA512
882f649d3d1dfb9cb7f99b15d6ec31d68c49e67e87a0dac5c56c52d98ded10c14d7895d7745c729c18104ae196e028e14e7e4df98a940a9ce6a9543a4bfe23bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be8e9ab565e1dc31ebf31cc354474004

SHA1
736bb3b3fcc1deeaf8205a536b5af63db8160d37

SHA256
6792cc9a817236a5fe5b27565852a246ee2545b30a63afadb30c0199f418e3b8

SHA512
48bb7a92bc8fdebbd89c63f1ca9c8730d02e4d185d07fe791a5f17b4a7346e38b867a01a1c016aeb40c76b4fcb8132d464a94ee3bfc037f8ea45b3b0a831577e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ce800d02c528a9393d066b7b3b9802c

SHA1
732a0a04874acebc55d63c46a9bd611576777c5d

SHA256
1076932a8648466c4c388f46fe986facf88ba53fc840d2ee3e0c646997b643d8

SHA512
8d949306bf3829a1462110c4d696372ea95233c452e6ac0785efa0e7bf03eb5ee52f327bf7ec811439bb9966d9d7753fca4bf34a685d27ee1adc574626420920

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94fcc8e14e5218734e86692f1a46b348

SHA1
1c4de4849fce47dff89604cec879d62a240a59b8

SHA256
1e044d40fdef026808ef9708e7372ac5216deb8e56b07d50941a9d37da70eb5e

SHA512
0028c3a8a80e8d2303071d70d744678cea9db2269ab917ea51256ae9861b4ebcb9e9ac09c0d7d6035cc5de01f0c3addb8f3584f1963fb28f2296a44e9603289c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
074d9e7ba21e8c536190f65ad0870bca

SHA1
6f9390387cafe55926b471f641d3f2558512065f

SHA256
da95fbbf0452c9536e8a0b68464a2eb8c6cd400a84deeba4087af4f703a4c0e2

SHA512
aab52abbd84e99e036b3841f06dd55aa91be866510758fa0f1e335436e006afacd6213f14f40dd90f2a52f08bbe8555eac3db719325f01f5486e8fe2c3cbbc37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7fded3c415e50879d44510dd75d27752

SHA1
e30537b08da73a9832a5ae1aa62ad0b7eb4383c9

SHA256
5987ec2f1ef86c001fea329e78041533d1fcdbb37d8d99b959290cbc6d765c19

SHA512
fdbc727863b91301dc6f7352c1d58ec26adacd41ce5dd6bad180f0a952433ee5c39b0c6805e4d5b89ac4fd397896984b0a0884fa6f2cb0e3ecc628995d4aa8c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05865014efb1ce9ce7b289bd1f0dbc45

SHA1
78ca9adefda2bee198fa02ac4fc2d31bf45a8d3e

SHA256
cfaa5f6582bb79bba523ef1c5e72e9e466686302c995ad13c3ba0974268951c1

SHA512
3ad769d6ee92e13ccf3086acbbf02eaa46b477d0e982172198d9f98f3b4f39fa1265f60776337ac7f24d956531c186c3d17fca0fda2db1d51486deb45aa19f80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c361af5b7a7c65e4fac65194231ecfc0

SHA1
fd71ea63af6e470a84a8ad4513e9f7b149fd74b0

SHA256
b6fc9217e769926513c9c2e9cc7f83e034650ddb251c2dcb5fdc4d794eda84a9

SHA512
beacbdbbfca9e601e573bee76b7302bb616d3cbf595336052923af99ccc2f0029c74e636b35973ef123407c774a755a03b39c04582c725cad7eb7a3cc9b9a030

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7f4453322cf12116cffccda310fd656

SHA1
faf6059ffafb5ddaada63f4174949c9f53137aed

SHA256
7aa143a80e35105138a1cb3bf9a1533609d5ee2d79d87253606a63463c0f5746

SHA512
c5342b56ace9ba10c8b03d1d5c329352621684cac6bec3ee3a9d35097e4780e1bd63006c795fa9381ad6bf53cdd8676f2e655fd358259d4c19a83ec8ad608d02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
883acfff1c7ad5236ad412fff9c45f30

SHA1
5de63800464d7ce7671a2d85e70151abb88ead18

SHA256
1d6ee3dc6c860c417c32f5e87bda6f661c961851228184bf3d334f433f495a59

SHA512
054b45c22e6821ba39d5084077137dc86fe64177be093765da84b183ea7bb702667d155b1aa83dbf60b5e5dc41753004fd8a8abe3be32fa9674be12548878f63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c775590bc36508060e57e9c42c893376

SHA1
9baed636929b020fa7dd05f926f8d25e3f103237

SHA256
bc5e463a0ea1cf3e153b8e42a71b0759f12af6e9579663091d55b2805aaf9a2b

SHA512
fe24efc9d0f922e01a98cff4b3c642032fac53a6d4c22564f80b408cbe084258dc7764cd5eac2234f0dd8d60d93f1fd4b443f060da246fe0bebb96bdde1641bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ce2b8cd2946eb4a71fc1e83fb2cea92

SHA1
d173890d2df8927f9bb574dc6da7aaf9e016324a

SHA256
d4dbb46f7179cc83c28682e0e1d39ef96bf074afba87b3f68ebc60c00c791cb9

SHA512
af793bc1bff23d7ee7072241590971587ccc491d59e2c527a00b3ef4a5b00f7e152301e69d04df00f411661ba7548f3fa1899a74c16eab22432525d3c9196d62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e8c54bf11c3bef58cfa7be451562b9e

SHA1
21cbce178673cafe330cdd15a95f082958656ae9

SHA256
80e5cc8d3cad34effdc18ec14234327f13d9168a61a8e6961dc980b91ae2ca4c

SHA512
f961c119c9fe14b59cee2ec8d21ab5021dbb8045f981d174b2b63ca5f5bed764a28ab3d90714ae0295578a23272bd07399553384c3e4a7e0f31bdce75ac924e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
286433966f086b0634f2d25a43f3fdb5

SHA1
9af77ff165410315604caf61633a66f9ea9a029d

SHA256
20ae809e003619f4937b868fffea1f0c6ca81548dc86af6851d93af625fdd4fd

SHA512
df7a57c69904f277a3f756caa7b93325ef458d9b2d48a699ed204e00a0a62f2b2f2f4e67f9d78fbbe27170238df057d14ba01d2cbbb05925fe45b08bafa3fbeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBAD8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBB88.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit