1a5b4d0c4128fc7959b2b8451bcfeb572f34e99b587efcfa99a1b167d4837c2d

Analysis

max time kernel
118s
max time network
148s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16/08/2024, 23:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a064205eca7cd905a20d60b9097dd0f1_JaffaCakes118.html
Size

1KB
MD5

a064205eca7cd905a20d60b9097dd0f1
SHA1

68c31dd14187c7a1dbf28da034e8ef294a9916d0
SHA256

1a5b4d0c4128fc7959b2b8451bcfeb572f34e99b587efcfa99a1b167d4837c2d
SHA512

f2e1cfbd65edd56275fd70c6e007a6154f98b9db48dfc59c77f2d114cb2af2fd960569504a03c17853f7a03ffd4836a57657cba7b6d4e7332e2ef69c391de2ef

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d026bd1235f0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000337d109c073b7c0e18908d1e47e8c220d9b6c615229a4cc5bd3a1cc9fbdc7d5f000000000e8000000002000020000000cb23931d3b3a765a027506dff926a8e1c891049f6cf93bc06a397546d98ebf862000000011905485776422799ea84783f8ea27375b74e94871fbe2b4fc4b75b4e4f2d84040000000d534bc9d52f381cada38d351789fdeb93afcafe939a475cc3d9628444c33471b605ad58d09a1bc9840fd9847f93a631d6071a09fa86aa604e31ab558f38be763	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3E311511-5C28-11EF-838F-D692ACB8436A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430013225"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000004b6b23482530e84c95a5f7d76758522e39d2c9b2c42f53b007e39b0a6d2266df000000000e800000000200002000000065cff80336c6de7bbc2ee14ed6bb6132ae896da6cc053e8f19ac66881d4fbc98900000007cd2be5d79eee02dd86e140ce28965f2360a429f89ae88846872cfa17229a12b40cb8e845bc86c630eaea700e445a159ffd5f5a2d3b857950416b8f38d97cbca5c6b270f36a75bf7ef64d9b566a1aae856f43d84a8d4e88c4e7fc5c1c1fe6fc1dbd4d45f9d9ac303a071166dd4c91212773cb218f7887ba3c04d35554d6855407ad6ec097c9b901e5270686831100b02400000005278ee4b683de1a9b9593223f9b8a085dc0aa4cb5839045f0985e88b3f2f2d54e68740563376b8cab7135d69e7616ebffb8c698e7995132a115d692f4df0b6ae	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2724	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2724	iexplore.exe
2724	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2748	2724	iexplore.exe	30
PID 2724 wrote to memory of 2748	2724	iexplore.exe	30
PID 2724 wrote to memory of 2748	2724	iexplore.exe	30
PID 2724 wrote to memory of 2748	2724	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a064205eca7cd905a20d60b9097dd0f1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2724 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e07438aea67af98cf0d8b23e0c94e71

SHA1
4c9292591a63a5395d4e25f772ff395b0f83b2d5

SHA256
6b5e53bf16d55f555563d14aca62e15220713c1154e829f159c50612d12fdc29

SHA512
f46febaab2b7786f54ccbea47108b21eb30b6e6692642071a86b254456ee3aa30a6a62c825b0c58f67cecd7e19dc603aaf109526a57122e6cc4067b147442486

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df3fdf5daabc0bc993013d5f9875c9f6

SHA1
e6ca44f0ae23a89feadf07f441b0ab3b54216379

SHA256
2712dd83ff436b905b12dde47821a8e11232b63c360107089abd1399a3d0e199

SHA512
ade88599719572f5c2a62928a9c6f97ea2d41ee616059015539cb2a420b6bb6b10fa2ba72d58df87d8f7aff43188859c0608aba99716f58dde75f7cc8d2a5547

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f11278d3e63aca512790bd2ba5b7ee85

SHA1
75ef45945e01b659df38c5a2673c48762dbe88c3

SHA256
4d3d80703f77c72ad9ddcdb78bfc31ad13b948e3cfdb6cd8cdfb76867dbd6ef5

SHA512
5e69d0fa9c162095ec3b30db9cd4008648447ad1fc2caed300b2e2f43148e93a9c489a0d66ac2ef002a7c6a59742186dfc2bc28ece469ef7b8b2bc3383570edb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
393b35e449a5669515a8cf2007ab44f6

SHA1
7afd6e55afd9c874b6b3daf56562a5949db9ff13

SHA256
63024a75e005b8c707ac1c0e6ef00d575c46d781165e1ac9f7a7d45b229ed82c

SHA512
e74dede0f2c6aa420bb25f4510e30ce64a33bd0dada76661dd4e41b858bd94553b7240c6fb3f8b4a4d23602fb32ce095ecc213b2b067fa81ab265fe6b55a0119

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4827a8c97cf8965e9928cf9263779034

SHA1
3f3ad4e2d9db443931119d41ccc2c1bddd186fe8

SHA256
2ce76cdc933289c99ae36c696fd59274dc6985602dd872275214e71f4bbbf51d

SHA512
253e1545edd124d823042c409c56e65864033306a9e779e2da0278d71e0a8e8cfdedc78ec63bf07ce44518000fdad1b55f59b63bae4197de410f87cb95b71748

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e5b22b79d277588c9fd150f1632be0e

SHA1
beef888d352c1f23aeddf24ac655eac2b30a658a

SHA256
12b50050e549dd1231a3f0d8b7a91537863b30430005be0fec48befd9c4497c5

SHA512
257943a794ba6eec6d8e4e732c3f3fad56932ae91da7dd201a012efadd4f44788bc13e97ba001397271988cf2190a004da87e50fbea604b131ada03c1a2a5405

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1c8409d6e9d5f0929a4876720b84743

SHA1
86f74a892f2f454ac5dd31e56c00e11a6f3e2d54

SHA256
c37c8eb289ef421a38a49ca33ce87956a5dc8c6f9ff9689efc6ac3ab6fe54a2f

SHA512
95e72e16c3a82184cb2a2b20f3784ba98d692f0b4cc21d2aef12eca807e2aa4404e7316da12a28f8243b85c88e5fd0893036520bf17e130e6b337a531b8fad4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71d681dcbb36fe37e6d4f20727a37cde

SHA1
e257eec5a1bc0d097415d7969a29b087dbeb81ba

SHA256
e65862452a341fcf3b90be90ad76c90cf3a0b058efa7914256345c0cd6c79211

SHA512
98740bb0ecd305827df42d4c07a00696c13065368ee71ac14d9e5f4e4f8020651ddfac926185f82734b9e73b8c907c732b05846563fbad4d083453c701667c76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a43119be239ec6fddaa10d903303997

SHA1
257fdf8b41bf0af61e909c1bda686298b019e72b

SHA256
67b121d36ad464f2a5cb31d145df74d14de436f9761d22e96ee5a5c95f784f2e

SHA512
b8847542576ee30922a3bd845216791b95060091a6c578295d35bff52da893026b26845e1f8123a5370479313f9fdfb4810e1f8310802c27ec5ab6ea0828d33e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab90CE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar92C4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit