9e147b40f463da17a8ec5e9e2e1eb38ab39bbf4f31b6cc427c596f18a4e1a174

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 21:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

acafae75db6bf199bba408ab2178b01f_JaffaCakes118.html
Size

43KB
MD5

acafae75db6bf199bba408ab2178b01f
SHA1

190704d2317108a477211062879bf997d6dcc5c9
SHA256

9e147b40f463da17a8ec5e9e2e1eb38ab39bbf4f31b6cc427c596f18a4e1a174
SHA512

89ead1d337f9d44e22c874ad22c2a02fd6d5b032e4c6fdc7a7f6a2bb8c11481fe297722db66f1521fdf01dc3558186d5a62cd8bdec19eb098caacce95a3b3079
SSDEEP

768:S5yi0Hgjf5xMkbW+u+w0j/jRd5zm4LVA/nqHFuF:S5yi0Hgjf3MkbWR+w0j/jRd5nl4

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AC15B341-5E73-11EF-8E54-C2CBA339777F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f02ab18480f2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430265536"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000aa8e438541600e909852b2af9dbc56442cac8076f71b95dba0c89945a22b7c6d000000000e8000000002000020000000f93e820e99f83ef9ab35d19284d03f3b08655d260c57774518f95f6f315632bd2000000082bffa154a49bcadd90fd9f5ec8836963a3ae93612dace2e46dd32ebaeecc5f8400000009f7016e4ff1cd7eae7ef26b71d2550c5dc1c7b83c108d93c7f3990af277464766d4d4ad57dc68657feb6b4a835111ca319636468799cc7b30e614db1060f38ca	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000643d4f2e27056b623110c5d0940c155e228746b66a5567400bf5f010a72021ce000000000e8000000002000020000000a092429842f6c267dd2017d73fb65a06a0c63b897720839912fe82634762da3190000000c673e907507d0e4c0c160b28483801d2080d528aa784def9b71b490cc311f583be736be3e57b27e5d4f36792a7e4a41fc3faec1f9c51a8f13d06cc52e83e922285c77d77a123dd2fb8272b399d88d6d95eb77d57a6071d57be353cb3ca9454a2d36532742aac88dfcf38d3361f3b94449f9ac82365d1b710089c149bd1be15e641ec41fad4e1c6250559bdac75370ea54000000049632996aaef1c1a88a8e5014ce538a18d12c97bd470e03619f51135f8c60bed7551f9e2c085b37dc6e1c4fbbd849ff25a12c8844d41b6f71f110148c72874ab	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1072	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1072	iexplore.exe
1072	iexplore.exe
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 2704	1072	iexplore.exe	30
PID 1072 wrote to memory of 2704	1072	iexplore.exe	30
PID 1072 wrote to memory of 2704	1072	iexplore.exe	30
PID 1072 wrote to memory of 2704	1072	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\acafae75db6bf199bba408ab2178b01f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1072 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1a474c85d525fd7a3b33d4741113bca

SHA1
339eda296f673acec0a530f7bc32701660a6e5a1

SHA256
47d39031f367867350759a1ac699c3c4a617fd13bc0aca526bd384520bada442

SHA512
a85b4bf819b3f73ee7e5a54969e44caf55b1a68ffa5136566fbe3b813be38adccb74bdde1000b40ff6e734595b96b5d7321c9ec8056243ed107db31ba9faf44b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0e9f7ebeb0bda7f6d95650b15fc5be4

SHA1
08993b76a571e15c8dd6131c483c7b97403c98fd

SHA256
43bedf9df3ece910659a524fbd650ef6c2565ce419010b5ae7759726f449f9f8

SHA512
554a3199d0532390d90d5219c5d8ae8e6fc42dafaeb74bbd37d03a07dc44fc4eea4dbc19d4419d47b049f60911fcd5f10fd1225d2e53f2c86d9097a641d7f835

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
024a862da8ab96f3be9e82d03002a658

SHA1
278d00d1f40a2479a7028ca12532b32e85e77dff

SHA256
8e5a0f605a2ab96d573900065df56667d1cb3f495c607c84a5ef74f3c65b813a

SHA512
481bb660c71c1918cfaca75bdef9025dd351d3e77574a0c7dc7664c7f4187bc0bd3f60748e3d18859090581f5c7705b68d1f7a516c5501ec3ba1db4c76e30f5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c845e442f817ff2b3df7696776dfa416

SHA1
e792dc3f4f14e771a81ef75fcd1270f5e4d46196

SHA256
63c7e3b05409a862133459253c4d0ca093aa788dcf4cadcc8d39dad760f69746

SHA512
77c5cf04d2911215c07259a1f3b82d4f68db7eec624b82df5ee862525a8bee6defb3c41ffe14bb7f207584759e1a235811a775d7ed0c803e55b0661122b861de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06d224915c5258e360269c363cc392fe

SHA1
2372ceddf59b6bf52c03c83f7155cfbf29512b0d

SHA256
f9d593d77d72fa2eba2484873eccc6a792a395924bc0c3f37b4e2d103667566c

SHA512
120c4e58512510744d2307578380162cc056ab15a77ddd69f97420cd57bdde9c423f8c0a0ffbf87387f556217cd9d1ab4e56f2bed90ef19731cc8a3f826ac670

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16f4da8187c91a42595d204937dfdd68

SHA1
7a8db0a08254166ea148e8b12ac72d69b4d13c29

SHA256
cc3829a52a80c30a76c10e0fb2ccae8f2e6d87d884e15b0cc2414df1a97a80b4

SHA512
1f74a0378549ddee1549fdc76585759463467b37a6c516368a38fb7f2baf14618bcc113bcf9c46a2416a60664d7a22280d1cdcf45d52344f96ae30812f4a83f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80938c18ed40f952dcf64aea46752ab2

SHA1
06d0c4e0d4f6af0b04f7fb34cab0694ae4f8288e

SHA256
63f9842ebb4b4fad4826bf3c81631826e4578e98a91b853d0d695d59072204b5

SHA512
0da95c7884dfdc3a3c93ed586480fbf19dbe9cbaf2d31b1faea5dc0c82a6f62bdbca77c95d984c2de4f95fad24d244076e938c9ebd11ed337677310d412b0845

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4cee1e800f39b5cf72a81254d0378e23

SHA1
1d1d0c8c88a697a7a2defa138ab05ac11e836795

SHA256
a91ffcde65e5b1eaf00fde00c33883f6c56e1f5f7ccb24fb80d77ce62748848b

SHA512
11107392ed56143aeaa21277b22f94c0443270e10fb53e88f815b25703ee4cd68ec6ff5956ef5ea5be09599d4f6fc3931081138f0b77b1509961cf8447a484bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90140fabaf2f6557bb0822b546f714b1

SHA1
81dd81c011622f9655d42281da6e84e5e7eff4ed

SHA256
b6a1b9ea799e58d74ce6b6ef6da85c6865545ba57c8341318d66b645dc1bd710

SHA512
73a60b02b9aa4a45a91b30478adb05e1f3643dc354b3b2c5ca2930b1296ef302e7650ae3dfdc12c0e16f78e7e71b0357126259824ff2e3da46199fed8f41684d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c02b332201cb5adb4e1edb9bd546fda3

SHA1
3a391dd18e37a35ce4aeb708a4eb5aac824508ba

SHA256
a850287620901417575d554ea5459c158f921a5d7f9f1ebd2eae9eec1b89c04a

SHA512
08e097a35bf9536ab7b1b825f17613d61a8ded3065a2570f251468d30276b5195de42eb89ea21e56e169af5515d836c39168521545c0957ee26d54c56e4c29eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c998ad2b6e6544251b790b8860cd726d

SHA1
8461a9165d1ff53284abe3e0d1ae7619dc970d78

SHA256
3ad7f180cf791dff104c5d7eb2b57ae40366fee3556eb1b74d9aa243e10de1ec

SHA512
b85076efa9e34a5092fc36a264d9247e06b706ff8aacb4404631b257cd570411062bd6b87679a0f5450305bd03190ac850863ae416cac837836b5618226e976c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d25e06098f2669e2d2bbf23d416adf61

SHA1
1dd85c0fa69af1e28355f92c1b16738e634d6ef6

SHA256
b2de5b44aa650b3a8069145166b0200f2e024f09a6f8e9753cd56d92ba190474

SHA512
8fe6ee7cf2f119fc69dc85e263dd0856d2f0b11569f4833363235430eac7e7827483e2755ff38bc7b7c0d34a365745e82741f4b7f17d0517ba96007c84306af3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab35A3.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar35B5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit