90bac1ef2258ab581d0e94e285113b0054119a39db4e2b23fd7a549ba902eb05

Analysis

max time kernel
135s
max time network
129s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17-08-2024 19:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3e4892072f9ed00d7d6d115e3e65758_JaffaCakes118.html
Size

43KB
MD5

a3e4892072f9ed00d7d6d115e3e65758
SHA1

b892224ece05f7a2ea4d7ddc6bc25d8d57493348
SHA256

90bac1ef2258ab581d0e94e285113b0054119a39db4e2b23fd7a549ba902eb05
SHA512

bd04bfb98ae582f447afec7ca143b4fbe66600e33a56f6702c518920354a134e46c2dfe5d77afba8f17c2671fd3eca15c3bb318feaedb77def0d13515680764c
SSDEEP

768:SIRIOITIwIgIcKZgNDfIwIGI5IcJ7SaIRIOITIwIgI9KZgNDfIwIGI5ILJ7SF1zN:SIRIOITIwIgIcKZgNDfIwIGI5IcJ7San

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A7165E61-5CD1-11EF-AC6D-CE9644F3BBBD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000006c0529d80b8b10502915c5d2913dd94f814b0b898e2a94cb0dcd7cabefc630ab000000000e8000000002000020000000f0a94613e6d646a8f0e7efd1629aac8185625973459aeef37448d811b78cf514200000004a72af22b5be6c2f485b6dd550e218d48284a30375a8aec022f0c605919579cd40000000945807532850b0ad250af2c0c87860d0abf7b799722c96dca5e5093b926730524691c708884f4e06c29943424f817d521dbc2411eebc9c444ab84fef174f3288	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb780000000002000000000010660000000100002000000057b818cbd6b44b8dfc83e54269043b112032e3493c55c91d824f7a37928129c7000000000e8000000002000020000000755d0e7470cf86f5c9e8f0d9fadb5edb88d003ba8329dca3c1eeaed40f4beb52900000009a8f4da4d514b3d2282ed182658b29c1c89b1eec3ff237872cb391497d9700e7cc84c43a96f6523b324a787f5ad9ebb814ba6ea7db68cbb70571c3df225f35319cb6ea043cc2af292ae201f90e88d6129dd28ffae3ea8ecd1df268560eab961b8005cc2ddffafdba2bb02c8ba40c0430d21b628c6754ea1cb5a88d59b8b5422abc6c037385d531e09ca9ba0b3e7c514c400000004a5a02f7eb8d47b62d2a9a1f3d6c270d3437d2dfb1b6fc510108ed5efeea9599f4729a4f2f11b25d620f5fe5080db0db1136f888392d75ee1b3bdd11d4a793ff	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a04cd07ddef0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430085968"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2500	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2500	iexplore.exe
2500	iexplore.exe
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2512	2500	iexplore.exe	30
PID 2500 wrote to memory of 2512	2500	iexplore.exe	30
PID 2500 wrote to memory of 2512	2500	iexplore.exe	30
PID 2500 wrote to memory of 2512	2500	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a3e4892072f9ed00d7d6d115e3e65758_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2500 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
8972ab16fff22a238ea2aa158be5daa7

SHA1
d17453f465bc6823f1dea35afb2580a3ccd35f8a

SHA256
4f8fc9909ec584937bb64ce6d925926c591716ff55e42a58d4926f12029ded2d

SHA512
94e12add9c920d4b3564fcc665bd66fb2b9e489e0f98e3b13fab92c65a8c1bb159e964ca4b359443a7f270f5333ba9a7731df1f61a23747ec908dca057131099

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d55a5c66852f4668009638bca4683a3

SHA1
4ed2889f3f06154513e64d23c1c2d7d330d37474

SHA256
5370785e7e5714d24333781625a04573dbce3f0f8ad7efb2554d1395208cb629

SHA512
f5de6b62695f164ef25bbc8b08e42189e41eca96606f2c3a8eea72d7092afd7f7d5b389fd66c50db4aa5c0edbb0aed7fb6396b0ab18c56514c9827c5798cc602

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b87814ae320290b6558db8a65745212

SHA1
669e79e82014c3364110e44030177e2018daaa22

SHA256
0e5aff06048a5ddbc913b040868ebfa01817b8b6445830aa4720f55f1863a7b0

SHA512
b9da0a8c7ea7bc1631a6bf54e32676c7299d4143be0da6635bc595c1c01104e9ac2bab50e46537f97d1dd193cc07269b9d99dc3c1807b32745096e6fc1c14f34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed9bbf61b4434abb612dae7711e9ea63

SHA1
dbb9a02cd111a57113121b8fbcd075985ec82860

SHA256
e822959af2e9140b63076fb1f776cc9567fda6b492077a971e489aaff88ebe1f

SHA512
8cbe4866b9e42f12b9a12802deae0dcc2c5de8dce6a0d5704a049412e204d1baf772aa31777b7a500da595f351183d4abbce3140975a53bce1ea9e049dbe1c99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cea57a0e28b8e6f1de585e2f25c1469e

SHA1
fe805b5c52ab28421854cd5efc24dfef838c7aca

SHA256
bce841236b1e5d9099a082c4de83b0aaa51a69b655fc5f117e3a5117b4cc848b

SHA512
5e9f5b00d45f29aad977c6b4e3958e1009fa2fa097953f4de7d66cbf63fce49a6f8be9d76a74b8fc8eb30a136f8f9ce66cbfb269b2b2d34884dfbb8601824806

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
597db179c46dc6b75ae4b9566a3c5f48

SHA1
4d2c84398001ac96b1dcca2db157e1fa4dc47dac

SHA256
e4f86afbb6842baa2a949e2d21061d75fc3e82d0d7231fd108793e4fe19aa839

SHA512
58eed3c34f8bbc49b3fe60c426fe2f80159432a7aa9b13f82aad9b6c282c3edecd37aa7999c84159a854b641e403c0eb8c621c21d01a9b2817a3b95dc6583b7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a49f900a0f7babdf9dd2a8dd4b8c2da7

SHA1
c9ec25c6136d1c0139e35289d3b6b532fbe29db7

SHA256
40b96723f0af84e7f7d25826f9d535ef1f1fc83929fbbe296b7eedd3fadc44c9

SHA512
fc0e7d68b973299e422fc829f153391ddcc5193489b4a91e61c6d5a7d95d7f08d835b4cf0c5b5a5b36874ca282c944d3c82bae8af70410bc08545ff6b94f3cd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77293de546d7f6f5b590ba3ad8b94f1b

SHA1
911d56c2e95c9b8361e0baa2ca7df9158c8b3fad

SHA256
1a85f71115e35975b13497b4e0bb88d33e9db879d1e55f0a2c8104be70657658

SHA512
d404d52c54afbdb641398514733f4ecfc0f419de1e47442d5e25da901f74e2d57471ba4925c8308d96386122c2e68c57917d44adadedc548dca03c2d60114e0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82ca51bad53d0eca5729879b0d83c425

SHA1
ca94cacacf0ee40629bd5cf5b3458898fa722875

SHA256
e913fcc3905144b80508b3871d1df2f48dfa8ef35560789af686061eb7f57316

SHA512
f46b31c3cdd04864d69a7c0691409901f801d6d876e1e292f91aea2597cda5f77d19142aefdd748cbdb2161fde151230ed36a67b0c0b35dde8a1678ee21799cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f1192eddc7553ba62c5b50846c60e98

SHA1
ce51b0bf33c60c682a8ce65ba2287ee3033bdfb2

SHA256
228913ac1b3b8c09286e2bb8b12f2bcd0279b8e3100fc391bc597780cdeaa7dd

SHA512
f441ee59d17df424c604112f3315801c92ef8aadbffe0903fb7a9ca724d18c2ecd6b8379235b04f1243977ea44dfdd549e3dd33df03589041256c9607cc3a587

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6962631a175cc2d7df15ff0401af8e24

SHA1
92c7216a2a54397f3683de6be478bd54a1ffe894

SHA256
0ade7cfe2df833e2376bb620cb8eb5d42b96134762aa7c7f6d44b841031b8685

SHA512
e32231df34a6891c5b9a261c6870434016e4a2bb8eb4b59c6dfa9d2505dce57e8ead8799ab9b6554a5aa21e7ad6813d99fccaae47a7245a687cb3a56d207b78f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a1aa792c2b9e00fdb7beeebef81dc3c

SHA1
c0750aad5866fb7078b9c0a4d2f99314f8643d7e

SHA256
a3132f0dc626f1810b7b5a5727669d31ad309d627a78a7cf89fbda3357b04701

SHA512
b6c34b41035752b8b1dd88492e282638b7dfdf5211186bc62bd9171bc84a525823919dbc5e7cfef728f9262c6812f9e00cac8b198bd03c5366fb4ba00a906f8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
d916151b39c0da1c44e63efe3eade7a2

SHA1
61820ee0a352b66ac1c6a850180ca579a04e24d8

SHA256
14a9147a8b9a4ce0ecf79cf805507dda23c8056697eec4e478e5753b1a7275eb

SHA512
5f6178fe1f510bed1465c11fc4d5130c5c22d098f09f9860d0d32495b6bcb6a0e163e1a75130ce995f5186e8c49c77c21b7b3f7a322c05402f7576d4541dad16

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF07A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF07B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit