a3595c5541dc7cf9f2cd98e6b53495a58423c93c737327d3d78458c4c9b2f45a

Analysis

max time kernel
133s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4cd474843df275178125c50e8622b25_JaffaCakes118.html
Size

3KB
MD5

a4cd474843df275178125c50e8622b25
SHA1

5477343da1493360ddfd79373ba1eeb23a8cf3a9
SHA256

a3595c5541dc7cf9f2cd98e6b53495a58423c93c737327d3d78458c4c9b2f45a
SHA512

e10744da185cd962d13729bc64640f95a878c73dbbbb2aef964d9d28663617adc85d2e3f1f71ce88c8e0971bf9cb6c7079a62253f1bc50c2e116fd5b6b7652f0

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c7000000000200000000001066000000010000200000009bf2c9e0921d601fcf4b5e33a831d21b75659398c3074abf6a36d9176f209b07000000000e8000000002000020000000bcd32ec532759794b95abcbd44e4e1055f0545c3380c151647e108959115d195200000009848929015dfdad940953331fd0fee9912a13e79d64e4f5ed1cfc78c07cdd72840000000402f40fc7c2f4eab1b83d9fe8c09ee6250023a62c16e66d23f6d0d676e7178e67a6409d2127b9e21e9b87fd1058910fe1c749bc848462590d8c0df1a7b03a8c0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430105067"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{20283041-5CFE-11EF-A1BB-725FF0DF1EEB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000f46b336c7fbbdb432be384a5c751c8112815cf4563869aea2caae5f22878a4a7000000000e8000000002000020000000b28d231ae1b43095dbe8342c137fb45622d9e2da41e32c333ffb415d683106fb90000000c375aa0fa75dc01684a6942f5a0383fd761a839f7d4a04580b8ab52b65eff9f6b3596e55653fd5a3d76ba617a39db101b7137ea3357fed1582cde99ef6f1dd29872790c38340a56dfd287ad401c2c96af1e2d1f1c99fb398903d9bf8349b8a6e24a20d7a3ab7e238f00368ec0244f627f9137300675b51152f2831d45fd90df6af76e861115d176b8ad3a5f9ce886cba40000000cfe437c86864c13f1c69d3ba31f432a76e4b1b8825cdd23e70de0916426be228c13e75093ad062b5254bb5b5db8c083591c8fbd3ecb5cd37c25de074359345ae	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d01672f60af1da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2112	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2112	iexplore.exe
2112	iexplore.exe
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2360	2112	iexplore.exe	30
PID 2112 wrote to memory of 2360	2112	iexplore.exe	30
PID 2112 wrote to memory of 2360	2112	iexplore.exe	30
PID 2112 wrote to memory of 2360	2112	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a4cd474843df275178125c50e8622b25_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c00f035b0e68f2fecc0530a3e0c99398

SHA1
0d9c2ce4506882865e17ef3a7eb16237ca8e341e

SHA256
6c6bc7dde127123d338338c19c320246c7f46b9bcf00e7ba86748c90ab36321c

SHA512
02d99303c2cadec9ae16d6aa050780a5c1c8c72a1fc43f739f98ce5f9b9dfadd4c75c5b9babe1ae74911a5976d3b478b772075e726c418f1e9320f7fdf8add8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e13b1f47aefac8bd700c3dd257d976e6

SHA1
e0f6005d9aabddf453c1d4302bb95f085b0cb73c

SHA256
f85845b83181e42e362429d9bca7b205c65797a4b29a5a4aa14b5f4cb57bbe60

SHA512
7594492f32b07faa0317ac66a362746595dee222c67eaa79fb089c1839aa4be3d32721bfd02e6d753793f8c7900a385654a14d74bfaab59229e7dcabfbb191ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0875de736c976aaf88d9afcf2e932de3

SHA1
d4a73d22f80332b959bef09b0eaba8d077f505c9

SHA256
75591fc29cf5e19f26af0ba7b5cfc2d6ce287ccedd9162b14cfa4e1701d42b9d

SHA512
e97def760539075d0a8b17ee27f066a12d5a09ab36461b01013321d945876c8557c1c1a93a6f0703d07650966b931702dff31964c41131a5c92d91a50caa5f73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0fdff9a30c7a69ae5da4336c78cd915e

SHA1
fd4a2016519bb548ae1cc7e08001c6102d020fa8

SHA256
a19fb15a8d01c9a8cb8e9cf775d0ba002e9901f896919cf91ecfb2332b374207

SHA512
412212f9b14fd62a9e0a8868d4f31751d637340b05cb5399dce60ba0e12eaf13a800e7b31feef0a35ce6421d7c1152ab53020e3d2aae4e884732b919a58e3d39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4bc932c95321bc1dd2fe55dcc5bfb2aa

SHA1
2354b51581bb2b68b52573bd03a3857922392296

SHA256
38182895d48cc2191925ce372bb3ed475a984829ce3caea1a68f39efd3dbc5a3

SHA512
e824e725f962d0044e66e783a9ab139b85bd972ed764a29767472443893aeab5429f4da328065d2569387623c38d1033ce59221fd591039e348bc35532420c56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea9ac4682da475919843ad5e5c64074f

SHA1
de32203738718b94fd79140df52af905e1571c0d

SHA256
cda9a254505e4fcd7f09b9b19063e52b7d72b1813b91f3f46083f3b72210d2e3

SHA512
5a1329de8fabbb2695858a150fc0cf90d233719d80d51931bca15a8dca00ded3ef4f3f91f10a5a6f34cbae79a38be8c495de742d960aa500abc60c0eabce5eae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
323d90fbfa0f2628e74fe0de10aa7e21

SHA1
5663b6510ff067970b15c337e80f1de290f1fcf7

SHA256
66eaf7f5b59260f6d53e0c31a986e75e0676978df5f24ce659228478f5172eda

SHA512
3f64cd1a12a952086f1fdde9f13d06f0ca7c38d752fa2ccf53499ebb718b18b48b25552945cf6451c3c5206298addfd88e580e675a0ca58c66636467460a0b83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc14947d32de96a013c904a99b2c4ee1

SHA1
6d1cf2ad1910653e02e145a70e32a4e27761aa72

SHA256
27044a2d2975540bd96aeab8de6203d29f29d900da5b7ea8c578178a4e70e73f

SHA512
86e3571a18472aaa7b0484bea5ac9759568a0164f0aa89fd1733704c2e496da1f39744a30afe6fa5501bc2b99e4d645a30f7126eb2c522d77492fb7b8a20d5a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e55f6902c5bcfd8f561a41e32e683216

SHA1
4fa371b1b31f7944f54ace6cfe54df82e32ba3a2

SHA256
6a3c98f7fccc0aadd7483e589818d261cf84f06e2bbae3d50bd0c351d3641927

SHA512
1312ca4df886c3e7fb2045adbe40a8e5584d2e284ab7425347e62ccc3d5847ef775f7d40b9ba0161019d520871d59d9b98232ebb4a0f43aa1f8048161c439362

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5d37b7e11db0a976def36982903a69c

SHA1
1a5413848d80a39115c9eb42683c938acc31cbf9

SHA256
893f2c5e28380ef6419bdc263d2361d3d241da07d300393dcb704543d18f1d29

SHA512
79ad4449e4103df2ed60302ce0c4852a73c465936c653a4a616b62d16e97805950216a8bf9c7d35c6aab8d4b9b3b93689084d3c9577c7931f09064271653db78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94b2744b06a675e15accf06a9b7a19a7

SHA1
e7b5398960a70e6dd3dcdccd3d99439e7e0c6cc0

SHA256
d0cb1cf409d2a94190ec1de66b5b3f287073c92d3d64d21da0d7ff454b485935

SHA512
ee1297124f64dc2a486ac17ee54bac09279d0e0cee881460b7d7f1df861f0edfabbf6d416723a35a2d930adcda79200825fe6b625c3bb282fb3eaaf3861ac8f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3A24.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3A96.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit