15062013546e9c302429c33f881d301ad4b0406080d93db018cb035c36589078

Analysis

max time kernel
143s
max time network
144s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 12:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a28a7de31e4e6ba6c65e8bad5c324f3d_JaffaCakes118.html
Size

24KB
MD5

a28a7de31e4e6ba6c65e8bad5c324f3d
SHA1

e32c6fa45214e34f37730d42e18b0a84b0226880
SHA256

15062013546e9c302429c33f881d301ad4b0406080d93db018cb035c36589078
SHA512

d4480d8a3db970bed5ee8561750adc914effeba609ba6aaf800716b2da56c227a06fd4ac3908a7718c47d9ab66507fc2521292cffcb4abb75a1c9279999fadb5
SSDEEP

384:S+qJ0/eCEnyAwqFixRYbu5AyD2igNjeeeeVS1Wf4yPhB4xXSG4NWfN1Wf/RnmCmy:SH02v+J5A15eeee2OFnp

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AE64C6D1-5C94-11EF-803C-6A4552514C55} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0aeb486a1f0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430059810"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000e31f9644cfc5e07c1b6a7f407db30ec8e8a0eacc255b571ffefa41f34bf11b33000000000e8000000002000020000000df6efdce1f25d0a900005002fc22fc7174014d3ca753501909e5ee0e176046e190000000ad2273ced75894f7c15cccba486b6c7c2fc54eb2812d28cba290bb0c4ccc8998223f8cba4c3942c5fe912d3a356af009115c3fdaf9ff747c7ea0d6979bd19b84638ce1a3ff5694477a21ec51521e91e34e70e2f9d84b84162a0f79b5717709904a686f5a7461806e1e9b815f95954eb74c1fe32def5ae7259e2b98d09c279d90040f995bbbeffe6cf5e3bca5e073c43b4000000072811154af9b638d82bbd5ebc5b5f9ea9a2693fa4fa50ec6f1d829f83636e634f6216455458ee60c8af968c65345392e68f9731471b7f5759b64ba5a4435220a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000d5401cb6907dc9402218d83d305d5fb3f26340c4e1f660d723853b228cedd4e3000000000e80000000020000200000006ef590c520b544e8862c5c73722398ef72cf5ca08f6083a62af973a87b95422e20000000a98d33ef47f8d4cd80ad0fc726d1a285614cde5fcd83ab5904a000ea4c459a2440000000517edac5a52a54b9e75d10a3b7f2e1f85f9787e74b183066207c6822a6dc4a98800d6f54c23721a89cf64c135b40c74fc7785cf2b602f0fd5473995049f20b9a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2272	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2272	iexplore.exe
2272	iexplore.exe
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2856	2272	iexplore.exe	30
PID 2272 wrote to memory of 2856	2272	iexplore.exe	30
PID 2272 wrote to memory of 2856	2272	iexplore.exe	30
PID 2272 wrote to memory of 2856	2272	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a28a7de31e4e6ba6c65e8bad5c324f3d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2272 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\03F8FD9C8D11A5F5A3BA32777BAEE73D

Filesize
346B

MD5
f3eaaba9d006720d1811c622f9c677ad

SHA1
9f335a25e705a5d8ab0330204e5aa41562dbd48c

SHA256
336cd238e437e2eb3558ab37868a6c1718c8f6c0f6840926616550f85e156faa

SHA512
1e02db80db1142be5b0b9ba5cb8dc4a88c99c08266efd7762e7181b88be54f1a1d6201d590b922b098004d1f2b285b3d387fd71a107dc4391efe9758ef675e9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
822467b728b7a66b081c91795373789a

SHA1
d8f2f02e1eef62485a9feffd59ce837511749865

SHA256
af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

SHA512
bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
37b35cef87d424eb2e85a19d5589d220

SHA1
c1e26e448b4ebdde22baaed30a08c9d8b6dc8642

SHA256
95d70824749a54527364830fecc90235d5f8fd9080a2a57b7eb8f0e0d5073955

SHA512
8029380f03c697315dd83c7649fd290168b7a82b599b3078d785fe38d5b13125b196fa3f7fcc717e3c48a5ad8c729410e8cc95cfed1aa3b457707ffb9f8b3b13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9fb1040c06ddef9f165d816912651b6c

SHA1
bfa36c3baa2d582ff22732698294b40ef072c20a

SHA256
fe089bf0a5891c6cc865dcb4b3db2376e1ac8495743004b58c2a7ffe8e9adb70

SHA512
4024e7510aa4c4561695e97217de7b5d85710dd794066197d0f939ef7f6085f5dbd48429247c0b5aeaec3a026d07f67b1f26b66f23f2558d2eb7908a3a2941ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2a5be27eabd27fa7e4a022f562229fc

SHA1
ed60b9eefef723ac4879586e2a3784530e46f0fd

SHA256
1b30476fc6cd253c76bbec26d479179755e51e8b1db278c90bea9642cf81fe07

SHA512
eaeef53b4a78c576a509c4583a2522b61b189342afda0e4ffa20622daabf6b58b34b67802317d56477c815c4882f0e9adaaf0172b1c80dd3f514b417f912b08d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3af47e25312398596230c02f4d10214f

SHA1
e315bd79139e15f58c3ea91081fd2293c5721887

SHA256
42207b404fa4acec3cf322d43e2141fb44ee3a89d0f56cec3972e258521baef3

SHA512
e883c477f50653ef2c0f456d8d86ec30a0ce7eb1219773fdcb6f6e539d3bfe2d2c3dae8a19eeab7992f7b3d0eceb2d163e4775c1c2aa45ae1c69700b3d7e5cc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c03fd716bb93eb464ae364d984a3269

SHA1
147f758702e75465b8feb47aeea1848364f8a361

SHA256
fa94abb5dce48604e10753e6662e49c4d47156acde3c30f1bc52ca1216f6bb11

SHA512
1ba98290171409f3483649f7b8e1dae9ceaf0d8ca279d286f23467debfb5cbb12262b8d3bc6ff2891be998a3a277f1e2dc2d5cdd7ef51bca7a4416789e85e599

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a441c736a648e811cb2a968e96e725ae

SHA1
22146996d6a092318901f6e630ccdfdcf5b3e185

SHA256
72114663c11e663a365013559cfc08f03aba10ed8eddb47d8aedca022f14a896

SHA512
b35e7e6a054d1b726bc51138a6072200d54e0644bfb5ae8e76385ce4112fdf7a62acbbda8e59570dedad2654653f7081e6386c89066b9fc2a7ab876aa47d2426

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e418e87445959bb33628b11c637f1d90

SHA1
6242b07b670c23ecec066fb626b8df4e07319f89

SHA256
38d694e124595cf5d9bcdd2dadf5a701c82e2a7a159f74a57cf8f336bb0c07d2

SHA512
d3995d2628104aaef9a1962b0fab22e479e87baca6a1812fa82c4e659cdb1aff75b34837bd7be47c6975493d325de07ca5f4cd922df3ee89dbe5332e2223f270

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c28c2cacf6c5768030b322a412c8fabb

SHA1
9eec29931c1b75d80631d512ccb4ffb146ebd784

SHA256
466ef19aee75e077e431e29a0b0ecdbe64a3715f75ceafeceaafd231b8dca5fc

SHA512
3f939dea9ae61c87241cac2edff043d59ad75162e01b304f7a356b60cc56f3290a55d129b9462adf39292149c915ab85200488233bd8d6261d2bf80e3f2ad74d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
550d7a4b0df037cbc1b9d5a23639b97d

SHA1
320538090a2ace75c9a9d51211efe060b48af521

SHA256
af57b5af6d9bb0006f7ab830c23d54c234a0a07b8350eaa2424617263a127eaf

SHA512
72be2ee75c9f85823e271e4e8d9fb9824bc7471d1eca0aaa9aff8e4b234c518577aa668a6a0f51f0be48835fed864b189a1a5de53c92953b6b8549661ed6002f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d596ed8b824e18c8f7e6c1f4a1bf1f93

SHA1
2401fc3016aee10c18984f73f934d881cb8b0471

SHA256
26c811fca48bb97371215d8d574919398c7140785f358bbc434255be0a05c531

SHA512
4a9a177fd7695b698d79e97daf8faec13111f2ed609359871b4e7ce821b6d87560a08087d984a043ab2a946ec5829219563e6acbdee29687a1b23e0d23c96725

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
325178604255fb949b31bf2ddbbff299

SHA1
ac7faae1add0d85ba28bb10c5f3f5f4adfc250e8

SHA256
9cb75a206d914fb260ccf0431d333ada00d275610b7e9d97cccabbfff3fc9454

SHA512
bc97aabc204d48a00a6b32a06feed47490fe1e90d8198c820c15cad4ddf6c852a78bc5354cb2c5c2f1a8ee244e46d0e8d0b4dcc337a9e73617726276d43cfb2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8EB8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAF06.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit