48bc0b3599380ff489f243ed3f8cd10d127115bdf4dbbeaab454180ca800ac4f

Analysis

max time kernel
139s
max time network
147s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 18:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a7a63c15a96d36297e79081d2a59fd93_JaffaCakes118.html
Size

26KB
MD5

a7a63c15a96d36297e79081d2a59fd93
SHA1

dc9dbc04234946f984f662269db33e7092f757d6
SHA256

48bc0b3599380ff489f243ed3f8cd10d127115bdf4dbbeaab454180ca800ac4f
SHA512

24397294071f7eccf872ebadde9541ee27f9f46cf9f27a24070be7532da3aeb78ee6970b7b476abc574d6beb152b9260b5bbad42cba65ca8126a2316b6444d41
SSDEEP

384:4+QfPFd9QZBC7mOdMgcBKfpC5IgSnbmFe7AcZY644kJvAgo0iqApPd:Zcd9QZBC7mOdMghpC5I9nC4aIP0iqGPd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000f8a842b25a8943454772da643ff154c629754c89af86d4065f08dda6f1810af7000000000e8000000002000020000000af27d6b8079d9a9dab7bd029a33f94436198f5e36fba51e8da7378d0ef463c8d900000002a19e4dc295e0c54f2e640c22f8be0e7051ba3ade6dd9e64d394b6805de7c4e6bfa2e4d863852db034ef69b312b8c6961271dabe7e16a13089a7d041112a495d24fac1851a539f34bf572d0ae89f287157fa37dab12580c1023dbdb23b12efe3d91ec45e8d64bd3400b4fa8babbbbc3d9a8c665e6ce78acd3f13ee537f0d85a33d9c9f1fc48de5bdd9fee5a4b43b5fd240000000b2d09f958cec0f58ab5bbf4021a9a58a0f8506176bc380936148498091111a0b471e4a0a4ab97fedbca7557199ea43e45c39ae0cb1996a90f1f51387d8ceadb7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c7000000000200000000001066000000010000200000009aa47e29bc02df69f065cda0038f63fdc7cd28a7467d9f1390e18da2de729c1c000000000e800000000200002000000092f090ca8463a00c56e66ca5935559d253914dac10f35ab4ec6e2ecfe25401ed2000000052730b2b7e89058d838518cf06d58bd3784737cba0a520e7e04962fcab95c0cf40000000fa7b15c7b3e85c9a56d00c11a135b1e02fbc439f722a49dbff3c5919a9f848b7977f2efe199c6dd11a4cc7a807b525d68ddae48c11238c934ce1daae013a029f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0c4ad9498f1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430165909"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BCE44AD1-5D8B-11EF-8340-72D30ED4C808} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2488	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2488	iexplore.exe
2488	iexplore.exe
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE
2380	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2380	2488	iexplore.exe	31
PID 2488 wrote to memory of 2380	2488	iexplore.exe	31
PID 2488 wrote to memory of 2380	2488	iexplore.exe	31
PID 2488 wrote to memory of 2380	2488	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a7a63c15a96d36297e79081d2a59fd93_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dba5cffd7033db9c227a6f46635545e2

SHA1
c46e83ba8a5fd76c0e998505001f083e65f3ba96

SHA256
61703dff7d0558fd9947b7ee9de468451103c40531112c0d561687345b2b6c6c

SHA512
a917171cfde5674443469ef7f850bdd5fa1b60951bef0d2e262e758c63a704bd104ac0f7fceb893336e587d531756b8a02f8e6791c2acf8ed00b5a1043a54d64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cbc43087a68386de3e898a2d42c67cf7

SHA1
a89ec17ecef029579868e993780ad34627fe0f95

SHA256
4f82d5a5cb92009bff1ba5ba92e10f2895d4cccdb1e614fa69638b62bdbcc172

SHA512
38dc12ca75b4fb79bd1cc23d7ae239856a72267bed9a54960f9145d8bd054c8a3e4e41d3f6c60e58f0af1f3444991b43742bfb24a5ee20f294a6ccac4f2f8b8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d5641adb0cd88ecafa082fd8b2357ef

SHA1
eec9609ad6fd30bcc6a83ffe8e5ae278e9a65ff7

SHA256
edd939d7dde97f1aeba74ebc584e0a95df08f339cb252b411a901cabadbf1f25

SHA512
9883953f897c2301aadfbdce9e327aad8c8063572517e3ee3d78d8f3d3911c744a633970d25dc4ceab2a8652394d8b6006a61776d7f51196b74ce04fc3025f46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e21b9ae2add9fd3ec5a743dbbc78ac6

SHA1
a662814f60e28b37e0b4210a2b634befd32dc95b

SHA256
99de71fe4e30d55c8e7a1a4e8f963ef8c9d0f33ea5fe8df3de6bc0374a6074f8

SHA512
c7bcaa5a75eba8c179bd46f0af9ce63aec77c12b717c64c8689855bf625a66740694d956a1a7ea1ae6d6cdb18c5fbcd45f8762a69cdc0562b93395266b6aa8a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fae8b4046a57e9dc743b5bcc3feb01e4

SHA1
a3753eff9cd609a56f5182df8d8458f46c43eb52

SHA256
7426b5d04b5c06c7a645b63f9e3c5785925ec38cac7b838847e2ff21c5d94ba2

SHA512
cfda5da02180ceb6d8e14239430eaecd3762c19d6b71fcbc10df1352dc9b194d1640507ab5ce3e21d4754d6d8b865a2cf7941413fed0c88832fa0413e0faa725

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
477afe7623e51c35b0ce98c5be818665

SHA1
9ae1003e2740e20c9ca41fc7e60aea92f4d9d806

SHA256
a1306699af2b98fe4cc25e3ebd0ea71e15c4b527f703739c4ba0e68b8a344131

SHA512
3ec376ebfb2000ab95beae23fdfd24b49a4bda0fa57b21d683cd75cb7308f3fde87673c8e84e78359be1fa0f4f1a0574c48f3f0bfe29ba20451dc892e89ad643

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a635acf39df05cd89d8642728515248

SHA1
9e7f6d97c3e35fe1987974679bb20abd539a2596

SHA256
3e0ba20df528c7095582e66aebcdbb450fa5b2730ce04b1ba4a68f3e2233e0b6

SHA512
e484ae4f37fe7b4067702fc58e3bed43aed97c8f34ec4bb708526c01c4422a7bf404745469721281f763d6b71df859e3a650a5565a20798a85b5945f2f66b41b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53db76e7372e26f4e57e1b726a2d5213

SHA1
76dd5104dbaeb8a5a7765deaa09e0c036ee72713

SHA256
37e56014b45ea5da561ca08553915008e2edeb47ff2fd0a98f03dc05efa914fc

SHA512
92217674d8e4b4e41903470f05ed9699a9210ac9db4f6a5a6eb79f53929714e1875097535414930cb1bee57a463700eee4de98d905e35aece8866c7bb47b8810

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b240a3722c375f1749614a788608555

SHA1
d440fd10f3358f84c2da3dcf78fb1629e3651c0b

SHA256
831bbf73132c82e0737cdbd841d205ce59f5cc43c71ed5f58c723e504dda37f8

SHA512
d98a4f54907cce8358a9424eb7983a7d02e6d72707926bde73410a03318f19fe0ab786d47dc5fcd531440aa1e5bf8d097fa164d9b686cb318a282f138e41f3d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
746c38072646e75c64bf631b138bf78d

SHA1
43a49c7f7aa49061f8398b201992eafb621c210e

SHA256
3e4c154f1d7ce66ad95d9b3209a2b2020c45cebe57937550ca3b9b06ea507bbb

SHA512
cac63702cbfc0acba7165b317344048c071e6942cc16704284bb5b007a3eb7677477b04fce549534ec985146714d0968eb9104b35c76ed398798a0950c182cfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d722e5c85f5346ef4f771b779d90bae6

SHA1
5279ad82798e958629866c18131430b9cb8a9c16

SHA256
c50209d32b1a58a32b44dfc7fcb298d871e970f5e938e1def26a15bc44db2e78

SHA512
902d0f5161a617ed851e10ada1560d7edc9cb62bfc4a198a467891e6e634206e6fa5321324d10dc693ad5ee76b159a5120a49dea4fbd4f833bb723c891c6afe7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18bf9559a35b711900007821a17181a5

SHA1
183cb1c27ac67d73c894598a6c1f1796aa2ffd79

SHA256
826d0a0c657e5e5045fb4ee6c384252cd6f653f21c75fb83cced39179715e467

SHA512
d821a13b2c4ae8ab88216d4bc7d6f1dbf7a8e4810cebb8c00e766cdd1fc6c6909b64275a30bfda4b27a2974e643540a38b31bba1521edc98808dc2914f434d91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b019c1699928b451cf279d7975af319a

SHA1
bbc3ca4d173eb0f356bffe9cf423bc9dbe6b3e13

SHA256
d657f851a8e72bcfffe6b8834dea1e50f8a76419071998a61af7c52beecd3be2

SHA512
f3a785005dedba145e88af9c1aed60072607f32414e11be4537d65af428fea617a5dce362db97dcf2d94875d810dd7d9ebcaa28b31f4b0ad4300de352c88f35a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5eabcc94d4a8d7f13e0075055c56ad63

SHA1
274ae191ac1d4e78fd297a90a778e2848a2df9a2

SHA256
8dae4c65708ab57fd09d9728881bac58637e5d15d124edd66a5baf8413580a55

SHA512
75fb0b71b3d5cacfa915674d9a82f0954d87bf2d0988485af9cd9666d82543d510a987ce1b615fe3c3198b3d3313ee278931018951b151b4329d1173da09ea5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD6C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDFB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit