1a745752686916637c78aa0327fa89e013585167c68a06978b100c7092926fe4

Analysis

max time kernel
120s
max time network
132s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17-08-2024 19:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3d331788cfbbd710f68e324a05e084e_JaffaCakes118.html
Size

53KB
MD5

a3d331788cfbbd710f68e324a05e084e
SHA1

d9480a790fc9171a50e2f6477476172234e51c8e
SHA256

1a745752686916637c78aa0327fa89e013585167c68a06978b100c7092926fe4
SHA512

83914cbf7523f83a8a8e7f5cf691d7e4e111f82492fcd2d0ab065c531dce99f3051669058b6ab0ec4a809267e650dd327aef7893bf36bb0e5d8a3c460710a504
SSDEEP

1536:CkgUiIakTqGivi+PyUzrunlYk63Nj+q5VyvR0w2AzTICbbBol/t9M/dNwIUTDmDT:CkgUiIakTqGivi+PyUzrunlYk63Nj+qw

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0319e7bdbf0da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000cc2c2247a047f6760740ea3fc0561bd442bf4a940ec94adf3fff101d45f8c968000000000e8000000002000020000000b60aea6d1d1e7f22605d3fce88ac7aaae4f5cf347362f0fc707e87fd06c8f9f69000000063e0f24f1020d1627429e6894bf5896f1fc490bd34c1e5551bcdb0b62595a4f259852c6f975115cd5fbb0f2d0753f5196106af50fff5d5b86488582272daf57d28a96f7358a4f56a9d8bca14f7af49d3765d4ad2ccf612efe4fc01c283e06f861eb8bf2ce45d01e578d30dcd71bd106c4c0c1b1a579568791ee8f9a7aa14407d6bc177977b2f7fa232ca73422da176b740000000049914b17917b9cbdfbc5623d3a229d71a0d65fc9c11e9ab44fd6403aaaf74541506128c109bbb9a8b894254dcf281f7774e9bae005fbd456b511924c4100c21	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430084681"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A6336091-5CCE-11EF-A3B5-DAEE53C76889} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000962564c040b8a0a37f50702d391cb60279eef0843008e688e5304c458ae5fb05000000000e800000000200002000000077991af7d79a453e033098446926adbe3e01848436066bcfb16c90043f1f4b3720000000b8981ecced113f198fa29143f0f53289a4765761d9f812abf48767b8534b642540000000289da9b491db885e5e229c8c715778a5fa5693e356be8e45ae8103dd4f73441d7f9856bdcd0cf3ede8c7a6c51596914dd58c40729a1d40e8bdf5a5331af38dbd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2760	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2760	iexplore.exe
2760	iexplore.exe
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 2664	2760	iexplore.exe	30
PID 2760 wrote to memory of 2664	2760	iexplore.exe	30
PID 2760 wrote to memory of 2664	2760	iexplore.exe	30
PID 2760 wrote to memory of 2664	2760	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a3d331788cfbbd710f68e324a05e084e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2760 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f57da9d6e32f0e3668ff14490f74c6d2

SHA1
9b17d6260446e568e6d67cae42c7c78eafbe843c

SHA256
dca127a41736172bc48e949e1f79ae47e6f937da6311bdd7c74b255a38f246a8

SHA512
22c84f7a851916b14f63a2bcedfbad61af73b3f867e0079943ff314e34825065b4521f59b2398d6406888bfe559023c641eb5c3ebdb17a2f52b1a61a6141b96d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
144d85a52c514cb4eb0507180f35b6c1

SHA1
d28baea160fb3863b431755bd97fb2f5eaecc8a6

SHA256
446b0708b714b69d2b9363fd00783ec40e28be43d2379da3b825d97e222f6e9f

SHA512
0fdf2959e799a12bd5846c99adc7307d20222996be371041d08a87f297430c241ea81b629c3a9e1e03b915a3e39700395637242dcfb6fd4f5d40e2105b57d6da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e296012d2e6ab4dc4a9bcb5e2ee1e97

SHA1
b670a860cb01bcc378c55907a8d5610b96173860

SHA256
4dbd8926e66cca9420a0a1bf36aad3ecab0e81f3bc62c3075aa60a33f368a7d0

SHA512
19ead9947ae96d7648f72c290bceb6e57fb1c23bac52d7d26e2746eba0a25ef199cf36d9a755c397c29dbaf1665d8368af1967441b13cca232c7ae60d7367675

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bff4ec5e55c52644eefd229a87198609

SHA1
93cb3f24c5ae073f744de7e6356774dc9f790fc6

SHA256
89f1dc092840413552ca77f9ada1760d43d13c191377cf525e94a095a5186cce

SHA512
341754afee899a082a780be6f90a1e37c05415eab96367e8f7cdd15c0ead38310ebe275f786c6e6e48d8579074a752d913fa9a54e2f2e8f52af4febe210beb94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09e946f6dfeaa4ca00a6a0fc7b1ce40a

SHA1
e1580c5da90c116487dc7ee77c7d4cd355bdd3f5

SHA256
ae932ef641ab563fb2bd37bd45805e6be1959896371e3ec0d74e0f43827b6bfa

SHA512
7a26bf62e2e9dbd99ad00e4c31b42de7cb5cc7122748910bb3d8b0dfd3b2ed4fe57bb2473ad8ac7e3a9ad39b8761ead3136d26fd763c65bb2e0b329d6054ba20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
762a20215d601ca61ed6c125a395b71d

SHA1
b0dac09301fb31b2ffae286635b2365f1380ed5d

SHA256
5536b27546f62f91f3cc45d2264572899c9aa95b57f6f1b5299b66e602dcd17a

SHA512
45d366d0325157fac52debb60cb4a0d02a9239e3915cfba10148b6e2ffd29f87ba76b3510653d4ff38702758a036a4f2a6adf31f8f442eb98e96af4be1d120da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85eec004451b8f715823a02f0d345a89

SHA1
0a73f295eaa1a15fbce57015926d7b23ee368663

SHA256
3f598823d4733617c9b5eee8509be8d3ac89eb1c0eff9bd485a63e8df3ec328e

SHA512
f1f6a443d08074306f0cf0500a4b0f78dc5e0187aa7c7265c0bb2ab28bc2d6df777de7e630b81dd58dc3aabf4d788e657936b95026cae881b1358e898588fc34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32509474a07781a49267aa0f7dfee2ea

SHA1
c4fc4a6084ec1863401c4d6c8adc50aac1c7fb52

SHA256
aac95ca94ca3350a06f0ce7ee11d5f1516758c923af31a3bce6aa609b235fede

SHA512
38ce0c7cc950bb5c6dab9946e653215910c12004b4c60ea969685200be561b5d2ae36f804cff86dfebb9f65ef0389971cb27eff4a6d4f1654d5c0eddea031672

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
853b3422f9f02dce827aee3cf12d5782

SHA1
5847eec49c7c3c349e042226c3c1c429cdf7ca17

SHA256
37fc6e5bd1ca029500497ce6e0878cdbdac4334740522e271ba775213ecb5911

SHA512
6fce7d71d735c03618443c8dbd9addc208e56c7897863a594fd8e6a2356063c66cbf4ccbd1acb726a0d4560f8cf9176e2e1ec0159ee877fcbb04ef6949ac21d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9710ffd6cba7a0eadadbc29d01e9978f

SHA1
088e9cdb90680a9bdaa57fac4de0b8ca865f057d

SHA256
082f145bad5f2f0a55a5d2f19f2ae7b63c02e6e3ba1a80d23faabbf0aa06b8b7

SHA512
ead733140202bf182f11759ec46eab4c36b454e77a355dd5cd60d85dc183ae37f1c4898274b0e4ec6b06bea2a295571e91c3e31c0096f619f7241b4e51234baa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f483e39b6f32fe72bd0a28576a678d54

SHA1
3ea18eb43751a99f3e52bff6b7e2c0f65a9d445f

SHA256
d4b19ab2a5d0f1642d2ee10523bdf5f90c1b238196858223e21b443bacfdb940

SHA512
a9f397dff1c0a547e6edf2a1d376195a9021c6fca75a0f90be2fc99dcf5dc8c68d859e7512bbef84b5ff80e9bf82ead92c44652ec2dc3e76646471e3418bdeea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb97595178ec2cc3543f655e2a2c483d

SHA1
736e66f730a47d83e2b297b45441e0e252184a12

SHA256
c85588b54c77b22bd0651a1fccbeb367ae056322cdcb950d85b0f3eddec3971e

SHA512
8eb9616f91cc40a210ad0504a87b2fa3ccfada43d0313e0de5625b413ec480f9105a4634620c9f0bd43581185fbda103392ee3342e0aeed544848bc265f07037

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c4447f00f5d6ba2d49a8aa599aaca1f

SHA1
503a0e0bf9988731341271fa5fa4c8efd4794874

SHA256
0ae4592c4b74c2b6aa9faf8aa2fe2218a55a9c81a607c9d5cf5a4d55a6c6b316

SHA512
fa02a8b024f423073629ebe3940acb12fecd1b3cec83e0a804e798a583b1ce5784465f43601ff24c3f637adf3bf71643b217c3fa78e392f64e5167aff4dc6e32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
505a4af887f12a80b568d009e7901c10

SHA1
9050f76116bd2333a01be3efc1d68795ab5ae998

SHA256
3b1e7750f8c3b8ad120602b5f2d0cc002c49cee627da2d55045fe9a90bff6f26

SHA512
d3d13ce3ee29bb822d6b69b32746ba2dccaf8affffab78045e9437d24df41d1c9c75617679baa21a7a39c1ab15ce2d9cf8dcc50cabc68f96642edf228fb32de0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79aafc9bec29f6e164a1c498a0f96163

SHA1
a0431ace1d9c4dda53855a3c474a05dc220779af

SHA256
c5465dc12e92ee4ced5bc77d7c311b60abedabf397d8540649d4f2586b18040a

SHA512
974a89d2b95b4662f3ed3111a2e5e640c67bc8a246ead6e373ed955972de6616abad03014f95a88657ea1b3de8be72e3f0c0a0a3733ece7fa9045ad265582349

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X761FPIN\glossar-js[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3F16.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3F86.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit