680310bbfb4ccae4044c6d738739271884f2d1d7314f4d4fd92675f6724c4452

Analysis

max time kernel
133s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 15:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a30603498a35682fc3bc1f4172514302_JaffaCakes118.html
Size

114KB
MD5

a30603498a35682fc3bc1f4172514302
SHA1

ed7c8c1e27441552484f304476d925443c193d1e
SHA256

680310bbfb4ccae4044c6d738739271884f2d1d7314f4d4fd92675f6724c4452
SHA512

742faabf0991837e625aaedb5877bebe43b6f208a00668abea1893954b65bf398d378f9378219aed40eefefbd3bffb79866762d134e7f6ebb7be5672f2215a14
SSDEEP

3072:JmLEM969YHy6RYlpcusg18CfRUXARD5VoNm+KSv1sD34NqkFdHh095FX6F:ZlpcsfX5x+KSv1sD34dHh095FqF

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000006064e0351bbaf5be857fa930e8b48606e45428ab008159245dd685edb70b3c4b000000000e8000000002000020000000d067fe25b4c7cf7ec0ac9ff0fd9b0320c59da0a0a9aca6522b6cc42db02f15c820000000a78b5b866879b939c4a69251a0f3df506773a085a49c0378d04d18f23ab2e8f6400000006129a28fbd7bf9e6e758edf746b60ffe2d34f51c97369c98b3b12c1d4d296ef89bc5d1d378ed2027d258af14dcdedaaac4ce8ea9c07f1e6636d978e168e1b341	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{429651B1-5CAA-11EF-84F4-428107983482} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70519c18b7f0da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430069049"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000c0f2a9cd5438c7fbc174d6cd73fd0924562790d299030592a05fcfe85a0bb097000000000e8000000002000020000000973ee1b7707f453d330f0aea4eb93b74f754d644ba295e1ed2f51291c48d60249000000007ab20be1143389dd5e5d129e434ca989c8eae8c33a29464032d7866700a5fdc2d02068b7488d8c3bab0c87419d5efa6e8891d15ba8677889cf811c184994950dbf8b6e36261576170956421eaf33926c7006e7607419d94930fc950a71aa0bfa3be46d0b61343e85ad6dc2a7d8f452a48a924af77fd0138703436de40dfd31734cc5a155bd9e1297691700c75ed81bb4000000015eef1f025895fde3af70d936d38582b452fca45ba6d0890057cb5ddc20954b11452e6edcf20daeca01faa27d039ab060b1081a017f98e6712e241c2d136884e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2376	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2376	iexplore.exe
2376	iexplore.exe
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2180	2376	iexplore.exe	30
PID 2376 wrote to memory of 2180	2376	iexplore.exe	30
PID 2376 wrote to memory of 2180	2376	iexplore.exe	30
PID 2376 wrote to memory of 2180	2376	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a30603498a35682fc3bc1f4172514302_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84382af2412cbd8e2a57dba6592e36bc

SHA1
b72d9b71aa7fb8b364cdea910bc8ef62ec1090df

SHA256
295580e7e2bf281524778451dcc8d756db9b78d1c41d44ec6389451c29033e02

SHA512
3d50b1cb921d58606a425e9cc1a96fc99bbffc25301b9bedd49074a0cbd910ee8c908c86a8469c45636eb31596ee544ac90ac50844a8b11574f5ec13cedf99db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
061f9b433bcfb9066183a91e40076639

SHA1
fca5ca61050732445d5523115e776adc5f0dc14d

SHA256
58a7e126a1780b9916066bca6690537c9a54cf7f2f863bab6775f6e719d559b9

SHA512
ee9c8509ca375c3671a642e5e51c32c2e92ef132a8dcfa927dc8bb080e6c6d73ccfdfbd05155f499b0add9b18cf7b56ae2a3e620cb0877038d378ef81ef65066

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b142118f02422bdc52fa6576532f3ba

SHA1
7ff57f5c58dce72f89798ed439e5bad9f611a5f3

SHA256
ad902de7204513b22b0a1c0cfee0524217db2e08e08d331be58f9db3f36be1e1

SHA512
172e31aa815a7c1db27e6c73f0d5ef3e6ee9fb1fedf1204f42bccf89428089f76c52257e4cb2990b7ba869a77e3bd9bc0eb49a59bb4929ee15a886644a705492

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54bf69118bd8134244d78c0f5ddde97f

SHA1
902f201f54d942786b71faef41d4dfe214c9f583

SHA256
b59f4f07fab69d4ec3132bcf26610614e3695dd7e3f163dee7c4a9392001aba2

SHA512
d77f55fb398bf281dfd16526ebd831167a05c95664cc355f15e029f34dd3a7a0e036414214aab1a6f84821f1f817b31b59183d118cc08e49fe6e99bb814db8c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d9f37317c635307e58ce68945bea2bb

SHA1
9ea8c58b6eb93888306647fdd787c2ead3a33dd4

SHA256
3e518eafd564b840f70dac3b57e9a92c955ea8da8afbd9d03883cb7a841dfd8d

SHA512
3927618a8d9fcae884111ba5d338a9bea26c18c0d23d08a858ce878a6b155a7bfd373463ed5369a2ee1124bcecd43571f4fe78f7f687f4f70d1923e052f48f5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4999c58e15b283fff22d33980f63023

SHA1
fa1d9a0cb8246d49a07868663190f0a049ca6e77

SHA256
b52331ae3c9d30230465cdbc5e4862050268b6f93477a5de0e6c6ff0c878c542

SHA512
1f3cf48bd56bbcbcaf46cefc8b39361453f5151d36f2f4d4bc08b4b36dea7d70d7424c860324df0ccbe62892ad3215944bf4b9e4541d5106209adbcf77018318

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddad851bd929043b54d7c9f078d93b00

SHA1
87eaab8958fc2437cfe3e8289ee94972d70c2422

SHA256
ca6d403c12dc1120fa751e5af857ca2905a8f3cc85e3a53db7c988332de819a4

SHA512
44814bfc51f27d3c770815a253c9c76415147b4d7bbb1151adb6b95dab5ecba2f13a221276d69ed58637cc3e6e4a020c4a42ab30ffa869ec8c3ff804c7e0c638

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86799b953cf0960a7387d060f9dfe35e

SHA1
b4dd968b76517528d40b44a6b627eefadeae7d4a

SHA256
c61a5507911eab9f481a595235bbce3aaf07de84cec98bb132de1a31c0587a1e

SHA512
1504ba7d0da5679b0ab133a6cf7435a1d770c40ddb244b8b56673cb8147bb680f4f2c7e3cab3f8e8029c33339ce224a9e981e05359de62a2f1b2ad8731c38cb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a563e73c58f1f2faa7a0268e867dd68c

SHA1
ae0670db23fbdcd611af22d35071ff913e5704ed

SHA256
0c9273c5720f51e00c6c74e54634a5952ffbf5690896eaa1e5208fea22ba34a0

SHA512
2eb997da1eb11900d924d37bf7783c4b3f5d27745384f204ff6f914930430e758c60943ea4a18153e6bd8f614e3a1297151757ac49600f4c127c4466a8c850a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5afc5e27aa6bdf3c34dd6e85f7407c8c

SHA1
99014e2ffe43b238295d0eebba3c9df5034a9070

SHA256
adf625d76ec6e7db698c29b82e9e5204bc24e1d95d2b73ad2d1e20f21b900ccf

SHA512
ccf6068f3184eeb83b3ee6947c19caf629ea6657b9b621483e08a6ea7514c9fbd4e040eb3515e9247c9a4444249dea5f7523dd59ebd3821e09788a5909d1e36a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDFE7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDFF9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit