4a75ed840615168cefe7df9fb212735d052b89f21106a63122c72ee1483d6350

Analysis

max time kernel
69s
max time network
136s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
28/07/2024, 00:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03a68a45a717ee30dbb03a4fa4cc8bcc_JaffaCakes118.html
Size

28KB
MD5

03a68a45a717ee30dbb03a4fa4cc8bcc
SHA1

9696786eeadfc24942679f6e9db437787e0c2950
SHA256

4a75ed840615168cefe7df9fb212735d052b89f21106a63122c72ee1483d6350
SHA512

d4614f5942b160fbb77c4f8a20c17395f9b9c7a6a9f35be8080c3deaf716f118767a032e0a822e427024de37da5ee782b9fc98f768a2f6f229b046e25e07e89e
SSDEEP

768:7MPMorcd593Pc59OkgNABdZ9OjnpD1p+tVGiF:APMBd590597CADZ9unpD1p+tVGiF

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000008a00dc5a19570ce1bb4cdd238978ee495b2ff47df9071dd4bd2333e12f5c81bd000000000e8000000002000020000000dd260a95e42faff5aea43104462e2ce1bcac0fd1bb90860b95b8d3d0e01c05d220000000221c01002a46bfd46268d595a9951ba5c7344cb2c9937aac4366957195beb9d640000000aa8834dd97fc082aa870e083266cdcc71ee076ea885be9ba7fcde7ede725d65d51f8b916025915e85f1247948153ec5739f575bdb01f9538ca41628f115f9ced	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4045472888e2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{50789B41-4E7B-11EF-B39C-C278C12D1CB0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000000a6f4f797d70b8a254966bf944238837b2317700162936ee4aebba537129441e000000000e800000000200002000000089093ca66c7bac7f6125cdb988b349d27592a13f21172eece1d2ba3aef4c5e7190000000b934d2f6d4cf655844844fb768d0044865def197ce36d4dd5b24051c1172f3969a5aa2fdc69f40343a9a1fe7c0e319c98922feb76695881f559e0240ebcec1f185c1987e0bd2c94787faa588f03ea3263c524c57e46366d8c83bb804ab564a5e66c07ac55967720d76f57c2044f856d5f87bee570b841668e06f849e4a97b4807c24f657ea71c26f8e25fa58b2db7bee40000000f1d79fb34403f1dc7529c15ef804b1d3ba3c68c04d3fc6adc18151ddb5db672b63244464bd54f8e6eb7809394cbbd098a8a6f4665c21e50f86c307d382009751	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2904	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2904	iexplore.exe
2904	iexplore.exe
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2264	2904	iexplore.exe	29
PID 2904 wrote to memory of 2264	2904	iexplore.exe	29
PID 2904 wrote to memory of 2264	2904	iexplore.exe	29
PID 2904 wrote to memory of 2264	2904	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\03a68a45a717ee30dbb03a4fa4cc8bcc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2904 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e78da1cfdbef648d04ac5c84ea8e143b

SHA1
910e9700d9db45cd8faaf18d0d06184139a7236e

SHA256
5b53bb32143e34dfdec1276c3c514c50f45a3f65059a89472ee02de1a94c13d6

SHA512
83e52b1f39af7495e034419d6ed8bd71581cafd80423e9a89f6326fd25567beb7068f2666874ac786a51d52219d6c347a81b30dc1245c3ffc0cb6f8967fc2c69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b1a9c303ad8e5810939ecfa0e41841c

SHA1
d3189f7950def4d53e7de9605db9b6c69e1e9ecc

SHA256
96fd0b0e928739c09c26e7282258adf083125c5e6f3481b7011d0e292981a6e3

SHA512
60636fd62134702dc43f76da307c6d131c3b8378ccdf310a6606b70cdcc5b6a30d7b70afb243e1233add038cdfc1409ace7f705d909cf33c8d5cb2f3482a927d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aac6c4e2385c405ea3aa5213a769ce65

SHA1
645130ff2c7d196374e01b77e47a0ef75c2f9434

SHA256
ffeb8e9f0b3aa83499aa7b81133275939a71bf28f7b752ad5d052af51eda81c3

SHA512
d9610391bcde8901e90aceead50fdd413249735db85a21522536a2e262a4ba8fca53b0dbd0601bda53de521bc21115d04abb94dc87f22b0649363f3d45905a6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
681dc1a99f2651ee56bbcc28c6fdd041

SHA1
b83064810f7b5ce90721fc6a61ddc0c7b1f188fa

SHA256
dfd5abe27f60ee1b901644ee76fa9a23b7c428395d2037549fd8f384e8e23ec8

SHA512
7d8511c170f1ea5ae3df51a32b02cb5cbbb1d44b9405e2c9834b52f66e8528c390dfbddaf979bcbebd2f0242baee17e8ce1745a800a17fd8a1575681d3a7543c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0fea5bc11c6d6360914745114d3db00

SHA1
c4e382a1ac44321340495f3d182455eb9d4c95a2

SHA256
8655bc07648c074ced7a11857f27e49f04f2efe5db210044bb163063508fb5f6

SHA512
834b057531f2a7a41411453e70c7b673d0e7781bdadd83dccedd0371cd926b47a1d7b0fe7701748c1db2af6dd2686018a963c94ea80c8ee917f4c7668a1e8a20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e13c2cc36a563e0aba5d27bec96e4147

SHA1
5c475351ab21c145d6b7562f9b1251d96e0ae7ba

SHA256
e7138d621742a60e507a7aea96656808093df56a021ae266b53ab8aad2b65f2f

SHA512
d73480cf3f0dc469d763446113b98e88b0de5834ba362b9bc8b415840e413079c4abcaa0cdff6d67cf166d18b4e6f6108c1947046ea87ad18eaba273eff421b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cadda13f536b730526ed181cf1848fb8

SHA1
c097f8d44b5cc8ee1a927c0d5c8b1d248f75967a

SHA256
69910572c5d343baff44914d82edf85438226ffc18053e6dbd1e55db8221ffff

SHA512
af28114ae52289cdef7cd974e63285fd70c1b5d12e8ccdf809283826503a3724229ed96d227139435ab5fd529e9a98d5c55d830aaa2e91a7e005e06273bb6192

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4f15be50c09b65ec9ca23415573f2e5

SHA1
22b0ee2be23fd0a5d154e23d266f52f5a5ba3768

SHA256
9bb5aaaff92f6687e24bc756360fdba3d32630f165072704eca5bb49ba2be4ea

SHA512
9109ce491273b1f72f1f80bd812a0d41524fec97ef52e15830669c800b6d947e66bea307c18f204f5494f971eb80f3a96785f19db84452b7c87eb1754b25e21b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86524459036c54d30964a86cee479102

SHA1
5c03c1515ba926863a5259a6835ec0ba3cb6ec13

SHA256
7a6415805ae7d6d7da8bf48986b0df9d8603769fb4322335ff97ab284a5aee96

SHA512
5942d1e92142e648c407b908d3f96a878d54b74c33dd1ef734ef8d894e2b518cbdb84797ae26399d672d98262e8e9a78cd6c9ce5a5590a60f3bb9cfaba14e6b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90f659bc85db9d95a2f5e91cba725b29

SHA1
8167bb8bcc3706bc1fa3d0c11d13beaa592b8c92

SHA256
71cd3b2dd3390e35d1206791c797e96bd55fa90e3c752686232f66e0667a4a5a

SHA512
05b4533259234001c313dc02d532061ee4e413b90d863ab79cb00fc9a15c39a45a3bf4ea8352d3d8e86d17af0aee24779adfc4c73ea93ccaea4823c0d6ce9045

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9ae223fe45de0fcdd53d6069d5311d8

SHA1
f26e865128a7f75293308593ecdd08daa003af2f

SHA256
3e3052adc4cb36ec5f9e0faf9e0418b9f6f85821f303d894e93b31b52ef95707

SHA512
fd21a3df9589e610b37ced068131d91a0a4246736972021a8cd858a696e4f95bd14b5e92e3b036ca107387e958a3db7036c2df738e08cddb91f42761c1bc77fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48ddda25828b013da2d2f41d0ee8ba46

SHA1
42948ed0c3bdc45db6b7627c2c6a12cf3031b45e

SHA256
1b4441227d22de80e5eaba0edb560740dbe1908540e9c57ddbaa9edaf3dde661

SHA512
9a396e8b21ea9516f5b3f5a5baeceff49e177461a1aabba5ef5738869bf6e24facf2f3c1c1e80538e677d83091b2fb988c5dc4f56f4d82926f8c4208f539335d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d0520786a60e5f065b3e4556559cdd8

SHA1
589e4e368e82622c3dd823c3b6138e7487a24bdd

SHA256
463a49b0f0774488e2b32091be4d6ee2bfbf625bb9b2402ef11bebf2e38f9f41

SHA512
8e1beaf7e4f95c338221fac79e09771c093f54718afb461a04826c2e995da478ef3073ee0588e8e9bff40c47666d84bed2ee740bcb97a0c3d4221141d7985b59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ddd8391b700c15a3d20107278b5953e

SHA1
28f9d7643deeee8e34a8ff3600787d5989e69a5d

SHA256
93ce9cf6d33a0d784f391ceee704bef1e553b966d8b946bc411a80916f736f26

SHA512
d1a992ceac44d958550c78c1ad8e8a555e8ce6bd6fdb4c1c7bf5e82eaf7a7d572be4496c624b02b0354f75f79c023c36c773304c2aea3b023aff9d38509058f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93ab3c82f267657e21864080fa8e4040

SHA1
cc9082020db782040ebbe0983d4279bf125d2327

SHA256
81c7a3105692ad958f0bb6b94df91ae9099caac4a5a841b50cbe2a861957f7dd

SHA512
63ddde5f2f14b1c70b42f6ab7d678f418a1d4ce794c5470568ca0ac12674823f9a8f165d1854bec02efc5139b0c20555bbe6e866258b9a40fe0cf98deafdb01a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7e76ff51cf712098745d8d9f8c88475

SHA1
7c859c70e72e1b46426954a42550eddff49cd550

SHA256
c53baaa32a5da76ebf320139e872250862a936d64757b4135a252a68b7a93a67

SHA512
810c6f93c2f326978c7d32c664bd2044e6ce69f275be11091722939074f22920fcd9e496d845748b1bbefc143b153a548e17d75639f31b2e0978ffff2274d222

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
573a9e8e2ab274fe424bb21ba9c5ce6b

SHA1
84d679f5301e12c641fb5497f60af08fe15cbfec

SHA256
5dee1718cbe4d830b04c7e92126e19e72e9ddaa62add09603cb6b881125f6442

SHA512
ee6114229c13f31d527bd1fc84335ad726c133d729645e6ef8dd4c26dd32dc5ff152d9c7dd83dc06936519ae485315afc853948d5cb8bf95f5fbeb0fcdb200aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2FE8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2FE9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit