2cf252ded5ec995851c8de3149f2e34907710927afe0b73b8ff42c55c70d66cf

Analysis

max time kernel
140s
max time network
142s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 15:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a301450257b0859e6402c646a8eb7202_JaffaCakes118.html
Size

9KB
MD5

a301450257b0859e6402c646a8eb7202
SHA1

f1393cb3843dcb97043e0f7c8e2b6ead9d8c66ed
SHA256

2cf252ded5ec995851c8de3149f2e34907710927afe0b73b8ff42c55c70d66cf
SHA512

4d272c0c258f175e22fda59a8eeab74900cbbb25891555b65e7054b1ee44c50c0ca5a64e697096b3e4d4333d309481e6e0bfe0e719d16ac5969651d6f8eaf5f2
SSDEEP

192:SI3iISUe6ollw6Nl4x1GriUgdmYl9ARjxaPvei:SIRIllwclEGrivdt6GX

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7C182401-5CA9-11EF-AB78-F235D470040A} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000ee43b52079129b53c146c4d7d4fbd50f2b452e47ab29495b2b3b62dedae1b33b000000000e8000000002000020000000ce74ef1360850e666c56f9d966c5b8ef620c21584295a5a7bb8c6d7d0b0b52e490000000483e1d26a61d567c8d1ab92813049ed2eb8527d35e6f60285dff8fa0afb1b35ecbd6ce662d1836ab5e0db5790c987f66cad51ed81f62f14a2bfe0418b0ff05787b920addb0a3113dc24d224f6385f0bbfb95dd6b15f33ae4ef2ebf6190f37d14a9a1ceccf47073907d8095f263cb44286dad218c7e78f7a8e6e5b05f85b522c714508530e1392f5d5f60f41567e1ae8640000000e9fb174d41e239dbd846baf699e6a6a26740e2ec06c360230f311371494408e2dee7b2fecf17735f54016df8389bc5f2b6e28af8bfee1bcb6703641c5f16a28d	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f074886bb6f0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430068715"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000007230995e7eeb3191487b77a9ddada284c5af044738799926de36e9d22e9680ec000000000e80000000020000200000001ecda92f2027e4f8f218ba3f7cd96603b19a16cd0151c3330fad58a6a336c56a20000000e81b9dd749819fa6a11232c50775bf0d56e851be47444c900d946ac7b0b2172d400000000091d933db308aa1296ccc5645f94a71301b298dc195946803d70fa8492dc692029c172734fc3b7a09527bd612905c41c7466f5850866ebca401fd6787161632	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2088	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2088	iexplore.exe
2088	iexplore.exe
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2036	2088	iexplore.exe	30
PID 2088 wrote to memory of 2036	2088	iexplore.exe	30
PID 2088 wrote to memory of 2036	2088	iexplore.exe	30
PID 2088 wrote to memory of 2036	2088	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a301450257b0859e6402c646a8eb7202_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0cfd94df4346cc9de71596cd0c131646

SHA1
356e0eb1c4382ec2f5a6f312af7778c1192fef7b

SHA256
e0d430cdd33a2582c40bec65f227c1cf188f60dd82b12e04b1df1433109972e2

SHA512
f3e39496a28e12969d4244d5c3a8cb44a8dadcd3cca3ea8743efdce8ede034ac04f176ca8947ab633f160e203953100cef134e22a03e91e28263fdd4deb78493

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d70a265842e56f494e29cd38a56901e0

SHA1
a8fc29802d4314c25b4d6b5edab0798de1f9ad97

SHA256
446d2577155583462500b67b9a2d4daa38834ea735ddbdd66a0fec1f2aff0a6d

SHA512
ceb255d5ef536352b187e865cf0612cafdc31b2f81eb280183a04dd35f420872d0574b3cf2b61d15b68cbae5d44c951181f41e462a79e8435e531ca03d6e56f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a9dedbe3ad7dc38336a5c2fdf681153

SHA1
cbabd99c5de9275c3957640ba9f0d400707fa192

SHA256
1f30b4bcff792841db8087e251f6bfc0b271ec7da5b0c5668ca5e4dbe332d5ed

SHA512
5915c38b5fa3a3b7d13026ae2683e2362f14f3c4e77c990bd4c3c277738e95f1a088e5ecc34795aa0184b8fd08d0009aa75e3c5111b135657f9140ee73f48fb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6784fc2d47a2ab047d34c37c1648ad7

SHA1
2e52d63e6b67ddb1b47d666c712ecb8e37156d35

SHA256
d81aff185ccf1d5ea936dda95153fc4c904433c4fb77ccf96f5aa3b988c2a6fb

SHA512
72ee64c54031ed5a6661d67c861cb87a16f00b39580d1d4647a4809e6380e055c072f675624312aa37a2e8642669b0f20dfe3c6c728de5e65f957cafa3972b07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4b1ba5710c4b333c906691dda939749

SHA1
c73d88c7bd64eae5d7486ee785efcabcef295249

SHA256
7066aabd152f2787e096593c8b0f8dbc9cc3c10e1642d2dd90290a3922a1f6ec

SHA512
d93a18b16ef666b4234a008b2b961be8b64610a59372b88ee9eb6e27f22d2fe7764aaeb7b42fd267314212467eac1d8d3f9001aac6ac614289f9b4a44e7ef85a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a303facde8ae780f0538e6a98c7ed60

SHA1
4d43986e3e875f44fc8e09c82c98662ccc4fc5f2

SHA256
f5fb716944253bbece04c5227a077aea85981cd3d0b64cce08ba2514d0462f3a

SHA512
49b46dac106cefff7e73e423973a528c7d1e36ac760ca6994a8ed94592f7cb6d638a664ab007f1346c4c20d0a2a0e7944ce9d42039742c40de4c410bc3a13d66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d20b60c1d0ac0a9f80f79e5e70be6487

SHA1
57c984d5f7d07547e9d09cd303a160ee25c98a1c

SHA256
bcd90e1f76d37cff6e4e148d8644731b8c230f04bce1afad1f5d8aa1e444e0cd

SHA512
ed3776918705da2ce90e8957c6346b238303447add50281dd4f1cc66a424c465f8405fbecae583db7a2c6b52953352351c21e79fd687ebd999a1b12a70e45666

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c9b5d716215e55e610babab9218133c

SHA1
94b4076f5f58dced079ca98f632e7e285ecc610f

SHA256
9b621c780d5add938149b9b06b8061bb7f6b98fe3747a0b9f0fb6b8e2decc54f

SHA512
ce7b9c391c788360083ddf890073c5cec503dc7713aa5c22d3eda44e1f066d4db850488ef27e5e6fa840354ceb0895bc9e0f3a45d679ea41909821fd01383059

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1185f5c5437883cc2882066eea3fa7a9

SHA1
a3e53a6ef3252702354ef1c9887722e07b1df340

SHA256
a2ae794e2c01758bfe7f92aaa37dd6e65a9b69e8f3b689c3b4d848853532d04c

SHA512
adfcc55bdbcf05726ff43365d485052088d2e25ac6971a3be3ec2fdcf3c01d501caeabf215de42c0548ad0e0d0e0c8a0aa3b713a16d581d3d1c9684f7a7074f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79dda0766cf42ab8f593fb83ffbb0329

SHA1
0c0ae4d6dd77f3eb79185ae71c6b36c18e0bb9f8

SHA256
5402ffcfde8c88773fde665aef6479a6bca641b56d36854ffbd03679078276a1

SHA512
023fde5a4f86914ce6f9748d54a4f0423adb4ff487c7064720805cafec4def6956259e57e749a3c1d76f2c54792ddcbb7161448a6e3ffa25bbc5c7702d3f92f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
651b553fd4709d5c1e89173160be53f8

SHA1
91afe33a47575204395d4e04728446b22bfe3666

SHA256
0ec77a3ac08367be56e7678244e7a3ef485db76521d00e94fea0ca704fe545c4

SHA512
0989eab085339c2b5efe163d8b83f5f6d996ea499b4378d87e51d20663129d994560f402ad489611d9d1c28455bd6d3d35b7e06d79ad0c6dc9a20e11b6a67b6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
717821925290b51f98ec9061dc3640ff

SHA1
855bcdd6c202e957017cfbc82861d5c07226f8a6

SHA256
82eb4b19b8371a1222718d366c6b1a77196618b3534e281a12534d369692394b

SHA512
3a69237e5c47c6b9e8098b4ba9824e73b0c817a3185d7879aefe7ecdb27f2049682c5334fdcf58fe7afbadb8d374ac4bb1955ca541b22d5c463de146fb152211

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e1d7af5e938543d8460b85ab266b197b

SHA1
4d27a0788a953fa2014351011de8cdc6704d2414

SHA256
095de0145a6555b61fea4984bc650240e69010522a552b51846aae41d9113ea3

SHA512
fd04159070348eba29b8555551ac29d90ed59391f90f32c44cfc4db75bc1e113ca9f321bc66a28c494bb2fec7eafee2a9362a5b8794b481163ee3c9d39392b52

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7458.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7507.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit