5ae29ee62feb854beaed5f943129e44e2f71ee97df07e6df3eb1d3880e284abf

Analysis

max time kernel
117s
max time network
136s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 17:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a36ccc40055531ff790beddbb229f517_JaffaCakes118.html
Size

1KB
MD5

a36ccc40055531ff790beddbb229f517
SHA1

fe160bf676b79cb5e43b3fe1fbeaf4cf0540e049
SHA256

5ae29ee62feb854beaed5f943129e44e2f71ee97df07e6df3eb1d3880e284abf
SHA512

91841a52f7dc8cfbb84db7e22a16a7dbd087adf869580c9f0ac9585c6f53d87a9e82ca2f1bf6295f4ec1dde833e9b7aca278803298df07f72803cf0e93d8cbc0

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000f907adeef1e6a5882c31ae16697b5203cfe9c5b8ed179f17b3ebe3aa7adbfa07000000000e80000000020000200000005710fb5c7e1846af445b5f49e639d480e92c3e55843715d530c1cf38a9aa061c20000000ce4df1b63d0d6f33795854103e4dfc238696582e9677cb0f2dc1160444698a6040000000924be7ed4bd7efd624c60e8eda17b61681094cd6ab2475aeebc98db951608b6a170cf3134676264671f07d2b5dcf2ae22682c5c1080ff96b6500e554b60b97c6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{682B2DD1-5CBC-11EF-8BF0-428107983482} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430076850"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0092e54bc9f0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000e02963eda549b28c04f8375249ecbbd8d24caa4c2b182275a9ee876c3ab7a39e000000000e8000000002000020000000a1bf78cf5110692edb8480d543bdf814c66e9bc9ca1c2b43a0d228504885cf8190000000991f72dfeb25d4984c2c906b696222c894f060a9d55b79c9dbc48e415a8eaf275170ac5752a88f0d20109a80c30505672c8f3dd216916039a0aeede611487a398f5ee9bb42d4bf7f7bd0ac0d87678d9b4c99dc9cc303dcd61720f6fca6597ec7373cfed3cc02076cbaadba7c69d216a38277dfbf4de46121da1b2cdc23a9f36d0788307c44f6af36aefeb2030c658817400000000e4c6c54e95510178e74698ca6d8b4b126d0ec69a1c52deb565fd54b31c6c9cc8e5ef20ccee399b3d110049e4a6ee1b7849ee0bb9a16ddbc5fe97a50fe3038a7	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1864	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1864	iexplore.exe
1864	iexplore.exe
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 2940	1864	iexplore.exe	30
PID 1864 wrote to memory of 2940	1864	iexplore.exe	30
PID 1864 wrote to memory of 2940	1864	iexplore.exe	30
PID 1864 wrote to memory of 2940	1864	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a36ccc40055531ff790beddbb229f517_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1864 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dba160c0204b00be3fc28f39858dc0c5

SHA1
c4a49cc0f168175a62db8584c3b32eb0d9954cbd

SHA256
bbd06e440e6511ef02911c2ca2bd66c90a49d69f9187268f7ef0d1d9c8c080b9

SHA512
74e19b592c474cef9da7f7d6a02f9d2d2ac229e8f6dd92cd985e20a38524c65b6557455de0fcb8fff121a557b99ff9a87d35b0c87337479bb5e256831805c587

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8eb319f0b1c0832c3e465fe849e026d

SHA1
c06f6beeb7d84e9529d20a2be29e09d5ed690bc3

SHA256
55471ce251740fb90688ef966aeea43b9a0461b6111582ac77ebf0c1eb09b564

SHA512
7157215ed10b9d4415efe7006dc17fa32f1f25e1637139d61e26930abce3d4da7a040132f3474ef70a44043f357af6e56c7f74c3df907f3fba212cbc4e8da48b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
093f07c7c85f9ad6dcc47957362363bb

SHA1
a4028d6da2ac393d9f800b802afffd39d12f3c0c

SHA256
c70b33903dc3890a1fb36b9bf61f93ce39b423b8c8b20d635c464e1e68c409b3

SHA512
8484aeacef9c85cd07d0919f34a6b10dd0ce7c1263b7a46b5cd4850b681ea1fe0d53f50c9cc2f4d924fc8ebf776c772aa8a0968a70deef583a06b6100be7b4e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78f9bc79a9aef83ac1b541fdea0d248d

SHA1
84f79b0fe75942b100f70d6180a37338677e0397

SHA256
070e89d1a1a7fe8898465800c1597c143960e5c1aa433df25fed1f941e13ea01

SHA512
1ecb9459a8df3c939e341a1749e45492422539354bf85591647b07448ce5e19564ff649946357e5c573c79ea116c805e89c794d21875d06b3a18d26c2e787105

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6bea4c46bc4959248929c41086f56a7

SHA1
73918fbadfe8f424e842baa1301644c2d3c4d6d2

SHA256
3aa423c693322426963b7c92c7b6c8ff7bc611622bfbca0e8656ddee0ad3a140

SHA512
3ead5c20e8810582a3959eec30bc8f762d90d48957499bc3602b4aba24aab574a4a52e893f533d8633d9333059d5f2c8512eddcc1d660ce7578e3a18cd4aa3bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85638209a0b5c51ee4b20a46f6c2b537

SHA1
44edc320548ef4e84601df49ade4aeb942a75def

SHA256
984d6c6e6c28c2aa7f01397e0b8f5e302e1904c21d897e85c501e602138225a5

SHA512
8bb7efe40affc7d39307b48c365f1346bee8a9be0c6da71f9dbd58a64915a60684f665c6336d041f82cf3cc1986151d71fd8d19d3ad83a40f998ff9484c92c59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08eb23130f71812d8acd744710f69552

SHA1
436976f87b19619cdf92446b0ff58eaecc46c300

SHA256
a699888a8dd1c981bdb187cfd65246a3fdc0f6214dc25700bfd103a17a6f5d5a

SHA512
f1624198548241e2f4926fd740959bab36fccd7e2103c14ea31a8c71e702b67c914ba9f544385b08d4b83022fd8e306938b873fcf63a3b04b22ea3de6ab48942

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1621b94af25ee2901fc8045fad9a2507

SHA1
8db2d589f33edfaead78a9ce84a99a31e66ee3f2

SHA256
d5eed950d005c3a2965046ff3cfef75e645caaaad9be46498ca6ef9bd23b89c3

SHA512
8a128246495961d6cc27254e8eba9179665e2878963fe8bde311bf03b40a8993f324ba7a38220d5be1189fcff0fd773eb29b670e060cb91b8b17672dc6db2ffa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a4a757aa9faf5d032d6f137c29658ee

SHA1
ea77cc6683cdd19b680c2b5225637637b0aa4f40

SHA256
ee32cac4fbf7a0c1cd317dcf8620ac4823a200793acc014fe3ec5fc57993bdd8

SHA512
8bb13a2177941dc76451de7f2b96b03ae803c3880e8076ca41cf87003cedeacc8b8cc83a6c7761978c0408e50426aa308883e4d0edfe02d2ac9bfb6dc9877f41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79799d14cc1ff250322e1704d7c25052

SHA1
edb03f8b2de0967ea648ed95e8451179417a76ab

SHA256
51c2a9746aad595651e3bafd2cf416f31065a49b6e10afe104d972857ac88942

SHA512
0a08ccc4a1e34f614c7003fc1594aff1b42f1085ea85fcf2c13fc92455e340645c43258bea4ae11cf3ebf6e452bc86df35a75eddec3c6011f867747cdbfcf93c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a41610cf46d384536e39af845c7dd124

SHA1
b5ddfa4fb229fb2e0a2cb9408c25f21af843eadf

SHA256
42d3d0056f67510719029c2376a9b851b5fd09d87e00d109e754ad898e0bf972

SHA512
b295e3b55ca8a8129e8a1c1907005193bd201794c546cd6502cf1c0a8bdf2c41429f135e5ea4bdce9b5b1272e7993702f84dbccb3c2de7600cf4711fbfffa4c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3B1F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3BEE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit