4602765fbbf4b7a7a953f3acb28f755508ade40215c8f347121e1b33b827c6b9

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 09:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a202a336ecf43bb87958559dbdcd2c70_JaffaCakes118.html
Size

53KB
MD5

a202a336ecf43bb87958559dbdcd2c70
SHA1

5a8abfd989d89a3d5a302d14cddc538d66980ec5
SHA256

4602765fbbf4b7a7a953f3acb28f755508ade40215c8f347121e1b33b827c6b9
SHA512

4d6dabc347dd7f31bbc708cbb5f132b83f0b6a3cb380ed3f8b1b9ccf3a0e7ebde32c07f7338622716cc62c500a40e23cb2208aaa90db8f336eb05f43e4c44b97
SSDEEP

1536:CkgUiIakTqGivi+PyU9runlYX63Nj+q5VyvR0w2AzTICbbUo8/t9M/dNwIUTDmDX:CkgUiIakTqGivi+PyU9runlYX63Nj+qE

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430048656"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf710000000002000000000010660000000100002000000052190447f6cbc3e0b341b0d8c89f6f7ed624687d662b3547ca390d351b6cdc50000000000e80000000020000200000003cdb4f4636cc6458cf02ef589f7eb14e32bd76bbb797dd1401dc86ce718567d920000000aef56acb68f347a3a0b7d347e1a0ce94179af7913a424f3d357cdd8b959f34ea40000000267a4be55f79ea7ce5aaa4f0037cbc0f73eef7be83bbc97423e02d8890385af70004c785046e5b9e0b1795853dd06cb2e2e3b31dd60890c196cc8031f01d4f42	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B1F3B0F1-5C7A-11EF-9CC2-6ED41388558A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e097939587f0da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000005546c2bead60a0938760aebf3c9861e40e2ac6b7a60f25303fbd97e9102ed0e3000000000e80000000020000200000005d4ad12c1f3abb903c52dfa69e85633fea44e2314060221bbb6f272e61d55f0e900000006f4977c9e3aad8ac78b15ea6fef221cd434c4bb079d57c5ff2e781a41a69a0c0e069c1450a0ac4e00dffc42b3bd7c8ad23053043576bfdb20075c3982690c098a38cb412cc2dee2af0d5ee92677526f3dba3df7614b45895e574d5ff188e38258dc665dc1dbcab43af0f40d982ae87068987e747775a1e70ba6549ff591ebae10fae153798a94d9ebe52c71dd094cd50400000008c21313526047eac3f2812f495d6108812edd42c4aa98ba25b440b95121e12777aac1c29751c0c6bbae91b9865a634f81b0556542f72ea0132f07c14e58282e4	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2548	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2548	iexplore.exe
2548	iexplore.exe
1868	IEXPLORE.EXE
1868	IEXPLORE.EXE
1868	IEXPLORE.EXE
1868	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 1868	2548	iexplore.exe	30
PID 2548 wrote to memory of 1868	2548	iexplore.exe	30
PID 2548 wrote to memory of 1868	2548	iexplore.exe	30
PID 2548 wrote to memory of 1868	2548	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a202a336ecf43bb87958559dbdcd2c70_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2548 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ecf961f7ac63f208b0a92daec06a92aa

SHA1
e2191540ff86d88298be49a1a7fdd7d7f4fd361c

SHA256
d14aa724a4dd8e466a7a2ce3858409ed6a03a5a9019ab56d4aeff21c4c6f9980

SHA512
05c5ced0f7cdec89b3653b08ebd2270711b8447c2be30eabfe1d438f833d2cc0fd9a86c4cde92c62401ec7bf77bd937bf394d1815a2f5e921da36895306b1393

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d00542756f66c066f8d98f08c3d80c0

SHA1
93738af31c7b23e331cea846c1317ec40fae5956

SHA256
2f05425395b082bf2ad7a8f5fa8731b252334564d1616c0ad48b1e91a4e7f8d8

SHA512
8f7c62fea055aaf63e20bc29eddf2c89dfab9847454bb88020354436d9917ae8f73dd2b25846064a43d05e4f7d9864a580f50bceacbcf940190c785d26ee9d13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bfd5d9d9a4d238aedbdf2dc199938c52

SHA1
2777c176c6f645d92546c0a9c68c36d82328449c

SHA256
3d9f9d748569d0df35dda8d1fb583fa17d6d2301a8d606fa65c0542c65b86d42

SHA512
40077283daf7299cbb99e1e760d74debdb6e534f70b7bbea293deba9c6e34a6f575b0890f8134c363e6e40f1e097ae771f12193da24fe30909e9ff5a2eb211bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03ac5bf06e80e09efefc569101b1806c

SHA1
8950b71dc922a9ac03b7f7069f4f8d3395f957b7

SHA256
f1de6e3feecfd5a122c4a34e86e42b979507b80fc5b145b208cc53a41ec2ca79

SHA512
497e2a47e67a0a56e50698b8174525cf60d5621a7b3060d510fd92b9ee83c66b7f7714f356f4f75120da73d0f5950b12ab58b884e78a1a877b9ce631f22f427a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
378d44d525f2091eb519a5405cbe01e6

SHA1
1b0f302a99c68064ec8d0a65238a82b210c759d8

SHA256
6614c0c35416143bcbaf5946f6d7b5da16f9b6cd4d34e3a9117cda916c5a86c4

SHA512
a6e64706854fceb80db286b1effdcb97914ffa6ace54e80d68d59ff308a04cb64a92469173a51523a47a5480efc1a33f461690d3e34bf44ea324e3f5c1c58c39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f22e2a155c42281f33965cdbf5d7e326

SHA1
69bc76b764eaebe02cd2096aefde91488af3e1e5

SHA256
11c47d5b5e2e26c74734274f2954914b6d187fa35f61199f6098449fdc1e90c3

SHA512
fd670de47b2ba765a2f1b267118064f7bcabb7a2686a31f2ef92b2e57f50570b2f682c9bef688c4fe49285d7c894295a655b5d1ff16150d32c7870f307a62b01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c00b1938d6d3c542c0b7e9d404484e0a

SHA1
99db24b301f7ab1454cd3c3729caa5ccf4f85ed8

SHA256
bbe1e1954573dc5dbb472ad2aa1add0ff8d598c7b43099e88fcccdfa8f38c534

SHA512
6d382f831df82b126c30a70901e4c5d733874e45028566f74bbcf4444335192317961953e90940fb4e7bf9e6934aef7c7997e0ba38465a2a8a792f0ef52040e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
928ba4c3590136db40098ea80524aee8

SHA1
0e7048010a401543da8ff7348ebbf35eae916bf6

SHA256
29a78a53cecaa61350215909aeb92e0fbbd7e6e6718d0a60bb2b3e470366126d

SHA512
8563a98db2dad81b469b0165b39335e2f0d9af781dc560a836d02995633b816f7c901ef84751ff58ac51997b10f522aaaababe953ffbfc1ea80836091af71333

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2942649a18b6228f6848f00070b2325

SHA1
fb292781a457f3c780db97def6c238e88f62410e

SHA256
c0f440d2e67b6e40bdd133974bedfad962ad88388b8ff99dc767474beca2e3d9

SHA512
d95188f2034cfbe63d3edb990c00edf228fbe5661d8491fa739036a962de9fc499d8283515db20fac98f81688f7b6d91fe4a84507b14cd037e2a89fe61063539

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8ab9334c579aa2d537f3062b45053da

SHA1
2182db27fe961f364a6380fd126d65160bb40c42

SHA256
3d5399e24f050ce5cc5b9d08d77814faa7b85eb6c09cf7e3299965b88f717b84

SHA512
b0a572490d36699a5a6ce9669bd1abdb6f894b896993bcacba48299d3b94977c49c1f6d5cc46b705c68bc1c7df0de60250d1126ee3bcda2de451be574553638a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e6f9e59d6e4fcf2937bbcb3dc7f6ae4

SHA1
5b7b6e8811b30368942655927b909addc4206001

SHA256
b1ab1398044d22bfd672faf6907570c514ce89fdc77043e10f4558c99a59180a

SHA512
0d2b6c20dcf03ceb6a2c04ce1f8221ea9d167fcfae6d6ffb976c2b1a2178c601ef47780a2f79def28c77f795c6f9c020e18b634331e4e7cdbc88d2668ca0f268

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8575062f0c971087fef671ba1f0178c9

SHA1
d78fc1157e9a6d0e25d21499fda7138ec1c63025

SHA256
97f4b9de1c08d1b7fd63d2ad2467529522697eb15ea372190aa79f0064729754

SHA512
fee812ba30eea1bad1145c66205ae70fef167b6679bce85c17b067c8d587edb7307632777f4b4569cd165ff0cadc79572c5a4c743c8ab61a3375685188ee163b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6003504460c611bb97219affaf8fa964

SHA1
e7f1b7e5f130721c4b3107fb14af8485aec4c199

SHA256
4c5d8faf4ff833479f57c281a2ab2e07d1b7152766b69904a77fe165996e43b3

SHA512
529d5b830cba1ab1f5993f6d2c9cd586b562bdec18799936d7b3f3859d422f79b7aa086d8aba043c8a1307de8b24100874157125babd8111600c3d8a476142e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1fa2254c9fc778d36fcf8bc995b24e45

SHA1
6617a4b980eec2a3b9ca3f1984b7609ff7197411

SHA256
dfc2747873f0426bc69be3f38d54179eb4ea3b71ea018cb5373afbdc48798426

SHA512
9a93494a9b8bd85468526b0d269b08e62147945e81ec430a8d3557dab940e77b77fefcd6534f978e20a5c8de9743cdb2a2486466f4031aceb313e5c1fe4f4769

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d325a691629d3443836a85c97873966e

SHA1
61155e82beb2ed826ec1b2ce54f4e67f32584f5a

SHA256
413de9c40054465efd141d96a33c2befaeaba29ce0933f249051c25434029940

SHA512
331f7f8cc8fb6fc173176558eb6bbfc78cc8039537cfe8e04bc1f02919655495383c60cedc4c60f3bb912a59727c0b73c9ab5fa354ac3f5a06b1ca7c41a6353c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5J67VDZD\style[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab480B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar48BA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit