4a91472a483be97d0de4f37586f2c570eecb60427338afefd9432957affb7192

Analysis

max time kernel
121s
max time network
141s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 01:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0afe7ce595d44e25fbe4fc1ced064c6_JaffaCakes118.html
Size

73KB
MD5

a0afe7ce595d44e25fbe4fc1ced064c6
SHA1

884ad7641c775cfb236390eaa6825a912b18994f
SHA256

4a91472a483be97d0de4f37586f2c570eecb60427338afefd9432957affb7192
SHA512

2d13c0526fe0e6ed6dc23bd5b9e84fdaf9bfcd68f85e68dbac9fe3452dbcdb00bae26597aadc3cb1b26cbab5b9f4c38403d72cbcde9d84c7a115e865e76b54fa
SSDEEP

1536:ZBKwY3bfhVNAso3hbhIPMriRuT28ZqP3S:jKJrfhfARbCkriRuT289

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e01a240744f0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000e9928a0f25c73f796d54af6497f513fb488488817910ba6e5ecbc7bd7afff284000000000e80000000020000200000003c6ec365804c6c66c0989006693080d4fc7a8b4dfb1c9ddf7067a0e741da2bc020000000034b278c9425249c1a5c365f4b0021b592dc4544e98f665e6f38b6c84c214df440000000f1dd989f1c037d78590c0bf0ecf9ac1c0e224f651059b642459ba50b43b1917a86e1d1f008cdaa3acfc7d967383c2a02f39aea905218507d86413b36b5239c0c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3298BCD1-5C37-11EF-BCF9-7EBFE1D0DDB4} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000a2d9fc9831f32bb46ad8b44e0c95ca0091715e48df6a68f8af625f1752322f10000000000e8000000002000020000000c71fbd9917d06d8a47ff21abf4452b5fb0d32d5c9072af05a830d5a2e73d09ca90000000187f9398cd7d7bf26ad274884bbb92d8b8fdf902f59e123efdfb6cc97e11bb0aba288f0f59783f9e69884036c2098a0744af4731536d96fe63feda947960fb6e4d4abae4d528ea448b1095a349455098f8611630c9237281749e9e7fefae02bedf541babaaa09cd819380d09c39ce0620ee1ff9333210638960fdfd8df48b0ec62a9ab0fc0c1fe0beb7cb3cc2fe0df814000000023f007aaddadcc30d22ce05172a2d6f7f699e4f69e967194087807e19dd8eaab22b37cb186ce149a4080074d28773fef56811505ec8d1c0a64f55ee12b7ee1ba	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430019639"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2632	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2632	iexplore.exe
2632	iexplore.exe
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2684	2632	iexplore.exe	31
PID 2632 wrote to memory of 2684	2632	iexplore.exe	31
PID 2632 wrote to memory of 2684	2632	iexplore.exe	31
PID 2632 wrote to memory of 2684	2632	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a0afe7ce595d44e25fbe4fc1ced064c6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2632 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90a2f5897fdd0445bb347728c1a8b2da

SHA1
c046a63a6baee4af33117cfe9a7247ec109097ae

SHA256
32db132840b7bbc2d578c769edccc5ba5382dac618bafa27a476b698fa7a2780

SHA512
590a0bc4e4d91174ebfacf9c92cc881a2c6cacb4e826f0d5a7c5defaf36345a07e07dba520b58c5e1373631041e88a0eb6bf730a3a8449ca632834211c35a09f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b450b31f9418e20adb9d99ca7ab30575

SHA1
52a3ef3279b3863c3c3af2a97332bf4973e919ca

SHA256
bf97a2b4e568f75c8399c8c48b7d3b9b54d32a3608c8447f9dfc52c8fc06284c

SHA512
2046816a38902873054cfcdb0d2cffd18f400a1033aeef604f89e1c33ceb4999a4aa054a27f203a3f0d9b09865bd1b22891d350abdf8b9e30aa14a7c90bf7e98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73976bba402f2758857d3a5df0807ce7

SHA1
f21d0e5e39adc3c89d2a5cb104c54445b1bd46de

SHA256
46d837cf342094d1e49d38bc025b1f3f375aa8387490ae869b6532159c6ee956

SHA512
711fbcac521c6987fb4dd561dac7b21dcbfbe367d7e77c79041cc1e3d52ff6a2e3585ac76701ebc1f2ed1948c58b814736236b465ef0f024df5719a1a8080be2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8b9ff94c82086c7ce9db5db7696f888

SHA1
173dd8bf4b1f900a6688e44ef934915718f825d6

SHA256
c19bac027d04d7829b2883de1e62e3551a7e60333ce92b8cb984888961f2c462

SHA512
5622977566986404f1b9b4fed4aae429061617d27cf63c47648f636d83e467cb8952f5ad8cf0f31f2ca7c2b34da9171e933e2cc5195d4150063b06eff5972d2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f497941ba3371c1c670934d1ddd7158

SHA1
83118253c99c46b380d667c0821edeed0613287f

SHA256
81b199af5b45c395de9c2a45b7ea3dab83a1f7d10d5e245299258a3e6a231460

SHA512
20c0f4e9f154bd9e97b6acca90aecb28e76e3c98bf0e4186dc7af62d759cad857001b65c72f45bd46edee929b5d7f27abf44536d774948ec518d54a42c86b25b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a09dfe3de82da544ce60628807299b31

SHA1
83667fb278b6ed254eb992e6f316db6ba9f02dc2

SHA256
d38e7b8bda189d7e058cad8e2fac476287c17b1ccb1089b72bd2d8355999285f

SHA512
3ca7ab0a3beb31f7ef7219b6eb90c5d18b29c9ff96a7e84a05fe31da43001df02be416fe24384a2184737afcec7e7c4e9d831fd2d191a5e1c06f45acec404adc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a2744e3ce076746deb2d29fa3099927

SHA1
5e0d568f355ab7ab730bd3f5c76644416de9770c

SHA256
dfcb62732863af5805239eba4eaf143f825511a71754f097d7da134bdcd5c3ed

SHA512
db907018d84decbb385462296e81db2b536259e754f917fab389cbf3e81ed56270d57e44266e12ba56338a7922db0bd2c9b673feb5a10d768fe6f3eeb0e782a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba354c78ace03cccc4bf07961d8d3d64

SHA1
11b11e9398f5f59bd7ecca8a224bc269ca3640f9

SHA256
5a355132f569acfcd3a086621ad4ac0b2d72076883485dee0953e8b5352c6d01

SHA512
d0f2ab2533e9c9af0bdffd15b4e0cdaa7b38aeeb89f1fd9a4513aca021d6cf8860a3839cc368ff0d5b1922c945d27b1a2554a7756be702940e51fc12af8723f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
429668493bea536ca72d49606531847b

SHA1
66ee6830d78044393a9912df6aa6f3fdd1e2b1b8

SHA256
a10b1c1a1d71d699fef59947329aeb6a02a9ade251d38ca7b12f967b4b5ba379

SHA512
2a6b2f5ae72fc57a0f96c3089cdbd0610089995032885cbce37e3f3a8e77cd9bdebd06cb1c1f30f9a8963f6062c015642a002a05b1ee2688e0e759e35df93320

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab561.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar600.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit