1437176d2f5f0a0ddbd537cffe61a21a0e864615122887d9465ef277d20f62a8

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 13:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a2ca2b85dcc2b79c2879a71340890a82_JaffaCakes118.html
Size

12KB
MD5

a2ca2b85dcc2b79c2879a71340890a82
SHA1

7a59122e1f4da968c0ebc1a7cb7aead4e0db3f6b
SHA256

1437176d2f5f0a0ddbd537cffe61a21a0e864615122887d9465ef277d20f62a8
SHA512

fb287b8b42ffba916305fe7ff180be765d5a3255ecbb9a8d1a81cc22668a3805a0e7a3ddf1d65a036ffcbe40bcd11d284327cf98fc5b11d75871dd461c1f57eb
SSDEEP

192:csz7YlAYS/HVqMEQPgHzKIF6jx1qHvQPHb76f:crlAY8HohQoHzKIAjLqHvMHS

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430064598"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000604cb32088e2c8162583c415a21d690a08f333e66f3d90c01d1d0435c8fd93f2000000000e8000000002000020000000d512d00b089a29edb5b2ba77f7fd5a697edc15437757dd74db39cba15039452c900000009314c38336640d35522a03024e7b50850230e1affc6997d08fac9f579475e918612d66b5303fc29fc7bf112f599af41e41e3052ea06054d9c3cc20affc50a04d9a5842433bc728b012843dc4e5ba52115412a7be604dbd6f59f5910493e9f8750e5247ff542b5d7caa5a161db30a1d55ea80291f88835f792ca3fa993d35b43035c9b861c52fc96b0f1dc9aa9259a4764000000031588f74e1d49d401d9301b80a00c4df1af64e2b674c3e9f81c44629048625a0e7c9af71faae55b07cd2811ba051639031396a4018f0288aabe3d61683e3c748	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E6C57B41-5C9F-11EF-B9AB-7EBFE1D0DDB4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb780000000002000000000010660000000100002000000094854173f15264fe28dce72ec990ed23d2242773def12ebb112164df66649fc6000000000e8000000002000020000000efb17b772a66a06701214c23a55543cbe04dc7679f4fa89f789b90b9c97ca68d20000000889d276f18cc11d4d5798e7ca5c9e83bb6afc1ed1d0472e5ebec55ad798715f34000000091220dc914cc6dfd2520cfc9de26f024c0a4808355e01f97ccc6d022da0b860f7e7ddf34457fbb17ea0353cdcf76af1213fd9535265562850cb80b0198774437	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 505645bdacf0da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1908	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1908	iexplore.exe
1908	iexplore.exe
1808	IEXPLORE.EXE
1808	IEXPLORE.EXE
1808	IEXPLORE.EXE
1808	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 1808	1908	iexplore.exe	30
PID 1908 wrote to memory of 1808	1908	iexplore.exe	30
PID 1908 wrote to memory of 1808	1908	iexplore.exe	30
PID 1908 wrote to memory of 1808	1908	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a2ca2b85dcc2b79c2879a71340890a82_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1908 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab988a0ebe0eb8eb4076ff80b33101cf

SHA1
3cb81088bc9ef2492d8cc9b3498c057e158aa6fb

SHA256
6008f8c02f358986147cf5811b567ae46a080e54f49468a9b5efd4c56d7da8c9

SHA512
c91a8bb04a7daa97cfcbdb68b162f1ab22607169d25c73626cafbba15205e929198902f0598b75376469e2bc988f4eaf6b7af83c8b20a197d4d03b8c73b123ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b83b4c30646ac4428d22d1dc3b3293b7

SHA1
c1f5e465e986e25970045262dbd6845aeaedf21d

SHA256
610096840d74c4c4758f831888db110831e95bc201dda54ba20eca318c92e0ea

SHA512
eab4f8c114c17a62dc05d14f7d9ad1462c3c7a9acb3a8d9b28f2ace9211f36ed4ffe206a317a05d718a03332395c39746da31a2a0aa15513fd5f896f075bb219

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8962d850e58622b607fa581da7e20fc6

SHA1
e3cd425da6c1acefdfbe9c914490300b1b2ca6f6

SHA256
9b50fd46c733d74eb07703b3c39ce168cc01664ef3fe9fd3893eac0eecc40417

SHA512
f66393ddcdcb589e1f269695c485fbb3be2fcad6cf4f43722eeefb85b6d80e657e2b9c9ab4e8f2b1c9d8eb5b3b691605e368523285a70e9f7173ab0576673281

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4112170909c92727a7d146ba902457e7

SHA1
a8672f319c80432572f5482c653ebd57a808ae23

SHA256
82e67a09ee0b2ee0a4adaef9976401862ab828eb63d341a156541aaaf69bfd00

SHA512
a04203d26a037faf99dd4fdaed3427ac7a50ee44d67fb30504fcca8f3c67658fc117ff7c99d69bed425149076013751ab39a4b33369d0289123e99768c2c3c0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e53e0c4b1da9abb69ac27fbbeeef51a9

SHA1
8c81adb38d9bdd210b44b30ad10f956df387f2d9

SHA256
81fe455449aa4d5e7d733102156341f69d7f49efc9f6ddfa337cb45a70dd4e5e

SHA512
863af68cb87c1362cf86142755ed5872159c1e08773c65497d6e44e03d7d5bd2693a87747b06f7a5aee4998a918cdfc4be1cb9350179919fec06feb49b66e130

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce9c60d2d790919959d010f5015780cb

SHA1
f0f00f2270f2bf4f285afaf0f34f1db3e897e502

SHA256
37f185d837062a9166f8c1d96202cf03a05425e3e0c16c78f6f24b0d844e75c3

SHA512
f68e1a701e53a2f30fc006d747349b8cfb41a135fc208288e6bdd270428a5052ab6314f12b5f84526dd2a4a2c5f728785b1ba46249b1ff94a9b38b88023eba9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6440db33ba1cfa193ac52749b47423ff

SHA1
117016adf45471cd1d9c49c0961ab0b5512ea903

SHA256
ff0c0c59df6c9f14790e2c165a6da8d966f7420d2c7715675d3331c0d928a3d3

SHA512
b409d77a1cf44234b2f964012af50e806f56251b4ebbd42f96c6dcf9c61abec4f68546dfd99d021b1b14c841726ccbe3bfd6663a103ae66ae47be9c48e7bcd29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65d35dbfb462b832ba80754aecbee47a

SHA1
f414197a24046b34582a4c3ee24d58b8764977f7

SHA256
f3a42df9cdde8154cd06f56a6411f9d51aee13304988e7534c1f4377fb8db139

SHA512
4c7cad54d316327278da930bb52590513bcba14a3a36de0ffe3303f5a5a6681c3029b0f68e464f031a06e1466589a2c77861a06acd482e384f3ea279e6107218

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c62a2628c36e547e44352d784ffd8c9

SHA1
c44b714d94f67d235a3ce600c53af0fd3d32d529

SHA256
89204a12cb02bda8efcf05b5d42059023f3bc4115377796c1236349957413495

SHA512
8f0670d1ffee23a00d18343584f7efcead3309ab93fb23834b76003322f8461131c3ff8d664a540106ac6443329b9399d90b8a5aa40013b19e169197fd7630fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
624645b33dc90c71c98f838b6492f780

SHA1
77cb3324db9e58f89f0f8502b561d4566c49fb3f

SHA256
41bcc12256c404d4acc48c9d6af03cbf2e1382b07ecc4296ac670be419e135a5

SHA512
0a84bec63f61ff313beeeae3b1d673bbd061cef127834784267d9dc11c6dd4fea6ae92fbe37b96c00bbd9ac9102abe57857eb8af7b02e9422f16f254d53528cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26aedb1e8921aa932da2b973b54f6360

SHA1
05188af40c93eac19cb7a4604f1a8ca956642483

SHA256
d32afa58105ce87ddc546b35a46bab590a80f71dfb6129ada6a1a92e37cacdc2

SHA512
918a1c6853fc60a065b1cf55301bf863f6d5437f489f9e12c9313d1a2a883679a178264cb5630d252301d806227287c3ad6950367def2f9905fb169761e2de04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c10283078ffc1810a9ec93186dc16aac

SHA1
79a619cf18ed387b6aed27b21c9c07245f5a1a86

SHA256
1645989cb918b8353a32512cfca036e5520ad7349aac886cd2ca8c88922a313d

SHA512
38757011c8f7ccdf8fa12147ba22016e830b0bf2a413d070984e56ebad6adff516704b43fb3df8ede6b2e1abd7ee2fe5a9fd152f42feee394f3e6842412f5c87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a414e03cff8b82c52486f09bf8c39e4

SHA1
6afb4bcf3d9b3fed9a979c734543d261162ab21c

SHA256
31cf31ca8687e58c1c5ced9c8abcb22370939289258708d5e4add6aa99295376

SHA512
157952fd98aa51a50e6c311edc44ccc7e8f03ae9149aadde5af42156c2d8813f5e47e1e10511bdd6d91cbcc18484fa08f3441d02cb2d01c47dcf79f369a53c56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
944a8511590b41d484285b763d425a79

SHA1
114640d5bab71c38771df69d48771757ae169990

SHA256
7645e63dba86608d7bc227c10391056e90a0cd82427208ad380d1520e8654ffa

SHA512
2a8661e4401814a6d4bc1147cd059ade86d085eda44a0d86d1f76a23937933a1d48169ef49ae395aa08bdc32fc5c6cd6f30b208a0f825ad0a984fdc3a686d62e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e851ad90e9b79f2787e68b61d73874cf

SHA1
3c1a4acf7735ddd0ca3dcce0b6a4520fd8898425

SHA256
d7d23592747af0564a0d2c00a45bc0d3f2538dea8c53f5e6201645ab795c1a4e

SHA512
121d99f79c5c31cb7607b7238883f03590c071bc017eda4014eef397f051f5669a2b8ab8fbef9874300bdeefc401c4104ca8930a83abe915faed143a9a137c68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
394eb29f7b3e147f23470229034bcf79

SHA1
833b1e9fdca9fe6445dd85b45ad3dc4abf45862b

SHA256
0a76d24ff4c5032ca5a0ce99cc58d361812a9bad3255567d982d508900a66c73

SHA512
dd499879864d8cb1f121413366a2f8fece49c89269885b1d4ccab050da2318ee1e4d6aec1965c568639a2edeb09647371db4e71c4c60ee29c9e0372331d36828

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDA99.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDB29.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit