a663209abcccfaff41b2b97b6817e0d01f510d36ebd44936ea8a206415152e1d

Analysis

max time kernel
67s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 11:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

95d3790bc25e98e42c39982b498c4e7a_JaffaCakes118.html
Size

3KB
MD5

95d3790bc25e98e42c39982b498c4e7a
SHA1

5d74a31f1d717c53ee9f7c3e01ecfc8d1f12a6f7
SHA256

a663209abcccfaff41b2b97b6817e0d01f510d36ebd44936ea8a206415152e1d
SHA512

4c1381561b1f528cd7816401c5ea6cf479d7ca3580e54b64e183d5496bfb5025f6398e26c021ef0350f4aeb01a8b4a597df2860c2918797ed1b794c4cccd06ed

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000044670ff960d33c1db6793eb3e30da43c8f0564d743992b0a90f5543408cb8af4000000000e80000000020000200000009539c40bda2840e6c12b8b975dbc16b1c2445b840f86404d4dc0e39321f9aa4520000000fda8e270ae0ccc40da4995ef090b18a6a72ebddd8c23dc9ce53f1f50e608a5094000000027aa402c7d0efb120d5abac2f766e3c9bdc65998c3ca466dbbc72f43b393bcaf10ea74cc8fe3df9170be20e3b6da9b6b6b9529c4879abf86913d2d7f19863141	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000000715c2eb9c6b81a4a3636644a8cdbcc1001248baf1f92e06bbcc69e7d12f30b8000000000e8000000002000020000000ae621eeb4c3442f1e5a45f898d675433de8352d045825048eebb7d80a6d95b4390000000b34b10833946b3bf914aab76573715e6794317f1dbf16108fe42b99493439f3b86c9d5cfe4fe0c1bcacd3d6f829771ffe09c468f47dad958a5f50041f1a5740fc2591d17ea3d258cd5e7821585310382f31989524edaea75be9e3f93e2df44a5c75804037bf1f63ec7f96b5aed7d44136a5c415b701bda49c4ff4dbe9080f03d6f55bc522d01841f925e5333413289e84000000039c43ba4404c7fb2d08370031f7ccba8ff36c974538b68a08bae28cc2f91189072772707361d48bf003c6e0fb22474041680c5eb907c09105f525bbe1b29fa0f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b031917439eeda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429795186"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A0208F61-5A2C-11EF-A839-E6BAD4272658} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2560	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2560	iexplore.exe
2560	iexplore.exe
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 2440	2560	iexplore.exe	30
PID 2560 wrote to memory of 2440	2560	iexplore.exe	30
PID 2560 wrote to memory of 2440	2560	iexplore.exe	30
PID 2560 wrote to memory of 2440	2560	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\95d3790bc25e98e42c39982b498c4e7a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2560 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04a943bd84ca4673b87a7ba1c43246c4

SHA1
cc9b62549fcb169865da9fa137ee478fada76726

SHA256
54ebe125389aac0eb1a7f207ea57b480017c5645622d89265b3bd09cfa0ccdf4

SHA512
68432ba3d4b518e7a06d362606b329486e87f300ffe11770a30d385d24491caf8c79dfb027c5d9832cd8484bacb2f0e57e3ce3f1238e0236a310e4e06bcca262

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cfd3de1faaba8bfe658d62fecfd069fc

SHA1
be496c7b8e491c4e138e1500b5d20da2b5609dc1

SHA256
7996ef14d2479f40f96b24fa949a7a035957ed29509e65cdc9421f90d097b516

SHA512
c216475ec27c006d529bec19aa4732c69b97904f366b25ea795cd9e17a1837f3d2fa3debb3e0da970ad2809b7f4cd63a962f3feb5f8ff5bff1962990d247f657

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ecf20016612493b9abbe15579bf02da2

SHA1
f711d88df05ae79cb02d42513c1c5ee6e6281755

SHA256
e5a8a24fc679133e86dcd29130a68c2a99d8925af7a46cf0e1062088697f48f5

SHA512
a7d59c55e6613f85bfc0323dc874124306fc432a8726a5cbfd9b054fded2a1852d6a797498f9be5fe9733d544739fabba8033c65a142df7a73994f40fa4e9719

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37e0dc128ac97a3f013f1168f828bc76

SHA1
6055eadea54b2f984f09b319933584cf094a209a

SHA256
127e1e500c449f60f6ee37db7d5e910f4a8072be89ca1c49f99eb5d0bd5a65e0

SHA512
73d19b945baaea75f8105c2cb305c53d1070bdad4890d04d5c4b571e70c2589e3ddce9c6f800e8fbeb9d8aa0346efa4001a128ff8a4b52ddbbf957fdda5296e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5b630326f4d8d0a22fecc31a4c88b62

SHA1
371c681dc00b9ba36b81c795c434d2a3486b2fb4

SHA256
0f756ada56e284a431fe45056b5b56bde2ac28c1af0288dfb4b57687d44a4990

SHA512
899f25a5836c56b6fecc0d2f77476abd9bbb286ec5c13df7b1d568197010453b940b9b8a6d550c941294471c27f9004a154bd03e17b16b9c3ef6c613c550df0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df4c77e3b4b3366b889efb38941403fb

SHA1
cb708925547d461a4690c543574d5b720612ebbd

SHA256
b825233bfe02879f8eb09a2ea1ce4b826a8aa7a85102b88e3255876d79186410

SHA512
8cd5cd4a45eef018e54a0f3a5c6de95d1f3bcc3c719df71cc9f5c8e71bd9684f76d828cd48e69ce8367bb1cf5010a5850a0f1c2fc32c4aefbffc2b83ecb36f44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0fb3cc99e4760d5fd38ba95c8902dc9e

SHA1
de148c04f6a99cbdba2bc00e37d3d28733489994

SHA256
6150d45d8ec07789cfb161004300ddcd71135e36ce4078b1f28ba92b5f3b0f1b

SHA512
0f72526ad1c84b44bc4e28df8a6b01d5eba3ddeb9085f74e32556c09bd4b2b69cc339cd3711bdae71dc756dd41e698e7b11e85192fccb43aea096c643d58a695

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da4e06b65badf0d9bd111fac1646f96a

SHA1
f68042ac153aa32274e47c1ea88169f35e192aca

SHA256
c01fad42877cf9053dc65f998c2884b6ccb8cd3ddf26d0e308b1c25f6ce7067b

SHA512
40f1c2e5b03c8b58126ad0641430804afdeae6cd42362d5676efa0d7d95e6f5471459499ac561d4be9a169b2e98ee4cf091318f2ab4ad410a8dfe650e9da061b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78bff25833639480f256b54024b3a5fc

SHA1
c7c76bda9d627c99378b0ebd9c29c45796cad5f4

SHA256
f6b1fd130ce96322a0a9f0e3c5b9e8df4cc2da4b9519d1fd19d9661d81f3be24

SHA512
899a100f10a84008340ccbcd9a542ad9b2d6838b1a2245a86e1275cf9e1cb6e18f922127e86b1255d71d4ff4169aaea6ade999eaa508ee23fe39bbca73286bd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88f4746732cb26be9c5fa7b382f00819

SHA1
8dadbf45e51c7133156480cf4fe5e1dbfc7ce0a8

SHA256
fbf1581d46ef2675edb7f13ddbd20d307a9c9f6f23c8987ee2900ee234a51a82

SHA512
263b299cf8a97aea49347941b755ba856db94d73f1029972cc7aab72e9725c40e94f0f30ef6a8da8f638d23667aac1ca31e467f957da63d4df24e9b2c8f39c2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23ccc64d3380fcb0b4ccdbdd61eb5103

SHA1
7400682545d1c255a24944490bbe5cc50238b886

SHA256
fe7e6f418a63886108fcb4da5047a4e195f3916796432f2d3769186aca24398e

SHA512
15e259c6217a7e882aae020906245a58e85c4e05b7299956313da4a5001397fcdc0bf7d801667ed756e1737b340e526fed6d4f9c08dd38f4b0a590067d83a623

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
507f7cdd61a060d4611a185802bea742

SHA1
3c9d44e1acb17802ff33a166ffba5e92936b81d9

SHA256
22e50547ae4577690e101111570a474b2ca10ef883020e11bd649d8c24572496

SHA512
7008f7787accc1736a81f6055ab601ebc75afe7220e6890ac63a034fb4915840666cce18dac65b0e9f27c8428f903eebef87a6e98af8e80347955debb4cbaaf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0eb71417758b91b4d8fba4f9b0b7518

SHA1
afc7585211fadef2a33541d5f4b49b1879d7d4d2

SHA256
ad9cd8b52e15b035197344209650feaef0c51d070c6b499ba77fbe2a8d0e8d0c

SHA512
ddd9b4ebec4301ee433f72720b64f4b81fa8c67d2b2aaed1e79bc8afddcff34346beebf88ca88ccdd05161a6fa5b4e0fbbbf9aac9724566c1a4a8ca5101f6ae6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBEB0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBF6F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit