5ab5f6eb28ac110c05b2c74c4f0ed0d08fcd638b10af698d4651ffd158a38a48

Analysis

max time kernel
144s
max time network
150s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 19:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3de91d0754e7287a334d085b8e6fc77_JaffaCakes118.html
Size

217KB
MD5

a3de91d0754e7287a334d085b8e6fc77
SHA1

935f3a65967aea7cd48f85ac4f5c1122b2c903d9
SHA256

5ab5f6eb28ac110c05b2c74c4f0ed0d08fcd638b10af698d4651ffd158a38a48
SHA512

f9283ca7aa819b3453089f39594457ac668128cc442f44a085195327fe26b205114df4015cbe43b6b53e240dc99d7efcd5801ae26821452c62878e9a2f8205f0
SSDEEP

3072:aN7OhaJhfDDyWfEY3dE7gjz8S+7FMEATa7gjz8S+7FMEATx4pmbIwDAQQ5ctp:aN7OhaJhfuzFJzFbmbIRlU

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0ccf948ddf0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000c3042566e85ce2c8994937e68aae61a5922a883c364b11a360d8c1e095f6e18d000000000e8000000002000020000000cc9ee04d424c67ce4addd6c170a121767d14d482d408f82461b3a720f615fc719000000096eea2e3db322cfd2d5a068dce2c34fa459cda9133bfaa3109a3e72d53a5d9d2546d21f02d3e4fc4011ee041c47956fa46fe2ae241e761c19ba97aa593591ddafaec8633e78f961c112beb025a9002fd8e7f70bd921d8b10e4e8c7e634af6f8d7117b5b2839814e47d098931dcbae7b28e2d8e1984285955a63eb1213a34378c2350f1dc9273d76a6b2d29e9736b0ca24000000045c4705fa1f6b68cafea4ad1b55c9b6853a21e9be9be5fd3730d0c017b13323ed56753b2cb3844048ec3d8fe235a27c1cda613e427e773e60126e03a44c1c2e7	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000006a1b3d70cc6c095eef1d269ecb1d2bb611bc5a4553906d69d3393ab3a576e57a000000000e8000000002000020000000d2e5723cbcbee96312c52858d82f093deff8f0da3861423672edbbda55d0031d20000000d1270f53e02d6085f95fc040255e7f2fd62671148615cd4deb928e5474755cac40000000103d07274756d205eb34bc26522d914bb0bcece33c282c9045bfbed31182cb8794ee2d0000b5e13ef185b427c8a24230dcc1162304c733b46d20b227e5ee4663	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430085460"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{710A9A81-5CD0-11EF-80D8-CEBD2182E735} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2436	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2436	iexplore.exe
2436	iexplore.exe
2452	IEXPLORE.EXE
2452	IEXPLORE.EXE
2452	IEXPLORE.EXE
2452	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2452	2436	iexplore.exe	30
PID 2436 wrote to memory of 2452	2436	iexplore.exe	30
PID 2436 wrote to memory of 2452	2436	iexplore.exe	30
PID 2436 wrote to memory of 2452	2436	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a3de91d0754e7287a334d085b8e6fc77_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2436 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
11c1c07b1f9b372d000dbf4833ae113a

SHA1
92befefc340c14ecef804044081800d004a2680a

SHA256
82bb0f3197e560c54d3372718479be771a9211f7c9cfd9edb6eeec122352bdf6

SHA512
f7079184cf1b67d4f56e78299d58fda1fd4df8cac7529e13964690f113c62b299e519762cd84a2e2728f565cd1ded8cf2a6073d11afc6d32511f1d2d54e80c7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c9bcabd41af4eebf64cbfa7cdce8258

SHA1
24f68f94a51e327293fa0e09ade68e92b20711a4

SHA256
06291d4e855295574d6699bd8048bfd939c37702f0d394bc46eb03f0df230540

SHA512
3b688089514afe9d38ae3183ed324125c724a1b08048df1ea26d8a45b00a3f447b74d074eeaa20040476221ff3cf2733ad85ceae9c330c12346ce9af9cf70f1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a49673eeaac6d91652210b81345c2860

SHA1
c6ad9846f9fd38b294236e6c23df2686bc47cf40

SHA256
3c081b749a4b39bd9cc52d17dc6cd2490ba91f51e9ab349cde752ede954461eb

SHA512
2368b66fc529bae8108a8cddc564e9b4d9c45a2bdeade4dd8ed18934021f33c63a72be7832e4a40dec6ced24ae799ef3346dcafb339bb899e0d1e45d28f41dd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c1fa59fca2ac642f992ff6064729f75

SHA1
118b5ac334072f8f4c1607c0f2982871d7f9ea7e

SHA256
a8bd3e7b7018e486ee3dfe8c2a79d0b4ebcd87edf9498cbfee19c0a8aa0fa461

SHA512
cf40a69764c0fb4b8dcd4f502edda2cc627a18394b8a6d50e83cd9e1d6efd60cb0394887c5a1bc7a7237f30888dd2129412d72e7b6bb48de7411c7be7af11bdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06785a93c4d7fbf6f6f49442eb304f3f

SHA1
59489311d81eda0c25323770a64ef301e02eb69d

SHA256
c3f9b47287966f2b2f53cc2f92ff4d5f13e4624fbe21512cca184e16140a44d6

SHA512
4b7c0688c97f1ed6091a334bd5fa025d9849eb398852839bafa3f15de20108dde5ccd2574af4c61998b438a33e126ff85495c3ba815e284e95d852451e42b0e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d38e5f41e6244feeac873099871f83a

SHA1
6b80f742ba0ed7a6b42d2d665f9022bb338c8c8f

SHA256
d47253ec0eceb12abb13b919bbc144a582975234d362a2cd87ae54fb67194541

SHA512
a9fcad7b9ab8bbd4957a68ea8ec299d2a728b2bd97531d53ea3c07e6ec08d8a038a1fd4f780a2741deb1c216dfec07ae6424f30ebc80db2985bcac7707d3514f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cdae9cfcf1973e93530f6987da160321

SHA1
a7b420966c9f130ac9c1f812c21fbbbd5328bd0e

SHA256
da3f8db5a16cfdffb590d59959de9b1eacded3a8c552a86320782d35dd5e3108

SHA512
debf8dc09a3025940d4b78189d98d3259f41f5dd26a5de57ca66eeac6e29d17b0f977c2e7b4b7d9c79690e782d9e1cde079d420e81c70c7a8d42a37f3a096d41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
162d20ad29893e223f26195a77c3bc8e

SHA1
148fa9a85a13c4f591657de193b874643f2c2a0e

SHA256
b580744da79488083b286b8eb6648a1cf9ff99587412e0505e0d7c119047e84a

SHA512
c8cc6492f3f43f9ff74ca9310cce8950f6f47f297073cdaaef0fd64362835c3276f84ef94dfcb9903bfbff0614bdc925e30b0ed97a601966517488161954ef17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2202a2804693a0d44281ae4149b629ce

SHA1
16cf16b207244cfbf0df1139f8801f60073b22a3

SHA256
b7954d32b47b58afd7644d95cd3065a13ff3d69f87f7c9b64d94e1b0a2845c61

SHA512
42744e5117c7924b28171e46841a73cbfe149216b3685d651427dd907e36e101320dd53ef0125e65b8bd2f98cd9163b3815832da1dd32856d13db77a35542be7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e74041c4375e6f0fa28be75660060a6

SHA1
5bcd54c5a4ff4fa3516cfe884112d16010e63183

SHA256
7f8c8289104481e0a2677bb98d4a2af6264034c8cfedde1f816aef9fc36f99c3

SHA512
26a963ec192d40d3425ee89a8b192a174e9afea448d25329cbecdaf99e0040027edeb20b5679c09d36baf5239e26ace75fbd465009f128e7b4d401002d4c2827

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
6216abfaa81f36e70f543e88972785ff

SHA1
bec7fe5441fd39e9fd50ac13f24f4b89022662ed

SHA256
ea489dd7887a81005dbbd59844c3eaf91b02fcee1d2d5abdb3b230588f0327e8

SHA512
51180a1d90d082f5a85033ae5a5581d49bac39f764f83f911f223ee18ec55b3353133e3110ecec484b13ecde7796d49a7363aec630f267f2c2189fb006cddb98

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2F6A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar55C0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit