ab4bc0664b33a6c37301e44b23b311e728f42d7855dd740b41fa9456e0db7187

Analysis

max time kernel
117s
max time network
130s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 22:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4594e45b9347d031dfe21ee4d080ff4_JaffaCakes118.html
Size

5KB
MD5

a4594e45b9347d031dfe21ee4d080ff4
SHA1

3dc0381533eddcbd73c104d1df6d980e4e89a1ce
SHA256

ab4bc0664b33a6c37301e44b23b311e728f42d7855dd740b41fa9456e0db7187
SHA512

5c85e4ae450d74a49893bb6c81b605bc9d4dcbd3b98d2c06cca0beb371346292e985d51f2568a54292bafea0c3f94c4a5e55af2ec43b2423881ea81a646b4838
SSDEEP

96:1IPyCQ6oISUKzvehCZGaXbrI/zvXd4X+ioAaKLah3xVFBcD:1Ie6XS47aXb4zO1a1q

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0B45A5D1-5CE6-11EF-B9AB-7EBFE1D0DDB4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430094725"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000464bbaca8bb221ce16023aa854fab291a1c31e605f2c7ccc84f41a6c2bed9cc9000000000e80000000020000200000008382752acf8b76873732ec6296ade7a2f7263df09bd7c18e3ee2b366ece231a6900000003e8468fc09428f03dc10b223b4467fd6034c5aa969d45905b4e578caead8f4c05e127b9116bab3074041401b4e8e7252cff69b9d8a36a7eb09dafb36a67d0a2076b5b4de7280c58ab88bd6278b5c3e79a517a196e91028178ee9ffd6992a8db4d89f5e7a2a342d9cf0e72268d8c0fe0f45aab70729136b7c0550be976b75b81bad86f843f8ef16ae0862d82552274ebc400000000fe574d390087761fe3beb9a3a67cbae96516e88b45fde68cf80470a65a5485ae26a3aa9de7042c8b122f13c1958c13cd9693cc285d491b90ffb4345f2fd3e8d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000cd44ea9ce0ff0a399f9bb00ef41e05462a29c16a1c7829a737f310a5fc2906e9000000000e800000000200002000000004510505dbf6621697dd0936a9ddc1f4708b48a68ee57cd1debd8514da63de9f20000000a04b680f84e0d5c66f617253e8151e2392a98bb401a8e749b3cc2e61906cc44940000000be0e3a15f09674f0d8742615f0a998854437c16615a6ca2f074e43ecce74c869e9a26d4ede1a9cfafc6f64c8ea7f16ba85d564bea9b2d2831f95b35fe895f100	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 104e64e1f2f0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2228	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2228	iexplore.exe
2228	iexplore.exe
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE
2056	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2056	2228	iexplore.exe	30
PID 2228 wrote to memory of 2056	2228	iexplore.exe	30
PID 2228 wrote to memory of 2056	2228	iexplore.exe	30
PID 2228 wrote to memory of 2056	2228	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a4594e45b9347d031dfe21ee4d080ff4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2228 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
777964da4c33f9c343ed27f7de6c73b4

SHA1
a25f8ea0521fb78dac395431d58923189afa08a3

SHA256
d4d0769a840591990b9dd57026fbe4f34c42c1d0eda7cf46a26d41eac10fc6ab

SHA512
36e89b70e73bc22968ebe86535533c517912fff5d600d526ab4e8c37ef7e96d2916e827411ea63a1d793d3a20dadb8db69916688947afa98b7d3f26cd87dfcff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c3790c538e9ca6c465c2d82650198e0

SHA1
6eec8a4ad7a7f0f0ad33abc020fd047e67700dd7

SHA256
53c8702aac5e46942a0dd3a4bdabc857bfbf16001d95af247b6b6e4a072f3372

SHA512
4d5a5024d525fd94327237e4cc1c9616df879269b211c6449933a68af88031c01b0a8dffe2cc62413808607aa6e5e8457b4cbbee52711321b48fa885736caa25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3732895b1fee40a557d621a042b5c7e4

SHA1
16f0191f7c4fb15ae156286ae17591b8f079c4f1

SHA256
00646b7eefe8c18d0bf2bd0aff502224abc6532a9ad023f82b7b94b7982a7a27

SHA512
58d94c7cd7aabfbe8044ec3771f0c3d26baa26422cce0dde5fce8c57031677b73a2214a94922af6b4ef32915d8d800fca05dbdb927d2e42a79f5081f88bffa54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85bbe9ba92c8a0966f65c08379fcfbb9

SHA1
04f4999b6827084c80044f33d62b0e6eded7268d

SHA256
de5cdc43f830faaa6c7c2166b00c66044a5bb125963d3c740248e1912827af72

SHA512
553dad61e870ca22950cea7d3ee6e045fb502c7d7dd8c81370807caf811a7d6cbf08abe13cdf4253e4ecbf9c35476262c18388813bd685a7cf003ddaf6417846

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e1710ba0c9603829b7b864e15b228e4

SHA1
b89a48112865e70707aae27368623246d187ba9e

SHA256
bc4cfe75f72664fc70c48696db9d96539669093ff305048b5ff5a2d0746b883b

SHA512
e9e4002de3c857b9ca90fd68807fd18275c580db64518a59f040ba79b28202034e682d64ad2875ef211adffecf186ea5ad3ec575a09be51203cecb34c68d2101

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33c78cc49bee5b3a7c0275601e5b3baf

SHA1
0b204b1932a2d3c9a2ecbfa93d29cf5b94f7f3ac

SHA256
5318d249b73db5d44eb2c193e8c8b1dc212cf8f5235a90bad56c4612ff20b1fa

SHA512
94fe833b0e675f2ff709692ba7fcbeb13f8c7507dee67083471eabec7a5f8c6e427bb06f7a39ce8ba3aaa508ed62213123d55760f9c56ac886faaf4e4dca4efb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddfb725f1b2cc2ecdb39366686464cf0

SHA1
bbf6ae10c9b33457c64684c752f72a0038a7297f

SHA256
9e7c5e1d7632feb5882f009a6d6417bc011cb8f2a2b12c3b0732c6b756de0582

SHA512
772fd9b47c02c1a42c04f3d8fb672d5795b2c12eb302d4450ddaa7b29cc11e7420f1bd4361c7712c26f31ddc5956fb1790eec90e4aaf12fd14f4eb5eda2607a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f2142988fae21ae23b8b4db25f0ecf0

SHA1
7a5431408d90ad4d54ac95873eab05a08252456a

SHA256
593373ef8ec3ded6965b6b75fb43f58550911b5c6eaeb5885e83a4803c7227ca

SHA512
a00450a7166c31eb5f6a719eae4104f408cd8812865daee66c494f1424af5ac46eb2d0f2fcb5edcc34aeb20806d856d20a243aa32f4da874c9ab5a56a7dfd60a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15d70288942e8d261e630f2e977e89b8

SHA1
eb3ed9d45b4557fb029d294942a5b33d5a913e88

SHA256
d40503b4ad4e836bcd66b08b030df7f853b8e9ea4e151872309e23ed4e454063

SHA512
05bb63ea6fcda909a4fd484beb6e4b0e805fe35df47b6a065903d1b231c352fc5948ff3cdeae81a9f36700de3116a0fd0fa107a33bdfc2cfd64979539e40a233

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6642c79b908124d2d30674dc7334d9a3

SHA1
0b0ed496da8bef5f3b24a3136a52c63b746b2146

SHA256
51c130d4ffb22b3a7c60a95bdc887e996dfe29348208f4e2664ed7ec16897e33

SHA512
f60a05569aacc4a1e238e0a51ab9a7eda8e3ecba5ddebab69522ee3bce6b0288d987bafc2a635f794a945e3fb8c2ec68a3dcb16a3145ce91ea7f551d6a2d4b46

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDD19.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDD9B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit