739d0935bdec22762fe77234ec5c21beb33259f901a4fb1afb90b38326f1a0c5

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 00:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4a7dfcac4f40c5acacea1d352fb61c3_JaffaCakes118.html
Size

3KB
MD5

a4a7dfcac4f40c5acacea1d352fb61c3
SHA1

3f2ee43833ed488ab90948d0cf2aab06836d0b73
SHA256

739d0935bdec22762fe77234ec5c21beb33259f901a4fb1afb90b38326f1a0c5
SHA512

5bd93ccbe8b34d4872612f08993a8fe16929d83076e21b50d923349cb9e540520c01292221d9ca34b4eaaebf2bb865e9af6e93d218c8bd66564911e6f7d10606

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{19521531-5CF7-11EF-9F09-428107983482} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e017daed03f1da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430102049"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000002ffb56d13baa887929d23016a6750d1916de479c62361a161ba63dd4245385e6000000000e80000000020000200000008d5fd0eae5c9cd9ac8e8027407f913947ecdaa040af872071eb90a7300d469142000000065a2dae5cc4efc6f5659681aee875995f6d6b6d6571f8ab94b700bb562eaa34240000000ca000f6646fea890b43975915f5adfaaa73067846d94c9510207e5cf4c5e37971713a88b73bed279278eae70bd6de5aa06e27a698ce641a14a110451495430c2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000003ba1613db34554d698f0b7f6343a51c98c4412cf5853175d784e084011971f3f000000000e8000000002000020000000f9bd291e11b78157f515c675d6e50a780366f4af0f04e47a28402d91a3b0d5e890000000a449ee2d9f583f4e91ccb358fa8b984add4ae4f1a3d7cdfea5d6d5408fa05e9c7cc3b51b1ae834c53f4d742f9abdef596478816410d400e0b5a126f470906392a923172643945dd01a858f47d4e942942d3bcabd22dc8377e2622f770157f597fcea2c0c8791773234f77e0e7877fff8e928f664a7ae718bc750ce84c22cbc5277b3f7bb924d23b70b8ba47f0b9c53ac40000000bf2ca1fd2801e0ae1c224def35a57e0cd61eef2d70e639e43f531f448517bc8f5828e8c9009724a48bc3b6ab6cd76993a8ccd25bf305027b9db2c689a1007f0f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
824	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
824	iexplore.exe
824	iexplore.exe
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE
2964	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 2964	824	iexplore.exe	30
PID 824 wrote to memory of 2964	824	iexplore.exe	30
PID 824 wrote to memory of 2964	824	iexplore.exe	30
PID 824 wrote to memory of 2964	824	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a4a7dfcac4f40c5acacea1d352fb61c3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:824
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:824 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4115c83c52998c9537ba3b3f43aa01d2

SHA1
89a311289ce13071b5fb5287e1de64ad8496d89b

SHA256
40482f73c769dfcb76aee8da64bb911dbbd450406dba2cc949ca517d50e2bbda

SHA512
c2dd6c4fa7694928bdb09efb861e7e9960e1dc2179d3fb5b0e28eb5b808be19a26b827092172ed542abec69c59093ad76ccd598c47ff653af3cb0ffe2708e3a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a652061ea3757083869c03e33b3f5768

SHA1
0f0dd83ce325b2f606e59b1dd3f668afcc0110dc

SHA256
f027270cf98e2d0cbe9091610497e67b3c527d3ae189e34fecade09a4f8aaa7b

SHA512
90e5446e2d6962bcfd6f28a43948b114d92ced152db6205fe0898e36291b81d423adadc79790396bb8b53dae8b07ad7a495db0e3d82838ef0e43a48d962bdd3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b1825652c198d7c134027730d004d75

SHA1
ac8f90e6839eda556917bfd2ea6d9ce5568eff91

SHA256
1b03c4419586fa866c6dd58217939116389ce8498696db57fceb36d5a305dcaa

SHA512
159b37c9459a70812f97a02cdd179625114b68ee6f9e4ebadbd48bd64874b81fef625167c9969473a2f68639c3bc0ab8690bb3f976bb0392dffdf018e03f27a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b1b3ae6420f5625d8d01b49b3dde0c0

SHA1
0f90ec8f53e36b4e1b577ac46d41349289710721

SHA256
beddfd216982195a0f55b6bd3788aa761bdfd0ed963979937814e43e59c3f97f

SHA512
4650d9ec3aaf39750b3cf688614bb76f78db36ed715d98448b503466190aba7b442b2df55d79b923d4edb9346b91ee93c936b4419fc5bbf332932ae8cbab3d34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ded395bcd0d11ba1fe71da2c1e5de4e1

SHA1
78819b5d0e467605ed7334471daeee884b119197

SHA256
1c589b2aae203ab6b4c3559bef1ef33c18b733484f65c2fae999085bb9d2fd6e

SHA512
32282e1734383edd7df53609f2fbb7d27e7d62617648d7aacca858a6aa793d27faf7dbeda8f524b76d7881577a6983b6e996935d34f0213d1e41364f11494648

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8734be10a191844e43b3f326a9953b9d

SHA1
19fb6a6b3b1c03dd7bd9dfd83fe60b6ee8c6ec88

SHA256
816704bc9559d574144e0b7c063b16a031a198248cde36ace15e777bb1fa45f2

SHA512
4c7191939e556f118002cbd898b6c6a92bc106a8036949117c4a58999ec258dca8c460f1aea2c99abe7b168128e84d263e6b170a352140b589f90a9ce7d0f069

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc11054a4aa0047d715a7f7219b5c9cd

SHA1
7bb6728ea62ecc95da8c3c3f99d12ed43542c202

SHA256
acca7e620d17689fae71151aff08fdeb98e88db445b162583a72379b7c7785d8

SHA512
bf0b7e8e127914fa30ae83a0a5815e8d69b2de259860eb4b36a3e14a78c0bf4a5f534bdcb5a163e2acc194eb68867f839018ff27afc1cd51b7ba5949b64eca84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f7d29e1792199d3e7f7b41e22d11ffa

SHA1
1dcf0754e7514de0fd0debbda0503650655181be

SHA256
062a45bfa0f2990943539b307a58b797564fbc758381fa3ff7cebeb621dea878

SHA512
31f95a4982bbe7cd089a66fd415dfbe9d17cf7bf478e9669304bb624ad27842eff44805902c9cf4f1529b9c8c91d59a8e2e8f949072dfe7aed704ac101eb8c1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e1f38db3a8abb364be7f043299728ab5

SHA1
8cb079daa0166bf1389bbd33778357a3fb284091

SHA256
4939c8c000e3e24217cda8ad2bda0c00892414185ee5761559bee57a5e749cf0

SHA512
3bf6fcdd3cee508a709ddf1c639ba5e9966b45250467666d6400ca1ff977d454c4717902f93fafcc4978a5a249e625e1fbc5654e3d2ceeb13e396f1e373521a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
edb4bea1f820fa58e9d5eca4b1b9ae10

SHA1
8c596b2aa52dfef923243e3c241003253988bd38

SHA256
aaa691462a198742449ca45a7e1bf0b00a816d89b61ff1377df39688ad6cd7f3

SHA512
c005a464991313164b4188a1f5d5402ddc6976f2e570510be8e1e51a4fe1bb4d9031725417850f8821410b9e571b3fa712b6775f3e92ee05718929616454c285

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d1be851e13d93983808d34307f50aa9

SHA1
1ee5981656b07edf2851e16bc0a0a967ff389566

SHA256
2f0b1fc09ffea66885d02701cd2d79dc5f79ddc634800a61efc0b434bcd6274e

SHA512
a724a48701091b1eaea125d095e3d93d2395e82514cd839475ef1efaaa4621ef90c55656dce2dce2a886ec228d548ae5ffe48e7ffc6b792bd15b507448d4a825

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c33485cd9c5f849b50cc6b747a58e278

SHA1
5ca2c1c966d7ad0de69c2ae0228d90ca527395d7

SHA256
4d899229b10b409a1e1664c7117cd1579a47f256a60221baeb04c1808c20d303

SHA512
6e255f0c8476d0b2c9e45e7764fac5a06977354be9395d4e6d19ec4badfd695bfeef00426d93d1259808b8c2d7a87f7a30c568a72e3443c62f270549d95f49c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8fd29c3b7deb70b7db3eeaa6cffa803f

SHA1
13f40eb1400391b33bb7544f56495258ee858c0d

SHA256
0a242892aa9e180c7eb7a92000a1e8e069eb0e57b7a797454340ff66561fde2e

SHA512
4a30716ae96be2bf626f52eaeb622ea118c8b4e40ecfb0b78ac8882d17d14e00d36d6d1246007b91a53d9a58f802f59315b36b3851d14264770adc1f8c23d5f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
398443a8875e11704337041321121b86

SHA1
f24391fc90ac6302162c691c82e0e22bf0582aad

SHA256
a0f9f5965141beccd86e3261fa592c04dc9fcae5e1458f20154a703175b505fe

SHA512
dadd287cd4ff291726c1b77aa966eba3d4dc22efccb117d05c786a8c38b10415a3e0a7a58285bd0886a62c680c4efa21bce5c129c2a69610cf6bb5eb3219fb35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
323f170b844c59f37fc5d70face49aeb

SHA1
02e11454c3d9bd126edb4fbb0124ae630143baf8

SHA256
c4d4aee372bb0c6590893b027ac15e08c4e311b6f1afc8c8f3b659120fadb60c

SHA512
438e5dd20283e7c0eb7569616ea9c34e4c2b03509bfbd3935dd68d2f5be3573ee10bf97ceef917537a54f93c755a6c5f965d4799fe082f11b3d19836cfbaec3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2b2ea6b045bbe882f70b898690af370

SHA1
474f581d53ede932cf582e4c0df90c89d3282e28

SHA256
b09f972d4484d28bc38c7232543e506d21ada0453be146451f17624dd3eae5e4

SHA512
41d89ef8733572295f437e01a57f8ec4d52db817ef7952d9cd180eb91cd50a32658e1af840dd79c687efd7d8cc8bbe9b6f2bf06c34fa724065fff522ed7569f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
608178fc71e4cb5e672a714ea5e53d04

SHA1
d47a8ff7f9d28258235eab6ba3fb9cbb076c572c

SHA256
e6cf78b615e74142d6b7eaa88eebb669c54063aa293cabdba67204bfe3be70e2

SHA512
4ea8f0fc82fd80783a0ce336c0181c0b5cdbb146410d79372820db1450914e7b687ad9f99b630a5ecce9e262ea16279ec11c58fe987ee1c7bd0460b0362ca474

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2D89.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2E09.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit