44400515f6eba85d99be4bc51e40f0af23826e0c1292755261ad45285ad70636

Analysis

max time kernel
137s
max time network
140s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 20:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a815b35cdec175e5297decaa97c8ab72_JaffaCakes118.html
Size

5KB
MD5

a815b35cdec175e5297decaa97c8ab72
SHA1

1033270735d7b915cd15ffe257f2df88e7de92c0
SHA256

44400515f6eba85d99be4bc51e40f0af23826e0c1292755261ad45285ad70636
SHA512

dbb3144df3db121b46ee890994e77361a59933c3d8ec383731282c1f62420222b40c9a678d659497a1e43e27839579a24979fd75468367e15ff65700d32d707e
SSDEEP

96:SuLHkR0cDJo258Q5871nY2MSTA8KhBODBXyj0/chxdAMlWu5aTjSThDvx:SoHkRvDJoy86871nY2Fsx3Qij0/c9wun

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B7968931-5D9F-11EF-B5B5-D238DC34531D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb780000000002000000000010660000000100002000000034f39bb34804e93e03eb06d4592baa2e204d150e9ce495a5fb24668cff74de9c000000000e80000000020000200000001dcc5ff11d1f6c5ff95d82aab47aa4d4d0139ec078beeff40172fd91675f8614200000007df531f7afba6a5e201c7dce3f28a2b2b0e20af87d90ecaad07331e25f44784940000000290c9c37a56fc109bbe2b56bda721153e97a7da3598055de91556ffb8a4ff9db6f9a62038ceeff2977574a88c1d45698152d730e6236e3d0390a9941bcca8382	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f08b4b90acf1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000008a45e1cfc596e137303a04c83c1994c3b729062851b01f50633303115a45f011000000000e8000000002000020000000d8e8b3d6f05fb9b1b28e7a809dd1064c63571060c9bfd86ea7a7fbe7ba4ee29290000000ac83bc70d0f45c92d142c0ada6b01d56bc4f401a5715a85818e5d11c31e29895205ade5368813c92aee50a251b46682ebf0e7a37117e98ac3956535166710a1da1965e19246d270347f4877a460a4ce9d02f7f2e3326b46fa9b14532f234fc2965daab9c26ad1f50de4c0f669b89d638fe7a531249b6a6fa83399077cf5cba848ccb2fde838340426d790c7dfe9c19ea400000002e2026c28b359fc94fa77aa75bf35c2d1ac64f75790b94d4be82f64e171d9173ab01413c641897118003916e0040af367ca80745dc4e4217abc6675bd9516ab1	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430174471"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2504	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2504	iexplore.exe
2504	iexplore.exe
2296	IEXPLORE.EXE
2296	IEXPLORE.EXE
2296	IEXPLORE.EXE
2296	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2296	2504	iexplore.exe	30
PID 2504 wrote to memory of 2296	2504	iexplore.exe	30
PID 2504 wrote to memory of 2296	2504	iexplore.exe	30
PID 2504 wrote to memory of 2296	2504	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a815b35cdec175e5297decaa97c8ab72_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2504 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbf032e64bf651ce9e1d5fe25655d51a

SHA1
25aaa6b1011415b1f1e3d232b939a592b04bd482

SHA256
805fe1c0542acb8d6737bc2b259cbdc8aa635dd2752b06582c1fb9fd345bf219

SHA512
b710ccb972f9958869c48aa58bdd6c3a37f9e60b350b423c5f730d71c6cf5169326aaf8e957e081fbe395a71829dba3994efceff44ace0973dfb83ea0cc4af15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60dbe668aeaf6cc2d89a97e156b801fc

SHA1
637c93a4bb2fa252e49e8301c5fee3dc4e8e3ba2

SHA256
265e09201cba56eafb48c64f7207aab872d6bf9471cb59dd87f42fa8296091ec

SHA512
76b7bc3cbbe47541b9254855a8a6114564206b88decf930b2036725c24075a4f4704bd49509bc157e3810d073de8aa0c7d6e5dc763f7574865f32034b560d53a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
964f11f3d589b1d03b3021d83a770fe0

SHA1
7e623cd00b5f31bc49c66e738d0429e13a9058fa

SHA256
35fcdc63d6085db2036e5c09217cf82b7fae4aa7487c564574722b444c1fddf9

SHA512
552ffdcc533e52e9f94912d366a2705325be6481fa8fcc8c6751a3752e516cbb2b8e0fa71a2696e87d12e171c741d587e000265bc3fbf7300bcd4912293f39ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e557c2787549e55482e04671ddce59f2

SHA1
dcd6d27b11c188ad1bca666ce79d98bdf3db164d

SHA256
8f74cdd306017a693add83ac45b190ee0f45f13710c2e9077d8cbae9eb6a20f9

SHA512
1ad20ee4e1c9b8988582d58520fb97e9045d0e282abb23d188ab7fac55270fe38dc766fda1a55629e4dad4b295598506e4e337e967986e3db531f5ac82290894

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75694fbb0b2dd68f6024afc49102bb8b

SHA1
46118e2eeb9519b3d08987f08d66231f933b5c9e

SHA256
5b0e72d428e106f819ea59aa8f3c4f53864e6b38a21485a503593bf820d4afef

SHA512
c1e2e72cda71f52dcc2761a904f8ef51f9f54bfc41377b09cf975500becc16125776f09253706e0ce3f3435c9dd4a60c9a39147028d4dff0089373e496c3b874

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b694402da6ac72462f603f86ab9b299e

SHA1
0eb6f7945124038b0458d1e5600b13a8b0ec22cf

SHA256
d28f22238bd672bf981822387ab6e55ec051fa6e3ce4ae63ef3610009d6699cf

SHA512
874411160f263c0d9198e9be52be232d1eb1e4bc7ab835c7211b473f47deb9491d2a76f92a7ec71de0dd55efd6ae3366c61575e6666590f1b9325685c39fb073

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2a074263c653d6b2c1f4abccdfcc34b

SHA1
111975a30044247132c7da815e6cf8f448c43c0b

SHA256
70fbcf36dbb6ae5c81652d2ab71f89ce137a4422e29997950777623ef55181f8

SHA512
6be5c627b363e375e4d7965938191cf852bd0340848c16ffe68dfdaaa3d9246aabe78ce46086d06e52c816a2f0973762b91bd0b336e67525e47b34a06a92f998

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86c728e5bb191d6b147f298263b7b175

SHA1
0a0c79001e703e57696bde9f3ab2c910c24dc297

SHA256
2258c76de7e0cd0033f58f4b231239f82ce2103bcac37cf2fd3c7c6f7b64d22d

SHA512
feb356e2e318f127af58a7c50ef57f4bd7c4c44a8b9c1eb27b491585dde3660b434508be0e2c5cab7394c85214e67455b2ded6187725ee611694a0658b4d81dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3b28578d2097c91965f47dc557e4daa

SHA1
190ff30bbec69a355d4b56c1116d2e09f60f9d09

SHA256
b5cad5f3c1c61b5cf60b2b76fe34236f74ef05bf1f684f60ef411e03045fb0f3

SHA512
2cc9b228528c2d4fa86aecb08d1c5ee4b2062e6b0c416daddcb60ab62ef4b085d86fa3f439ab11116642548b643c3efb49f504e08579e8269b12c8458203feab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c7d953bd161ca769417bb7226d803a6

SHA1
dc9c220f050493bebabf874239fcc62079ff7b64

SHA256
3f75d45e0b2b318ebe8034c88ae5c3b11a2cd89a54786aaa9dfedda4a48a7e79

SHA512
0984d51196ead0e1c8bc968827d44828d055001cb0c5d67b289b8fefcecb5389d94a5fec71638011afed2056242c5bd6b2528ef591f2573311667ef26a81c21c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f3d2cf51793037dfdce6b6934005a50

SHA1
66b99a96800dc18a6abbe07f9fb3c30a3a2dbc63

SHA256
215cffb681f3404ff73f26945805496e83e8b1ce4524e4fbe3c66bf94ff87e64

SHA512
a37c99d37a47c8e79f0b07beafd557c3a54245d8869c041aead307cabf6d036ad8e7325a6d9cf4eacc0f3356ba279407f2b670e5b099acdbbb9f4d96ecbe960c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5fbd5f915c416b9dc7bbef0f37dd2732

SHA1
1b86b661ed4db8098a16c3215d8737c905c7ff50

SHA256
4ad700f1dee2c856b52228e36a6040bfc43d1ea8b1d401bdf1794cd5e853042d

SHA512
615c2006791d54b06c9e1bdb64521ba6a9d7260ff27774050677aff606a2d1fc55e26e5de50397933b5a4e10661944519cc04b4c8336d2dfedcdd098b9a9a143

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2891adbdbcb91804b704757dfaf34f68

SHA1
e109b39b8631ecd8f4a4b5d1640ea14f6f11cdbd

SHA256
1b9aea95434dd1aa42d9ccf978e01abcb0fd1397c2ebbc73cd0572ceab4c2b61

SHA512
50d7b3c1e725e2e0982ecc8b571b65fcc8fe3010d03752156335b545447b2ba6c12b53e394919cd144eb2864b6cb54fc4b30d6d4e7425fa7a1cf82ea696dc91a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e70f34854a8d2393c5e6c5990f56b36a

SHA1
3d4770855a45fe5fe7411e7580cec5b9ff384998

SHA256
10f79f2ce27082d8110fb64c2517f71ca7bc99feddec6650fa7a0f665a9acb70

SHA512
aac99086e9227b6eaac10b10734dbd7f81e4088eba737d9f0b2bd53d20957130677085b95ae675aa18c19c4d9cdedd3134371d318d7b47f3fdbc7b32d3cc8acd

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBA99.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBB1B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit