5e3b740faaed5fee6b083b11f5add4ffe029733e1cbe3d00995361c87a782332

Analysis

max time kernel
140s
max time network
148s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 21:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a424e3b7a1e5516ff8b6dc56eaaea56d_JaffaCakes118.html
Size

1KB
MD5

a424e3b7a1e5516ff8b6dc56eaaea56d
SHA1

87e87934c01f4cd4012132c160731ef1fff6c8db
SHA256

5e3b740faaed5fee6b083b11f5add4ffe029733e1cbe3d00995361c87a782332
SHA512

a535d0f5dcc88c8ddd0bdb75b69dd3561cbee7c406991e6e7d8beeafe32feac479c5626ed5e2b368ed25736c74755b968f7f936f3962770d049af2e6cd85e388

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000c40c9762ddbdffe80f24d066f4ee56a111f4f9d9f5f82a1ad24050c6157fe362000000000e8000000002000020000000ee3ec933d2da198b0300f84f416cf5ab5abbd0a7c7a801a2ea815db94ebd4773900000005208a4b41959b2a35564e898fb06246ba1d361c73257d6b61cb7176ab7cba5307a09f8858f9484c0ce556956d57e6a8640049d66fe017ddc1596afe71d7d13f55dc12a3585cd2ae3a6deff1734cb4cec3a4871806d8c5602fa539281b37d1ab050de33456e44ccb7dfd54148147fec8233916b07e70d004d5087241bc1f06e2b47bb463e10912080494acf9bcff0b51940000000ccd4153574595419c65f046961e869662f2b1ee797f1af3c12065bdfbee1ede8025fb5a008175e95fa03f469d8a1a46439f59823ad032875105da7c784c2f670	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430090756"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CCF86C81-5CDC-11EF-90E4-FA57F1690589} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000d246415a32e24f5041d7117aebfc9c1239bc11b8a67bbeaaa6790ab12e420ebe000000000e80000000020000200000005f30a962f2999ae018f7e25cd07cb16d7c99bf28e2ad0eeb2f2b355a39e2b79520000000cb2713e70658e9bcdf1ddd5bdc4de0d773dba928f54c9bb8bba9402ae29e7c9b4000000023743e0d2803208c8d5d503b95b70470e40b18674ba7b629b5ca221cd98260d9b1cd31c7766b3e04af8b2353c871089f7073d6faa2d7e241e82e062c0849ec9e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00a51fa2e9f0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2436	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2436	iexplore.exe
2436	iexplore.exe
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2788	2436	iexplore.exe	31
PID 2436 wrote to memory of 2788	2436	iexplore.exe	31
PID 2436 wrote to memory of 2788	2436	iexplore.exe	31
PID 2436 wrote to memory of 2788	2436	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a424e3b7a1e5516ff8b6dc56eaaea56d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2436 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c55709f548de8028ec4ff9c2bf1ffe7

SHA1
ea317a582de6a3d8ca369910c96625d0d4e25505

SHA256
d6b95b9bcbeba57c0d07ee1d9f4313c83308604c2737bcdfbca27ae6398cd9dc

SHA512
294a8b0e9d16f05d02bd2200dc2b40228e01e2fa6ddfc73e275acf8e7ecf57ddd812a344b4c9178c22dd32412324af3d8d94214ca39f39d87f645d4f737ac659

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0da053a88d3babcd8c8cdfbd81b37e1

SHA1
0c62e9e5e7c1d3370d1c80c40b1a355fcd68f2d5

SHA256
03ba204742f59176ae823de33d2c8724a3d99d84e320299dcc51051aebcd2b78

SHA512
18b4174b6d1b5561a94714e2a631010d288f7a69f4495555b4d6d4d6ed9c2cc6798436dfc7fff5130d48e0895685891dcbfa5e562fd51fcbf3834f72581225de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff4476152b0bd90219f22344af2f417a

SHA1
15775b2e27d86ac752abcc73f35bd609c0ead564

SHA256
54837b5e8cde27d8a96c7cea6d54e1cebf26772661ec63f0e3ea42a16c6461b1

SHA512
557e2ac826f5bd0ba701a49843d890dcfbd7e210f241f50034db0c0693206b6b52d6db9e9a93d1f75dcd4f00c25e26cc3e680cd9f387adacf01ee584a43d50c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ff51bf010798252bf01a4d7725e7902

SHA1
a3a3a10e3bfb17359a1a8ae896b6cfeb37e5e7d5

SHA256
875e94cd47432f159c38017fdc0c3809b362264b4268874a98bd1e678be83735

SHA512
a4d08a0de0df25890dbd8a898ebb2077ff69bd81f329ececae761e9394eaaaebfa217a5eb75dd79c40c22f5c18ba9a0cd19794d1b10b5ac328d41a69b5c34bfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
169d20f5b254597c3d2878269b9a9495

SHA1
b238d895fd6577ec29a52835d53da09d604431db

SHA256
96abe0515da6ab4e92867b26d5fb314fdeb13838a3bd72305784800ed1c4366c

SHA512
ce10fca17aa2b24e36a5fde31b4bc24f031342ee0867dd3388b432f560ab44b1f2c0cfc71e8c037c1e837b29fb5fdad30cc0afe090f85f420818f1b65cc80ccd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26e45cbde7898fb1e09f9cd61df8740f

SHA1
2814b6439233de753414b4f41c5c174a409e85c1

SHA256
8aa0602f8a129d0913807c15d40891c8af16f186674dc5242e58b8c5e9fc89ca

SHA512
ba8e682f98a939d37a4510c5122a784faf8d57082602fdbe8754d5a2abdb87fd365b1c081b96e13467f2af5d993f252065be1fd1fe5f9e3e57936a9572b35b62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62b93b27c8b178f596b73a8f1089bc68

SHA1
1e9a269918c6a9e47ffe328c4aca6846f6dc47df

SHA256
6e812ae9e2069230bae8a709062b773930fde52b56cd6bed84cca0e8bc6f27b2

SHA512
d4b970955aa51515fb5f48b41159558e52819338f0637d2fbbee5ca9a75698fbc7e15cbb9ea5d35f16ed628d2882ac27cbccd19191dfcaa73f1edd2d3c17d0df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52c7fffe60b97a48a415170be278196c

SHA1
7d359472b83fcc0c5e60e2944bf86e8271cf1966

SHA256
a772331d5c4bc43f19514482a394fd140182380ee48fc68441d755b00b5de8da

SHA512
0699c38bd08dbf03bf07f1483ccc8484cea7db6d177328fde43aef7b3bba3a2c35b205c85c0e3acf2aebc530d1c2c6cd9774f48810aaf6ba83494cc9c65e0ae4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96a037c508e346f0ba429289c72dd661

SHA1
3d682fadb08c3b0e445af81c324488752712fc57

SHA256
0b56a12ca63aa0e26fb1b7831891b3ffa06b60d7a16d693efaadf9ddcc69c52d

SHA512
23e9dff95bbea51199212abb573167f499da5f0b09c8e52e4e5713013d51b971901a15df4f139f7410f5bdc4772b16205433890c55826242e2543545fd11b8b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3e2b6cf4558b0d5830c8942d18469ed

SHA1
658b708aba59db7056ca8fa70e0330a1ea504968

SHA256
f4b8fdd11b47ccadb57ff042deee16ad1bade56409bd0e6e4525d602cc5b470a

SHA512
43b95735faa81f926529c2fad28ec1fb673331a2868f4daa7684b18d6a87904a816d2c937c932442be7ad55b7e6d17a00e57dd3d8ff03f1c12ca18c091b2f61d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de7b748aa83719e2ea6ab959a756766e

SHA1
ab8dd922557b69a88969e152e82f96a1d93b3299

SHA256
e402137a81f4779654307906b3d0718ae7a642c1bd70a800485de825c3f82c35

SHA512
2beb85ea2b6302253be9217ab57f7e3f6509ef7ddfb790e2cef9e0a51b23c2ffc43c523ab329cd4dc496e9b8bd2bad874a41bb2fb3974c49ef846ff2fefd3f9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01ec0b2159ec05d214f6e20a7a89dfb9

SHA1
479fd72bda84328f298d2fc165b9a58ac2675b62

SHA256
92845f7f715ac92dcc4e58932d8d2cd9bee475df5f7baedc11d5c1d858bf7040

SHA512
79425262718a323998086477285b0de9ebd5d873b50cadb1e0f309482b48cb6dac75254940bd184f6e2a618992e5537e517de678d37fadc54d47078245e1f3fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c43f19b6410f8dad2744943f962cd1a

SHA1
cfec1a5c19a265000a627ad10f628d61d1c4ff35

SHA256
17a7eb04d2180fce63fcaca25b98052dbcdea8b18ba74d9e5b76292cce22a7b9

SHA512
40b2f3a30e9fee59ceba2e26ed9278d5b2bde0a7a588adac1ce5b9f27474b29749dc7aba20a42ae3f12cfeacb2237f54d91a38211b8f5ca297cbb07f1aee5696

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCD.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar16E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit