91e61175b285b3baa5a4e0e66179323d2b0ebd61ab315a4e9445ee89462d97e0

Analysis

max time kernel
142s
max time network
143s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 08:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1d4378038219f1095cb5422ed3d8d3b_JaffaCakes118.html
Size

28KB
MD5

a1d4378038219f1095cb5422ed3d8d3b
SHA1

f5c44d4e378125a90798d5ca717ad501f9b5f2eb
SHA256

91e61175b285b3baa5a4e0e66179323d2b0ebd61ab315a4e9445ee89462d97e0
SHA512

7c0d90f8444426f68438ca0aa450dc208f50a0345e2a90f75cfd4511a4ec3bb0819c85d06b5f7e6b24c5a51121562c5527657dc96a14790ba4c0c1ed9caa3309
SSDEEP

768:Zcd9QZBC7mOdMQHpC5I9nC4FwEwxwIyPd:gQZBCCOdn0IxCAwEwxwIyPd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2BD21C81-5C72-11EF-B88D-EAA2AC88CDB5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 200a980a7ff0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430044958"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c92000000000200000000001066000000010000200000002a59b8d0cd147e805142a60ef6450ffcb4beebe657e01d447f7eb121f7d015d8000000000e80000000020000200000003d0f3efd1dd4b00fa9ed1fc6d367f33f0b5f56a65a30df36bdebfa781907517e90000000380cdccfd6567311ff0f6422b8213f6791cbb49e97195bf716ee88ee3040aca970b3767b2063676906496f025f2de17de81136b15208a26e7c255dbbd895107fb0535091027da8e862cda911d241877fc3dbf215167d038945786ab6646162dd47b8110e6805717f1ba91d74baeb3127c06e0808dd93cf1834f44d55d9d306da1a0288b9b6743aff39503ffcbd95de914000000027f739b932c7eb42c6de5ce40cdcecd29ee6ffb7b6e56fa30e7d7ff98c8f9794874779e89eca90fa8c895d1a35e7cdcb878f5c9e2522dd693d27e2adac7404c2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000e2907ae65b8f02f223dddec948d9f86cee75265dec1204f3e1121009fd3cc4cd000000000e80000000020000200000003532af2c3e3b0b965424e82472587d3c7ce388577c687d97eaa8a1ff05aa20532000000066e5daa23a587cbd60d71a511b5465b1aac350746509029f5806540b59d43f9d40000000f31b0e668c54a06374437826323986e74d5fbdbbb5adc0ef1541842e4dde2e44b4539b8bb929e74c072961b9197ba22b492f588c6a54bd45175e11354a47dc22	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2240	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2240	iexplore.exe
2240	iexplore.exe
1472	IEXPLORE.EXE
1472	IEXPLORE.EXE
1472	IEXPLORE.EXE
1472	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1472	2240	iexplore.exe	30
PID 2240 wrote to memory of 1472	2240	iexplore.exe	30
PID 2240 wrote to memory of 1472	2240	iexplore.exe	30
PID 2240 wrote to memory of 1472	2240	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a1d4378038219f1095cb5422ed3d8d3b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
982c6e6397d7cdd96c0d0036ba1fbfcb

SHA1
60387b0ee52a7646a88331b61ba7b02ced76c0ed

SHA256
cfa4c03a90c95bc661228bffbbca53628cb877d430681a48e7f0231b4b97215e

SHA512
6957a796573cb07644d578886fb8fe6ff868c5738ae09961a81094d92b5ba485535e19a2ad93b7a8d308d0c6c69035b6fa11b5ddd19dba1b2b5c86d84f87234d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd2447e0950fb1160bc79436a1017d2a

SHA1
9c8d347bf53775560b5b62ddd7a383f641c9ce3c

SHA256
3f7deeefdbfa2dd1d44cacdbe5b1463e2f940a9903672e227d43c218ee3a2fc0

SHA512
d5240f1ec002e4b2b17976fe415d52b599a428e20e3d03065883a386215b44375db16a4538e072fba5d20b200c4cb86b27f20d4fc54de80c43119b8968e125b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
967b3dba9a10d63ae7505122fe0818aa

SHA1
b4ed314ee87de4111432fb2453150fa49546b804

SHA256
f0d695886c6d8c940d83e6562c09f11b37a5c37bbd5c08cdaf3bdee3a8ac8fe0

SHA512
09ab37a31b69d63487a9d556175b935a90e2b9e14c372f17cb1372d19fdc28559a81181db98069ab972ba0e367925f77715b29c0febe023ada5f63366964f87b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe05bdd6b207f3aa3a63205027b8a82b

SHA1
6e17457975c9935793b28b9b6f93b8311eacd5b3

SHA256
74cc6b0caaf3de7eb92e5a0a9dfb4d1def827747aeb7142711ebf149757c3b21

SHA512
aa57c827f127b33f481569548488f3baf553ee4e76d1cfaebc0a1ae2c8d2b92ca298f11e61df31567e732b799ba07b37a63ca49871fa65f9dbf21e1d5ffc7024

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8bbb35494fe9956e42a86a85de196f1c

SHA1
5e15a1323ad2ef3b0ed504f80e2e13c71c56b71f

SHA256
a8f3eaa675cd58a08a785a31c7af6306ff6dae60cba2854c4503864e6b4df5f8

SHA512
8268345d35542e97b331c9e9492b0c23b348f3fa9cfa52d000c35855169a8a14eb3b367e5c464993bf1616abe4dcb416efc4c4293466a1aa82bafb52060e48aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
486eecb8f31ce2d9258ae60c265e812d

SHA1
030d9c43942d5750fe91ff93737e553af60ba892

SHA256
8da171bd988a25d52977c804ca5f6ed2c51bbff1e758778f0929fdf0179d3cd2

SHA512
beb2a293cf9f8aaaa328d3b9a4f90c52d5d37e3109e6a5811c30a5ba8245a33d29c64787a1b0514dccad4e9d513fef2a4fa3760b2a87029140af7befd78af213

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3aba304f63b98f479c42eb70a9504678

SHA1
d19e5919a35b99312c57639331cfbd0b043c09f8

SHA256
c99056e99f26027105928a0eb6c639db34b1703ad9919bd27a2a07c6682d9f81

SHA512
75f16d63309a6eb6b65be833476c112b8ab4471d2a920339f7ed71e654670025cc5d29f507b3f20ce68e1161f885e1a3bf73d64a062ad84a1bb1b3e9e62f859e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6416deda5d94210a924d6db56e230003

SHA1
1bdc6f39aa5d9454c19f7d1d5df57197d448ad6f

SHA256
e4dafe4fd30a41ca2e902bc631a67355b7463b51f44360326bec34bd794d840b

SHA512
c9709d62512a10843ceda021b3f12969b86dbf4fa82f29daa55c53dbaec2b61b1631a1b60ad12063359a3be6b0160878b4b2fedc831729a14040f8b941ce9552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
438512cd3fdd5ad6adc91c177c4911b5

SHA1
e5f983e60b155f9b33bbb58c06b064a49053e451

SHA256
373e06ad6fe1026bc15263489f8962da86f1edd93f0eb135a215edf031365a0b

SHA512
20a5fd22271ae671eba6f9f055a91b769bb37b3e6b9ba6e7daaa98bb222e1b17df1dcc7d87fa0461b4693f0e3445d11435acf4e552b7470d3e900e2508aa60ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b04e411b076c921d563757d076afadc6

SHA1
a4dc92eb8c7dd2cf63709181bd4611fade96fb5e

SHA256
409b8d3a90a3201ac5ab20572b677711c394586877b970fe0b8959f57714eef6

SHA512
8843adffa047c96e8697e07932e964d152f3cf2b1c32c1c5b4d28f13e209fce2a77009f2a716c0e187a3c58c3b289aeda0690ef1472ea2002fc15e0cc4da343c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b943723158e43ba94952c51e4a6adee

SHA1
451164cd7c4d1badc739e6b2385a276f3ce12c6d

SHA256
6ce22eee6b0fb7318f6ff471076c176c617d339709a9ef9196d8dc330344289b

SHA512
5f79079e3f3b164e6e377a5188519a3bda6698157310bf8350a7b5be74625111afbfa3d0328b9d48ec0533b3baf57ea76312ab4717979cbb5bcefcd4cabf4d36

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD896.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD898.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit