998a2885f639b1908edec4b56ade47a5865f12cb96675a521c0c77e52aa7fa1d

Analysis

max time kernel
136s
max time network
130s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 19:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3c4b053a7158f5f5aced1714dbd42ba_JaffaCakes118.html
Size

24KB
MD5

a3c4b053a7158f5f5aced1714dbd42ba
SHA1

54ecbece221b1c95382eba3f70b753b2ab4cba6b
SHA256

998a2885f639b1908edec4b56ade47a5865f12cb96675a521c0c77e52aa7fa1d
SHA512

831f8ae04b9da7dbb54fb12e5a5b24b598a76b406eef2ccb7ca113fb62b4be5224a6508094403f51ca492182e8e88cad4dcdfc5056bf452cad7140d9574d9acb
SSDEEP

768:e5enG3pKC2pa2BOxRG4ErCDeqVbl1FksYy:e5enG3pKC32BQRG4Er/y

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6037d0fbd8f0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000571387916f196c5e6384b674ded450b03a93e0d0650a6928a49740749fe58ff9000000000e80000000020000200000000dff6518e199052c3111a9b3d4a2a4eeaa9ffcf9f02c8c565e0789c8e12a464c200000004227d4c3e95f1eb3d40e4be76ff7d87631f00626d89c43e1044830b03bc2b875400000008afc11b26eee31c8338df7f33120ff4fac9648cddc4b185690769057f289fc693724644fd018233d753946567523ad6dcc7f5507bd173f08318d1bed630492a9	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d99090000000002000000000010660000000100002000000048ae1df40cef93ff03c7f474e229e206004828dd51cee9b71cb58ee29875450c000000000e8000000002000020000000a59f19d2414d1c86963aa7110afbc58dfce7a5ed68ae16f85e9c28efb66f8c3190000000eda70f20fec686c6e5bdd6ed741660a842f1f9e6bc380569fcf58e7b815ea7767cd2a64bb13e4faa193fab7aff961a391cbee4063e45390d08819abe54125eb937a6bf6cd8a907cdf05727cd33401237cb099c19cadb0755e242862ecf823f73ad9fc3b2190acf0d1bf0b92d79e8471d77e71e2e08347c55580bb42138cb54655dfe7c8720b127cf2a7e246ab51f7e4040000000ec6e6536a5de36569cb7f7a2a267384a271e237e1304832492098356f6e498900e95ec384f9798e555df185189f07ac9882f835263eb5076581fdbc97672eff8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{273E1AC1-5CCC-11EF-B552-FA51B03C324C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430083608"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2368	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2368	iexplore.exe
2368	iexplore.exe
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2780	2368	iexplore.exe	30
PID 2368 wrote to memory of 2780	2368	iexplore.exe	30
PID 2368 wrote to memory of 2780	2368	iexplore.exe	30
PID 2368 wrote to memory of 2780	2368	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a3c4b053a7158f5f5aced1714dbd42ba_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2368 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3e2f2a5830315caf482fb2cfc0bb4f1

SHA1
92992b5056055d24ca87e3f74cd9a4bff3b66f77

SHA256
02bc549d21e99c7ae20c1618db1341278e8b0a63a396b88048fd3913b7316804

SHA512
e8a2a524d62d4db3d2a40cf8b9aa716235bdb86986064965a3b30b31730b0cb22026abc909b5e9bbd926b4053f8264fcb2e78633abd66d15c87f057421efd4b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
196f7c916ef9cafcb4327404c00378ff

SHA1
d8bc079d7e4d5705813a444d75d39477399d6d77

SHA256
9008d7c4a107947e9a17b7b70b8df097b59ce619a644bc63b14dad5de564da00

SHA512
1fdcd7bec8ab27aad81c825312ad1be4b0ad46ddb3df43da3511526aeae5ec730042c7cd016cab29f1100c0259865041f96fdd500ebdfe19cd5e7281867b9119

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
941ffb2a5683b85124990f5791edf681

SHA1
64131fa14251078b87b80aee529dc327d29581a1

SHA256
bd8f9efb672ab2c6d04bb1131ab951a53ef53801ce50e39b136ec646f63a3ae1

SHA512
731c1c7ecfe0e9800ea14a0bb1f5d8738c4eb696ceb445207a74e70149224db1d433fb95644a49c56e17df655907d4305a31811c876a1ed465b69905321d7973

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bff88c3afcc7e857031ee49cdb445245

SHA1
c494f29b26c8b256727e22e62c69a3fd9549bca4

SHA256
b0363e3254adc562eb6c416dd04b70feee8e043e2f796ee770beaaa2b290d1ee

SHA512
a570d90bade07b0b6caad8b66ee7bfb602413fb07bca84f7eced023b5d239d6b8993cc22a35aa0bbab5be0e37177f4a677d32300ce3b1455bc83456c3bb3ad02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05d1f608080faba27ebcdd9ac4441b4c

SHA1
0f35bb86e5ce11effefa217af232b86d7b0b1435

SHA256
72740fa244276b5f3d08d92d69eda79d1b3fe8fa8f0dd7c31f83ec32c0a36662

SHA512
a63667be24f4336202dbe9bff64681a3102b26a15f118f1a4e8ef75cc78b6bd7688b6e6f00250f53a6491875e397d276aeab96990fa2400513ce770042ae475a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67e69e4123691fb77e2a15f748054a79

SHA1
9f017748e903e7d46637354b3c14b56d13fba66b

SHA256
a015c227c95ce9a67bfe22ad44aeefb265095cce75568cf7f96d8aead7ae8e45

SHA512
e4ae6b5d1fb75c2f6113c953f82dfa145b948bf08449524afefdd1f554ea27f3ad26369eb50ff995d7ab043b544eb7dcc5b5d0c6fa13cacd1a199375cc61d00c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56c02c00cad328ad437ea531e103dd2b

SHA1
567c71f0d3c2fcd842b5918dd66d9935c22e942d

SHA256
464215eaaea9a0e701119ef5515f2f9e33ea719bbfddfea0721b7ef63152768b

SHA512
09eb8ebff63d7228c018d23e14c495ad4e82824cff585ddeed80c1dfd20e2b05abd1f3349a2e22a0fde12325bbc92576859bcf9fe16ffd1ff10b2b7ed0964df4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c7b43f20dfa43acba7637ccf187dc850

SHA1
d80709540386513be4e5cbb900988e6d387c3f2f

SHA256
17a659457f425a6d1dae3b830d9558712585aea6e4e9388dca3ef3dd70333799

SHA512
7b7ea1b5f73a6b901086c747516e50f268dcf8bdbba02843f0084b18fd56cf0063f526909a64d2080b9bd59477e324ed32361c530c8450e92c2bb923dec4b9c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b65c45f93ba80653044896c73d5e463

SHA1
cc0a9eefd50f6f6a73bc213d000185c79ee827cf

SHA256
75a1299c3e33cb8c9844608fa26ddee9eee7e04b10d761ec0580cf98d0b5bdb3

SHA512
149e206581ed239af6f290bac4cea90a69926479892c92a9eb5637b0ec0dd718b6fd931d3d511ff9b6e7a533669a44f29105f7c82b0ec9cc0291ee90578ad37c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab54A8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar54EA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit