3a3c7e85971a0433089b283a9abc3d6f52afde8c03d29d23a39049f4e9b01604

Analysis

max time kernel
142s
max time network
147s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 10:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a21b63f9b5cd1cc760fc3a3723512040_JaffaCakes118.html
Size

17KB
MD5

a21b63f9b5cd1cc760fc3a3723512040
SHA1

eb38e3e3245c8a38bf5ed962bcc680c1c7c281d1
SHA256

3a3c7e85971a0433089b283a9abc3d6f52afde8c03d29d23a39049f4e9b01604
SHA512

6d31d7b260400e91b0cd3d52c1e766ed0f6cc8cfaee4e5f865ff1bcfbd219e7ae25b74e13b9d8542235393ddcf90b7043f2f0beb7431dc7c445be6bd91e78715
SSDEEP

192:St2BEmXSIe3V02o6rrFkIdf3DOfNKp15pkDy71wJDukVTyyA2p5K1sISSYZOCd:St2BRXSI0Og3xqfNKjgD8mTXA2a6wnCd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7DAC7981-5C7F-11EF-B062-D6EBA8958965} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430050683"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2480	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2480	iexplore.exe
2480	iexplore.exe
2188	IEXPLORE.EXE
2188	IEXPLORE.EXE
2188	IEXPLORE.EXE
2188	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2188	2480	iexplore.exe	30
PID 2480 wrote to memory of 2188	2480	iexplore.exe	30
PID 2480 wrote to memory of 2188	2480	iexplore.exe	30
PID 2480 wrote to memory of 2188	2480	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a21b63f9b5cd1cc760fc3a3723512040_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2480 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
d3e1239d2233dcd9a4c75a9830209898

SHA1
629357b74964f603020de3c19d219f6275850966

SHA256
2e39310c94ce058d50de213b0a7c3be751666d3dfb6a41aa09800c1e5fa3a646

SHA512
27e6481da8d26dd2614e281fa08719bd93689a093ed0497eb07ab709709405dae8d395eb5e91746674cba4a6ad00487fa8670ea9e7f516905fe2fabce99cb2a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3acd5418357c5ffb1dba5a5e5ebf7af2

SHA1
522a2ab4c8edc9e8edbd06f900a326732fa32d49

SHA256
a841fa3e15538ffd6b20ab7b459368afb444b72b922f5a3a29ca76739a2c4798

SHA512
58f7b58feaf6122b9bbde5fa360b6160ed44df38841dbfc69b71115107378e0b406b4b1d6f8c3b3aa887c687e9b6efa0a5f615a5fc7bcecf9aaaadaab6227dee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a8a9d59c0ef2a62505ecd635654c3d0

SHA1
ee963e5037936e279c31acb0c0b50e68617a3853

SHA256
f86dec80fdea4c6c82d429d557d4ba9bdd66ac19bd56367735f3815d59a1dfb9

SHA512
d61c04ac5fcee20ada4b3bc16ccec95619a90c45b93f78f5d8bc3ca7c99188cac9dddb6b1c7464c46128b8ab368ee49e3a4e7c29e5e3846a9c14dcbe7bb5373a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e63568eafee8431b8cfb2d4aea363150

SHA1
cb47ef1e64bc1f2c99515af5f446e819a531aae9

SHA256
88186d9edd508b2df693a7beb8e1c4ea6dca71815b6f642441096347b486b317

SHA512
e1db698cc087877044977ae5ba9025be0a9e221f48feeb8833e8496d93355ba6ebca21cea9e62466e68943a17645070df7912715abc6c064a92ec83d3600b463

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01bc727d6c09a5157cc21f352a8b1ee6

SHA1
2c9619bf69731729a4b2c2a277b91e1622921b9c

SHA256
cb5f474f7a44bc8372cd60131294723ea0b9d8c7981f1aa32e0dbcbefea841d6

SHA512
1e81104f9163eb122037fa8ae16b5ad9ad4c17e409d6c182b188cc2fd6295ce03027208b220a5cdc48ab04fb906eb5ae4bcb3d8b509eea0ba3ccbdac67a23955

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
184a3cb789edef3f3a9351c691925fde

SHA1
d45c09b00814e7a9c12aa0843deaba224b484dd2

SHA256
650710161a656da9853ca246e3a02b89635ec1584e352d81341e1511353aef6b

SHA512
5eb0ba6431c224462efcd2d5ac4149f947328a5ecc618821b38d09acf7205eefaa317fc7ce0ee06bb47bb90f43042e7cb73cc28b8b7ecc29bd886799526a2c8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7817a38ec51388275fff554d823c19dd

SHA1
9ba82b4dea0d9f6c436996bb6acb6468d328d946

SHA256
7d115525e20f85460acba65c851cc37e47ea5a72c3e877259af3536a7d095775

SHA512
5946c70c431046af1de74e8c9de4651fc7a9940beba83449c7ff1ad521656c4ad326f6d5f5bb839d7d2dd97f379ac1f9ceeae00950f3782ab75f148bf9ff1639

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b37f411778d429d3d1dd51b24711a37

SHA1
2dd45760c4d94962e7822d05b3cbf6f035c8f465

SHA256
89793ad4df457ef073239834c3f5b898f7659b0bc04a05e1d289c959d930cb45

SHA512
821ab527b91d8982672a51f390545e4ff4a4ca063690470a435d307f1fd55af498041fea03932aae3245d989221847524e4d3389f11a4ec50b57289605e8c363

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ea9d1feff378d181aef4e8e0b89aa4e

SHA1
4e7f26e84a5341df4ab7df08f022eda6ec807ca1

SHA256
8fa81e4fa6725745f569ebbc4740c4f92a6babe52eaae6eabab6bfc0b1f7f693

SHA512
90c22dd6f811a83911a83abd899aca1603252e0551b7fbdf434a79d0367d3c3a1deacbfa493d1b5d6bdfad6ec5cdc05fa3f72ae19b3eec114d1308af4646061f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dcf567df8d6b822df0a25a473bffe361

SHA1
a10ab71bc536ba51435bdf89e482034d60e27229

SHA256
e7abd066ec72d30bdb1f0bab7c33dd261c0d3dd0db97237c3f929e823d234999

SHA512
de23b48f7f2a70761a735d6a46723e6e15acfa5eeb1fe0296abf0d940554f4ce5327ab74cf0238ad34a42a9633162defdcdf8df1ca129e37b56581d5d2ad0663

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2894f7c7e8caa0657a1a00cab89df5ab

SHA1
b712bb8ebbfe2053cbdea7d91f7d9f76cb191d30

SHA256
9dbc2c01d21bfea5574bc9d3338018a853e93b754405e87f298a14c375a106ab

SHA512
bd7b1337a7903a81d39f18102d8218f171c33ab365c490187e5d440c25c42124d247ef9bee7aee58c90cef75445887864147be6e24f256dc2402fa66e06e551e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac4aaa2c0510419ff719b3c982a9cbcc

SHA1
a60daf8442f63c5c3ade5c4f2a27c8fd0316460f

SHA256
bd1204b35014e584416a6f7bde8b8e5755171ea11c3383de13990c1f3199531f

SHA512
a08273fe4517d77b96c6d85ef8ecc361ca55dbf737e23ba2175d662ecfe5f491f4bb70ae0b36010781f254758c21be40faa826fc1d4d1b4863d5a2c254693ef8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
9ed48119f8f33eb7afe102650834cef8

SHA1
3088ff60ca7ec874e488da35e5caba42bef40ed1

SHA256
7d257627530ae4a6e1a249e525273ffbccdc8c9b147b4be87c2b104081abe7f4

SHA512
30e2d804b85c1c36041a1fa97a28c0389d098db63276a6498d28f4899e83fc689407cf379d511cd72860d5b8b2571d62398f5539ee661464dd502dc115e067f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
39624ff66f3f290ab98bf57e747d489c

SHA1
d3c3f1f1ef417d3d91594e725a38707c855b564d

SHA256
af4de75c474f3b4e9d874cc10db95583039f303dc485ebc3f9a915c40a379ce2

SHA512
8782846c809f0dc4fb609dc350ce3d70a23fd4fe63e31e70ef0780b93afa0aaf6daea6554de4dec1283701cddfbaf0b5b74ab221457317287a4dd4000acf69a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE8BA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE8CC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit