808cba0bff225becdab96b785e19c33ee9f0222cc9a5fa34a3db1d8e34c692e4

Analysis

max time kernel
121s
max time network
131s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 02:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0e2bd382898813785faeb6723e0deb8_JaffaCakes118.html
Size

21KB
MD5

a0e2bd382898813785faeb6723e0deb8
SHA1

26f34dbf849c0adf489d6ea1f955015cdf328152
SHA256

808cba0bff225becdab96b785e19c33ee9f0222cc9a5fa34a3db1d8e34c692e4
SHA512

6c08e92f0c59247e7f2254b20b5605aa44e752647232a98c02a9a3fd94409b486d7a76e8a94b38e84681d14dbee1b93a0cbd8d5c391bb3b80b8488cbef7c3fa4
SSDEEP

384:K+uKZUZgXfT0/eUphSo3S0Osy8FXuY3L543O08gMWKX+Gk+eJNpeHmNrv+:OKC602+hrNed7DeHmNrv+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430023852"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d07e74e04df0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d99090000000002000000000010660000000100002000000091f0fb963e9e469d2ea35d6ae3a5fcc2b5b469fe80c3c158a56d7d0ed33af61a000000000e8000000002000020000000397cf1858286ce6276c1764f976833e0085633f4f149657d019ced1c1c0342542000000078d3970dfd8e62497e8ac8cacf96a03e0c3a199c6012f8bd25af0d41af3bf51f4000000019e770815f663e67069e99f3801fc4f7c19d03b936bd56180082b5f9bf5d0221bed5659de49a3569e1d20ba8e065389bb76d15228e7adc812eb01be5b1970774	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000d7f8abd9787ab103aadc3380fd4b23cdba478e79d55e43fe2c6950147667b910000000000e80000000020000200000002677bd2a5ed1f38becb7fb9cee8faf3144e24085b38b4340cb91b08a5b9ab216900000002a9de080bb327c545c8a2c51b215294afeacd4f8dcad6fe07bbc38270f4240e1d5057cb7e9999cff1ccdaf8d9114611991578255b494cbd6670b1e5f24eeaa0fb96e639f0890c748b2e43ce9e3832fc51815441950fc2187bf2a93a17f7a4478cd513c4d70be20c410d5d1001e6f13c38924f087e016c1aa6aea63a71008d25a860e4d47baca8afd0cee9d74a97bcbff4000000010f1920e48d7d7b52d277e1f76e46886e533eb62cd53c4abb74902633f5350adea058b07e09217afb39d739f5f982a9fc5ed2cd69f9e5e0a3a8825e419ab8b55	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{07AB28F1-5C41-11EF-B6C3-72D3501DAA0F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3048	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3048	iexplore.exe
3048	iexplore.exe
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2316	3048	iexplore.exe	31
PID 3048 wrote to memory of 2316	3048	iexplore.exe	31
PID 3048 wrote to memory of 2316	3048	iexplore.exe	31
PID 3048 wrote to memory of 2316	3048	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a0e2bd382898813785faeb6723e0deb8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3048 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
54c4c2697647f6689025de8fbe1ce636

SHA1
97120fc00072bddf34b635bcdbfadc0da6fb8f00

SHA256
5b503b6086ed748fa71f6841de9699bd2e8080c9b2929b3a3ae5101959acd72f

SHA512
9a0ec74d678aac93f29e563866015049cc5eb93d7f21091b0c719f8c42c15dbf341583c51133ab26d4aa52d95540451c241de31134af1d7cb2eaa7b2aa964b9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3cbbf21a18a85f449a0ec348072d99b

SHA1
f22e5b5bc4f8b050a3cd69c6fd7f595372c07417

SHA256
cf7178033c8259919a89a2516c8ded8db3a2b7738a3f2d85babb20c8b0096d40

SHA512
e037fb65eaf4c82fc13a4b413606603a5455e6c40820b0a7735777d78726811349dcbb7e1664dd073d5df8f8f5adff618715771e5be4b1cd6cfd576d0574e9ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
945978687c31f3db070c815ad2959710

SHA1
0950fe647c44d7af4efe58dc42988ca40bf74463

SHA256
361904a36d404df71d00cadefddd537327e9463dde64d32586656a4e458dfabf

SHA512
b7365e912d0be13e27d6adfb1edc7b2a8d189b9aa033eb1ded99b2e72c29584710d142f95db3d0ffe37e8b85a3808d8bc366da66057f8d843cb7e2735a95c4dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e083b251d83443e2a63600b6515a303

SHA1
1afb22407547c9ce9e764be1614ba07efab597ab

SHA256
9e434f627a9a34ee3ddbd7edebd0c50d76d128e067f949f2419f803121067637

SHA512
0deaa40c209a996982ff925050fc35f2201268c010d2a31c678c89df767c4af403c810635c9193a519a1ccd958f3510feb3050ff00e4bd3baaae5b8009b1b7bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d50594ac44b64fb1a303c2d1e656ca6

SHA1
52b4a5339579eb4d818cdd451d400bc01a479cfd

SHA256
b08e715db534ff809819526b4d43216d46ec811c679c815a9305855b671e9477

SHA512
97da857045d4b9a25c313511afbcce9108fc531b68db679e29c4fd6ca4f4e20f2ca077677cd86fd3be6a1876a17f9651dc6f4d1ab17205137e405bf3c76fd72a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9324f50d7fec297df13c4f972d610d1

SHA1
38cad3730dc716d56781412106956f5da8625e04

SHA256
2f139ce1496137fef2a1b9af502309151975da0293e3568a77ae2a6a78db9c20

SHA512
249727433ee7632bcf364ec9b727aeeeab99664ce9e9a1ff0883bdee8133bbe09f9dbee554b3910f47fe92173c6acc3879bd7293d11e407f2d084e5f569e1844

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ba5bf2ec5ceac5be9672bc66b500758

SHA1
337685a81a02f07831c61ed00363490045a0ba2e

SHA256
f4e75b41982f61ee0f764c3a24dd51f7225ee1c76822f3c014eb8d655e28b5a0

SHA512
f50c4c141d7eb934caf19e64072bc0774b499b19adb00e64fd252924480ac34ca107626cd71518d07343166e589f9a4d41a6702eb37498720bb089c8fcf6bc1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4538072045dc8282bd898fe6803f908d

SHA1
58c5748a1e73c237e1e9dca76e568e561e04917e

SHA256
39e396f565f9e9e1e26353bf33acf76923ddb6ca89f9abbb533afdfcd34c7e37

SHA512
e113496e356ff1ea29672c3817045eecee5bbf6f83ab12744b0f2578b3c70ac97cf4b7c8ac1a4b5ed5a443276a357574bd13b314eef51847b03af0871dd54a25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de19de78ec5ea72632d6ecf589f5fcf1

SHA1
9350844f00d2c0958b592f634a63ccde1415c195

SHA256
1bc1a4d72257812c9406b9d6d697d101a429e6fb81832be53e26b02236e8b54f

SHA512
bea2f0c463dd5418a0063c07e46669e4fc23aa6c1c2c81de323347ad79c80f2d2804fbbbe6211ca945de8d18c44150803e01b32de50c6bae0998f89855b0a760

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dba583bae942f9baad429fb311e2142e

SHA1
f78e0e4a56d38d54b2ae65749022eb26a6fbb073

SHA256
b16b3b7e66f3dfe36fd2d8b69cc177a43dc68562cf7af0d500424da3f36eeee9

SHA512
19727ec76736e5d9932502ad1e55828a6c392f6c75b28b67cdac64a7565f8159957e5063eeb74ec1cb28e81f96b3483f187fdc09131019bb14fb0c6c0ee3cfcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
f274e39a25ced5fa0c01bcb5f27ee76d

SHA1
2b3201d3fe419b3402104488a38ff98fc77fec46

SHA256
0ed9dff17da3348c9f8524ac2179c239cf30eb81031c598dc54929ade54ee1c3

SHA512
1be2769068864aa31207fda615dd020769cfb21fcb1d3598f05d39dde5b8432a0276eb700ec654aaa9494a51ebf9458723cda39a32b595f461bdd3b281a20ea0

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE226.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE2B6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit