490acdcd68152091dc555f1087efc84c237027ef3e8297ff377946a4c44ee79e

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18-08-2024 16:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a7530877dfb60469057db0e697f642f1_JaffaCakes118.html
Size

53KB
MD5

a7530877dfb60469057db0e697f642f1
SHA1

e4a5db8499c7827cedcb495f6e1b90997530406e
SHA256

490acdcd68152091dc555f1087efc84c237027ef3e8297ff377946a4c44ee79e
SHA512

e9fce5d7e0c3c4a90ad7119cbb4369e6a310b5dcb46800a458e778eb4e4de72507005e1a97b0b058bd46be266feca968da0eb309b326a2202d1fd4799ece75e7
SSDEEP

1536:CkgUiIakTqGivi+PyUarunlY763Nj+q5Vy0R0w2AzTICbbeow/t9M/dNwIUTDmDv:CkgUiIakTqGivi+PyUarunlY763Nj+qb

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c040326b89f1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7E95FF31-5D7C-11EF-B8BF-428107983482} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000048ab94568626b3b9326a20232b48c50930a5c5746020005c66219bf7f4a21eaa000000000e8000000002000020000000b06573a9cd203cfb21c175e8bc141d435357f2e6b0ee08b0ed1a22815d648ef4900000002395984a22e036a86d8d8f197ac4243fda4bf48010e2671ea83a0545f7cc8dd80f3939d0c4baaeabd08c2d82ad8d14a30b50cfb1f226de6daf259250b918fc07f3acb9d40fadc9e17fe60eace33249d3348f5dbd535c3a71781dbd52ddf752d1243acfbd3fb1ab142c7b55f3e765bd573b0087ab717d835d1cee86896617f02522cc6d7c0a264a2c3ea6fbef62a8685d40000000caee9f090befdddd399dcace96bf140270034a61944de36394803da74b5976e0df0297ff1bcd2b0064a05cc9424ef512bc9c25232dc798abd88944dbce41b924	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430159344"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000bc225e637bfa7ab6518329b83c45ceaa22adebbd3bdbaa9a931fdc91c170c392000000000e800000000200002000000056fcd5f134c22d71b8ba40e2271d8e7c856a3714286365f0e2782209571138a920000000c7c2586b23c019370e22c0018f355045b3648cc930447e6a3bf72c317825274e40000000ac5199bcfe6c65fc18102cceba4d07f5482a4567a816d7f0880694dfca4f98947598fdbb3ceb3b66a6d1401545512fa38f2349948f45087a0795cd8b059a16df	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2968	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2968	iexplore.exe
2968	iexplore.exe
1452	IEXPLORE.EXE
1452	IEXPLORE.EXE
1452	IEXPLORE.EXE
1452	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 1452	2968	iexplore.exe	30
PID 2968 wrote to memory of 1452	2968	iexplore.exe	30
PID 2968 wrote to memory of 1452	2968	iexplore.exe	30
PID 2968 wrote to memory of 1452	2968	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a7530877dfb60469057db0e697f642f1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2968 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8461f2dbbf73ca53af143bf9cecbcc7

SHA1
ac41da77754fc4e2672f6d56dd59c0da69dab79b

SHA256
40e16b56925187f65ea3967e7839bde5b241259005e5966b56d800dd652e958d

SHA512
0b1677e7c0ed12e47c42f16c673346d14ebb340c966e66dfcf106af5749ccf5c733d16986e06e36b243f290fcffce813d8f7b11b564569bc3bb80afbd6f25593

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d56009e012a61f2fcd7ac45a35bbb94b

SHA1
a38901335c21742b39dce9962977bfaa13f86e84

SHA256
26ef1e8e4be5c192d2fe61eea33b57d9a00ad9406615de679531ab018e47220b

SHA512
316bb3af40fc60206f496284a97a201d020172b556d3d8661c413a17c9729728a56e3a58c8be63c6b5e1e5eb7199fcce4ab1a6a85cd3c2aac53bc3db6f17c8a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68075c1e49944d7323c42db368b61070

SHA1
95418c5414a5bddf954e0db812f870d76e463533

SHA256
cb74f93c52b4c229423c4f44ae0a155befee378ba513b28714cf3dbb0b4b1c59

SHA512
917efc68e6c47034b41ae62e98186c3f94503d5f453dd73bce019be68019fc650e74ba178e0ff944ba802897e6b1da6c81f4599d4a65683bde743e3c08bd682e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7284f13d666b2ff75d40bba8237b04db

SHA1
50fa29e36fec96ffe388a1a1e3d9c25e61424483

SHA256
8a97e7f5fed7042327bf071b11fe4e01e0ee16f9ba9c96ff6c976e64fdbe5fea

SHA512
2b638c097ef224ea25b4eb94b041e26265cf815f0030b7e581f4c353cb5d1305d8058e0cef13bbae2257e76233b3b3a15eca8b43a7b89c5a48e0c59a196d3bdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a1d29143a21c4f8fa9f5cc71fc2da2c

SHA1
2c36d8f66985179cb9da671be6876f4001c13422

SHA256
a04453fcaaf7d57f7e25ebd7dec771e9fe4e923020cccafff0e247f644c180e3

SHA512
e87f34f94cafc1915d818dd3aef7db8bbb37f4299011b186cb3630833c24427674038eb004b40fcca4516a7523e0c699f898701e0905fffa33980e143ccf411a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68390d4404aad97847e4201c23375b6d

SHA1
548438a7d188f7927b79f316abe370556d4ab4ef

SHA256
3ad5ac2ec8c275d08a4b310fe5ace5ef05637491aa10b30c495025342bca9e19

SHA512
3e3f6515972b854683c598da345a92c5f2402798199cc8ce6f02d9685d1491859b56be836dd700ba68d61aa61e7a6e9f513ac5a0ce1b2663bf179d14e7364d87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
efc52327f6976017944c01f354cf4d16

SHA1
dc1879d6e829246813bc96dca0988b33f93743b0

SHA256
1618561970abda1c3ad14b420ea415546fcc3351a5f047827fd2bd413c316862

SHA512
90196c14f8d9f90bb469ce0a4742be37be1e0888f2d1d6ae798f572ba233e493df1b90008d18d91bc808ea82f5624dfe988aacac2b45f0881e84e858ef317f46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69eaedaf619e3c1ddf638f118201efda

SHA1
97b642161073f0991d935493af9097f506357a90

SHA256
fe0b8c379c059ab3945d1ffbc583e1cefeb16a6dfb488d8f93e54d305b2fdb7b

SHA512
f808dabbe7e4e3c09dea572b7cf073e79b3f1f5419cb2a37bec78e441649fe5cdf379ff4cd908b83f5b84a78f15ef1b435ae1397306029d07db45e36a49772bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d963d90f5741171c06516f0eb8da7dfe

SHA1
d66824c3be7f2daa31ac1f586fe55aa5bd060e0d

SHA256
2e0495e2eb542ad97f5834d586a66e4f15ceb317695dfd807a47c9a0c0439ac2

SHA512
e3709f69563f2a54ce4fe9069c4148b07891ba5c557cc0a5dc2a945ee41efedc44385ff94597e0098723b71a629f076786b404c66616ea147a429a875a829512

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8fc88bd172c15cb046a7e572a418439a

SHA1
004fa9136257df8c4f5838851a44d4d64045115c

SHA256
26489b876dadf5d8b2477eb33dd2d0102e07b87c3baa2fedd651ba8eed98d54c

SHA512
6b3e1c6ad3b6c048300fd9e88078b54b47397b764aec80105374ce030b5c0bbc999d86eb4325818e71ef0f2e3cedfec8216a4c7f9d75c88b537cd84dd8f04e55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a17d2efb4822ceb00e86d3b01d7c5689

SHA1
f26bf78f91827de161c5698262d2f95af00b5359

SHA256
5e1d2b1d100d4530270a9215b41cc294d09ba9331feece9234c0ac0abaf5bab8

SHA512
6b2305387d6ca19f569e8cf8b231067ef271e31464de25ef127d82cbcd1d86f59a6d6b8b3177f540a4af8b7d2676bf486240b58485941f11d348d95baca5ecb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97d7fec20a98e030605c49e5f3f79fa7

SHA1
8892d977196c2b27188fc45999be2bfb371d22f3

SHA256
6df7b3da3527981cc917444e9ab3b91d0af102ba22d3e0b043ef865296faf689

SHA512
b5aed464f57d115850e9d8493a47466a5db444a1118fe30669ce264e91e60d46daa9fc5f8eebfd4bfc282cb442e123e2b7720c56a1585afcee07fed2743347bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e2edb0ba5ead0af7e4fe25d620b0d33

SHA1
49290accd973e8ba12f9e55b625a75e3f649c137

SHA256
2c7b80467d4a5422e6ee91a37b002f6444f7a2ed61d669edccfdc48361256b2f

SHA512
82acac6d5783a42b80558af9e8c7ba95bc9769304223b64d52ee566b04fc27e725621f5596b622f804da3451271ccf02b8e4cd09857e94d0a31fc7f1904eba05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
722d696ccde40fe0c418451cb8097483

SHA1
d3ba3d31cc5953fdc44c0a6e5bda2d50051b4f98

SHA256
df5f124a80a4224dab4d27e2108b6288ef271df18ca3c649c99a389d8a37b966

SHA512
f8e538c56ad25888eba4c570ae86c6ea37f66dd286530a0d4836bc7c473dbfe22d227f4b1e0997a621720dc8e54ec059300cb8ff7b2455574a9aaf0c3279afb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6XUZ2JLF\normal_post[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab59B7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5A86.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit