6cde363798ff85ea1c8179dc8a01995d4a7c6b75c4c04f94b139494bb29c2bdd

Analysis

max time kernel
119s
max time network
147s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24-07-2024 06:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6a8dbff2af535b3abd0b1c564e179407_JaffaCakes118.html
Size

1KB
MD5

6a8dbff2af535b3abd0b1c564e179407
SHA1

6be849b8bec30c49cb75794e13fe5c2f1e69731b
SHA256

6cde363798ff85ea1c8179dc8a01995d4a7c6b75c4c04f94b139494bb29c2bdd
SHA512

d3f894300db1d9b672ceba1790d8ddc5439291527f20dcc645051b44689a4bc46eea22a7f1d6d3da40e6aba284b6493b80a4d231b2c2bb00280d4b11d2aab9c3

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000b94982f5cd9d1fb8056177aa393b47b5eeea77ddbb8cf11896eb922baf892b0e000000000e800000000200002000000056c9b33da47fe3cb26657079d8a8d7c4446b6987cb20e0b20ec91ee0e8d1f8382000000015c7d7841db3fcdfba9880f006ab88c51c50eebf4f1918d93daf3539df7699fa40000000a2a9b0b1fb80d2222484b57182565c9bce19b45905104a9092de0d024c804ebe6bafbde425c317c627c50286aab66e59c1f16e866dbe8cd10eb4ecd5e21892e7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427963916"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D8301FF1-4984-11EF-B8BF-428107983482} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00f2a1bb91ddda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000026b312a20c17ee854d9ed1cc96999f87b4d3fc6d857f104bdd973a87a72a2a58000000000e80000000020000200000004b4c8af280adca14467476c7ae46a8e461cc6321c40ed2b355adba533e781a349000000066fc341b148ee335ee4902805cc43a7ab9facb76e7ae65b46f7f42be2ad61eb46d7a36638023dcdef8aa653570dc09ecc240c4520cbbf54d11ba9cc20c94d3a8986a49a6232924e6996adb32b0ccf7ae55e139ebb6ba3d9768e2b7ff69f7b65d6b9d1fe3566a01db07c5eacf47dcbd4deb081cb9bb3517d658eed073bb9d19eaae2bf4a9a604f6fe9c479c8fced73e414000000024dd7f5225d3e8acedbe9d293966955ae455aa5272a16886d96dd25a5fa8cf79bc0f23442f59124ec344d7b5c4eca45c940d8e448e9d3d72f53fd6828d4884db	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2964	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2964	iexplore.exe
2964	iexplore.exe
1844	IEXPLORE.EXE
1844	IEXPLORE.EXE
1844	IEXPLORE.EXE
1844	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 1844	2964	iexplore.exe	30
PID 2964 wrote to memory of 1844	2964	iexplore.exe	30
PID 2964 wrote to memory of 1844	2964	iexplore.exe	30
PID 2964 wrote to memory of 1844	2964	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6a8dbff2af535b3abd0b1c564e179407_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2964 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c0c27210ba597c6281d2b01fb25af71

SHA1
241798173706336b7f68ada18be00fc3d4f60d60

SHA256
a2ee47d944ebf57c38367cbfef341ae5aff367eba23686b175cbef19cba1258f

SHA512
25e36132f56b37e6656796a8f73f69002116b16b2230f1d387dfc93007a959e32106e5a68cba45b55d913d188c6f76103a37d863ee7272d2bc5231f1dba945f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f98088e147179b692ecf64f175548ef

SHA1
0d17a8ad18da80ddb5e85e956b5e0dbfa1027692

SHA256
d845735a1915a98b2d7c6ea87ad2bcf92c9604c3ccef0840a97873274059e8bb

SHA512
1d91335307c3d60bfb3c043408fb3439bcbc59e41999abebc000d18e378d86587e35fd3079e08ec671f082ae431637fda5b12bf36c1fe2fcd793dbe66610fd71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
accc064235b6a5e6d7a961902dba7e35

SHA1
1e39d2742d78dcc46f6848255bcbfe5cc9c783bf

SHA256
f2fadeac79e39b11fdf4130b6638cf9665347fd966fe61f0f39b7dab8dd38efb

SHA512
91bf92ea8e8a52cbd9dfc8f3f8936e7d9a39975b9507ba971a6d95e205153b8fecebc062ab69d0959ca2c9a3aa349748dd223993c3826ecbb49b42225a270912

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c5a5044151924041eea14ce1fb64519

SHA1
e0122567a293541c60f8712a5d373a88c59579bd

SHA256
922a95fb0fe082392c961a3ee9bb3fd1b5316df7f38838ef650d28189a10d5c5

SHA512
7ab15c914808a4f463c78ffeb11cd6cab909e3b6d9f96b0ff221ba04da164ceab3a192f32a7d7c451a377f5439a36ab558f56464b35aa901c78af5d468ff91a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a03b8cca91aa7903af916df2461a57c6

SHA1
e5e44a1c48d2e2adb3d341a970bb4948c9741b91

SHA256
2f1a2ff76d952ad8bbd11fe2d024f61b82daa1c28c63c22083fe4de72d4f1991

SHA512
e2b43e0dc896821ebe3688a42aac3614c989484ac9f4b9f15961e4d774c6a1280b1eb36c81a788827650579965dec18838f6b106baffb815082c7b7b5801d3d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2dcdf0d4b7ea07fe64571bfb7fc14aa6

SHA1
6812473f280b5538ade432c10f0d1d4ff5234c28

SHA256
8fd64e0c97082cc2d3ee520933bbf4221e419bbcf55154f30ab7aa190588d7a4

SHA512
231440a251cf05e79613be78cfe6420df745e6d1081511ed28b9915b8c43090f367c1e42376394ccf9a60dfd925aac16791d4b96ba4b4a69b300b4b88d517615

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7b4658894e696b7e501747f9f5e7379

SHA1
fc67bdcf3e9af640136fd85e87e50eb581c26194

SHA256
0b07103759900bcbcd5ebce337bd8c501bae74bf1cd758a37453c0b3b94b3a71

SHA512
5d0119477a798fd3928f5765dbfe8bb79eeffe72c209fe91318875a13f18b1da0180a5d07672c47ed34038af6e8b5d67935e6d696ce934b297773e199f55e5f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8bb0bf5c3ab47e006f1a7ae7d0a91607

SHA1
13d5b8361950ce4a4207343ea1c5e1acd0c35d19

SHA256
65ebdafb5f58226f62e3cd935eb1c5f8e9b192fb405d9f80c904500113ce4db0

SHA512
060da5cab23fccad6b8619d247dddbd8a313d67923f7e4af4dade65c2618b1d2cc6f056547ca9bda595e3d66461b844f1b4852dc47e83aebb1625d6bcbe8008e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
675686bad3d65f17ce069464f92c6ccd

SHA1
0138918f47de6a40b1379142fdc7bebe8696ac31

SHA256
632030627d1c5f6a99fb46a0bddc4061ac80b441d49bb7033bc2a98b7d8fd3cb

SHA512
b6915974ea870a4e127a0cd9547383b43da1e79ec0ebba02dc487552120636b24a511b6b00511aeb65a786b8b757fb2ab4b13828315e48b6f17317b3cbac6655

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d0f6347500c54635eab61b93d76fc00

SHA1
5011e5431b2c77d7c2a06c25558848d74bd3894e

SHA256
858730f4eccfa2931d90e738d32eb8072d35c3c5539a5e38e5b8689cf3092f55

SHA512
4a80caa3a22b0462babd4ed03eea37d77a699e5e068974ea18411d82d57805bbd89e03ec60c6f5ef7ab905cfe3656e0307cd0a5e01012afb20ce70713f217f29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d3ac1e29bc3a9ac5ecd6ed8975fd89d

SHA1
892075bb154112bf19c3ce6ea7f9f00a862bac25

SHA256
25bd203522d21e43181eb4991263df09c476b9e198e981254213493c1d50308f

SHA512
c97cc1791d40359a0f8db844716cc0d2447d4dad46dc590e18c85e0f20c78d8879708ee7effffb24b601e7029553b2bee8752fb3a35b808c84330afac963260a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8283e4de411a1aa63152460b9c28ed40

SHA1
2be390d8ac1b3915964dd329803a26e0154bf37e

SHA256
5eecc4d96ea059f4a5026d091e791e932b9834567e6deecb874c3a89ac6f19b5

SHA512
9165b03df266e0856f83d386efb30f71516d0edb3d56f0a6a268f47ad987d819ec4aed671377fff664d25c6bb4e443559a026e152c77d1273d40475c4e9a8be0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a053521305e33f4d365e4969dd50fee

SHA1
3cbe0688413d6b965add83768b8e626a5eb7e597

SHA256
d6c6e26271cd207a5afef61bd748a58a5bf849e0d730874c9f8f8e7a52f4d9d0

SHA512
67fa5475430a6d9f9bc5cadc04074ff9612a5377ade6717ccaf6d53b544821b2e973daa599d5775a6aaa70cee7e2b667e57259e24ea59360669d37a096e9ee3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d7522a574a9b77ccf1760eeb8934dfc

SHA1
99b9ea419aa5f546bb949a08127237e99da4d9b2

SHA256
9fa74933d6c4503dc8c104932408a6748eefc9f069d6decbc64d9edb08750778

SHA512
d1704afb9abf7f581f5d96c59e56e3f8099e6ee921cfd725ba57196b1c97c70507b6316258339d8c16c1f512f467215650ad3f210032fb39f102ceed76fdb212

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab19DA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1A89.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit