d05b606aeb50a4487dd57f46f20db3b67fd885bfe7e71076b12c0f5647f359b0

Analysis

max time kernel
143s
max time network
148s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17-08-2024 01:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0b2b372edea0ca86d137e8cc396165d_JaffaCakes118.html
Size

71KB
MD5

a0b2b372edea0ca86d137e8cc396165d
SHA1

9f7acfdf0512b484eb08193d9b56bd568fb70cdc
SHA256

d05b606aeb50a4487dd57f46f20db3b67fd885bfe7e71076b12c0f5647f359b0
SHA512

ad5cbce4315476cc992c19bb68583a935531ab5602fa2e1e5fefb854e018b2afd33b32fd05e4a8597bffd52256963891a5dcabe1f41129b885a0cda795f50b35
SSDEEP

1536:gQZBCCOd10IxCZ3t9Eu3GwKPpw+7Dc92h/AM0gGhlXJu0I/+8wvaxKF9OoHUWWxW:gk2D0IxC9Eu3GwKPpw+7Dc92h/AM0gGB

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a02deb9944f0da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b700000000002000000000010660000000100002000000043d9b0b4b9106d7d50058c6c7b0bdb33cb426cb34181eead482b876f19d81262000000000e800000000200002000000043632e0e44c5421d5cdf376db7661005d9c2967af8d4604f7159324c8c3ab14b90000000a8b700f987422b720acdffeb1a7453970ef9910a2447eb3bb1e5b2335622b48bfb120b4d8f0560b2adbb6cf5d742a73e10f6fce8ddba6129e2f75d3c6b2c7d823f8f67e3bb8077d481000bd965a49f999ec7ca2398f2d4b53f7c1608df15695f188501cffb9c25df408b251d2ef4b38812d4879d70cc21e164ef5a4c2e8d099ed8fa8c4a95c1ba66259986a73c2de01540000000f9b010a05ccd5d17425b0c6f2b2a25ffaad53196a3451f6dc94a49a6629444e37db3c426d24f5365be115a30d1cfc2891fcbc05be0162dc094bccdb0292d02f9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000bb9b251df7f840315f362b6c793c8561242a7931938203f2a70897b491816563000000000e800000000200002000000064fc43692398edbc2588c288bb463c622f899ac9feb25243ae71a6f1f36457382000000001cfdc977ad133cc8bbd956d0ee4e8b5594c7e6c2b33a752f01c20d7cbbb2338400000006bd39a20c65c04c08f99f95b7f9e6dd51d29eedaf366a74bb17e97ab006aafc5763849131cdf2a3c0b0a88787aa52d31f65e28c7e8c811315c12632b4b6fc137	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430019861"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BB687321-5C37-11EF-AB71-E6140BA5C80C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2072	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2072	iexplore.exe
2072	iexplore.exe
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2968	2072	iexplore.exe	31
PID 2072 wrote to memory of 2968	2072	iexplore.exe	31
PID 2072 wrote to memory of 2968	2072	iexplore.exe	31
PID 2072 wrote to memory of 2968	2072	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a0b2b372edea0ca86d137e8cc396165d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2072 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
3eee44975c4c5f6f5f9fd671e4eec5bc

SHA1
8a197160592c0d8c947232ce05d148b88ec73614

SHA256
deffba64815c14c905fc6252cbe60454c412d3084222bd8b2ce578e86671ad7e

SHA512
6224fcb09bff91ccacc6744259cfdeca60e88a2ab777ffb57ed54cf7aa2794ab2e154ed16f035a916e748931057c917a1e5f8e266737d6daab07a7eedb7b5986

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62394a2ab28ca15f637dde17a6ef3fb8

SHA1
534f8cabbd58d849dd9c44ba5d9000279a10acd1

SHA256
6b72381e7b7a36a52526ec82ddf5e9f3785743b60513bc4f19ae8850ddfeab6c

SHA512
1157e1d15b3532e644e7a3802a81cc9d9910bedbc5624974f8c7ba4b1732568d6ebfeb2c9cb9179cf67eb65911afd7945a914681ea46173e9a6e16636893cfb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c269199229e12a00afc331eb60cbc69

SHA1
c18af24934e45839dd2f076c617fcb1e738d7674

SHA256
e3cf6c64affc9ac887dac94b6a13e7b87e7cb52da2486cb094df3480ee649220

SHA512
b51947e258bcc3d4e717d4f35b701e7b59b885494f3fef5466f31767ef8c252bb772287d7df35464067a27d6bf642172756fbe2fdc8e44789953d7f81467f243

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf847fdfc374ea65ab5c8e515bc2219f

SHA1
35d0c2e637188ee6c4989745c49ccbf33750821c

SHA256
0a023727e14066bee847cd552d11e76aa3a2922f1b854b4fa5e8a109d4c87f0d

SHA512
2899576d6a62260294ea0eee337315b12a9dc35b8ed6f997e73a97df03189ede2c76785560ca2dad7100e21a42e5c5a9ad299d21d1860f69fa26713651f2c900

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
152e3763d44109e81544ed899bd054ce

SHA1
5f65b030854bc93c8f700efd591cba555bc95e25

SHA256
5d48f93802b9a1d675415a1e5483fd5813f60e0a3864762ad5ddf0a29137ad53

SHA512
25179d01de1c404b1c9c7f37c85edfc373138f213d9e7a6cc0c5084389f215e3a6794047da9ee1b7aace367470f33d4d55a60244839c12373ef38f15389e7760

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6821987f09fd360dbe39d0dd7489cf8b

SHA1
6278f9a39eac3cb4b69d671f909d9de4a0660331

SHA256
8957ce2e2276d8523a31af6555f52d0c44a8554a4e29690b27aa033dce429fb1

SHA512
71409e8dfa9ad85f141e1628d37a66ee454f762b911ea01ba27a172dbb57d086dce24ef9fdbb688d5cdebf526105a796a4235669b981e182fa8472d9cbfd9728

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f0466979b1f01b00b7f02441c582bc5

SHA1
ceecd5a81e177aa88175c4748e8447c4b7cb1f60

SHA256
991477a769a81ac10283aa5f6f4f53c6b2f30fafa075e5fb89fb339dd7232ab6

SHA512
cc6e30c61b6a997214903d736e0b65dcf86264506b33b341413b7ac0a8596193edec1cae038fad833f244805731e1ecd4513f5d0094b0141c9b5cac220a7b615

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8854a7ddd6322021d6029e2ca68c894

SHA1
84da7a3b018c4b336ff78945d2168e925e75223f

SHA256
ee7026b24bd387b92e8ccd82c58eaa101459a241a798fc3f33efb8efa1926276

SHA512
3cb64603c7048ebec10fd68e7a18298fd742c7cddf9ebdaa27002723ae26889001a57a56cc36a9f2731eee9eda1c5d79777d7bd12c5746b963c0919d9fa7f768

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c2d958d413f599bf60d71d65ef55f6c

SHA1
fb0ffee13104cc5f0760886552684c99cef30295

SHA256
cffd932ad2cb40ea736a80df933f62ee0d0b2aefa2aa07292b0448a2509f22d4

SHA512
777f1754bfd28f281c8562199cb8477a82c1b8f5e26f52ab58d2b537340b2d2f9e2c7bb4b4348c1b97d6f2f50695b712014d289d56279caa57b7305cbe94ea2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c24276c7f9937cc96787a6a88d6bfd56

SHA1
b8c8ca34dc22b9b5d8b6d4ae6281d168729a2b1c

SHA256
4763f1a80b693ed2aea2dd401360c8915d7a21083cdac90e157d9b212d784d79

SHA512
2a26c32942594d931e6618dafff2d1b0b179a41459c0f48873b6eda33bb042384d1136170131b9e15f032ddf60f0aa2ea2febeb71d637d5ff1a9b2fcca630056

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67975b328dc7ead04a0540f0654d36bf

SHA1
4d00526c6f726b56bf8bc83aec95014b589cb766

SHA256
4680653511b4a36dfa72c3921666f7c0b17ca4646e9983d445a564aad6c720c9

SHA512
c743048ac39cb1742619b48a8c273921044bf36327a04a5a9ad87c9b5ef7e39c5d102a7a51502c6037ba68ce825685f366a71aead2c77686533501e146d8b1f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b34d431e27498bcfd2e761bd1235f2e

SHA1
b5584872b3a1efc996d747bb85dbbea3bc8e0979

SHA256
6c78763ff3ac3eecd70f3bc99d0112e432479eeb90fde697f4ad2390a3c0da75

SHA512
889cd9a453606fdf7a8537cd5636a3a5c36b2bf5ee5e96df7b43058f482e04ee3c9c201d2d1d04383ad16999d42b7a29fb6761b389f6ee2c7bd385d5f46c0102

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26544d967ac5a887e0e4545c011d6b7b

SHA1
eb196e3bf067fa562ed901447c3cb898f9a06b94

SHA256
d6cec3d84136315b91a261029325e7494718807dffb07ee42088a3e2a30c3b6c

SHA512
983840483d7debab645bfa99c49d4c020895f509ea307bfe3f18e3cfb3e6527cc240e0493cf76c6882c857a99e688bec36c8f7086a6b6f7b7d6de96a6630e1ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
f92bd7ef378501e0883e9cdff2652c95

SHA1
43902c9926820643478334a85c0e1bde84dd7fde

SHA256
d823930d37b7f2f2ce7bb5858b0af3401a79f372b3d1d4a2206c4b229a97c772

SHA512
ac5e1e46687353ec196a6d03645099357de12b29d2fad1229a143cc12f0e9649b85c7c60b14de37d486fe1a1372f430185df01b4e4fc5b817b285edd29e22daa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5DBD.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5DBC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit