2f6badd0d431cd483e3d9e6a5eea98935a9f6995fe07c644de7de5eeefdaaab9

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 21:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

acbd4434fb76b43fdd10d1dd304f0ac4_JaffaCakes118.html
Size

7KB
MD5

acbd4434fb76b43fdd10d1dd304f0ac4
SHA1

41f51935b13a9e4232029a8e9524133a42475810
SHA256

2f6badd0d431cd483e3d9e6a5eea98935a9f6995fe07c644de7de5eeefdaaab9
SHA512

19248c4ad4528fa13ad4a796df137b895629bca1f52c8924223bf06039d3c80820b4b7549b16c4e52175af4c1cc6d5aaadbd77a7128786ae3ad2aeb821d9fb2e
SSDEEP

96:uzVs+ux7v0LLY1k9o84d12ef7CSTUczMcEZ7ru7f:csz7v0AYS/ib76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430266474"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0dbb2c382f2da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ED159D41-5E75-11EF-B5D6-4625F4E6DDF6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb470000000002000000000010660000000100002000000015a3c395b2b953c99c91755419a4528015d2ca55bc60b0b63d44a96b4846c7e3000000000e80000000020000200000003a08f05de95defef453ee8e35ce37e4a38861f1c4b960fd2d27f0b822f6c558390000000433b4ec05a19fd456817a52557df01ab7ce0fdfaeec85f9306822867318abd1f0d89b51df6218583b5e50762cbc4886cc4127631bf73532f877d4d0000a518f9a3730951fbaedd2d9ef613c9d742768ac9daf9148ef9069c35651acebf68c3a4045250f40ded06db58f894a8f4e6b34a0fe0c8648eb96b81d3e47b89037585fdac338f948bf252dec9cfbab5b2c4a5184000000006d2cb69413e0a2fbd21b652aca0f17de6ce50e947ec2aaef859e1787e56c6e6ba3ed605b0f4ed85b61466e3a41ee55d9560a203c39bcd9d9550dd173d95800e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000337f749c1425ac079e74bdbca708d96fd55c6f566c4ea8992973cdc720c3f71d000000000e80000000020000200000006387300547d12e18d5ba0dd3f497876afda6851baaf445726062445b277f79bd200000007102b4e48171a06ff0061fb0b47f82d35c40fe3421fc25ce7189abd8ec1bf0ea4000000064ab29ec2c440a8384b0948d1b4875ee3bb4bc72999fadf8d39b6d8e774eef322785f12b24a8e8ebb8fc2977782ec915d17179755209ddeaa277d55827eaf4b5	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1820	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1820	iexplore.exe
1820	iexplore.exe
2432	IEXPLORE.EXE
2432	IEXPLORE.EXE
2432	IEXPLORE.EXE
2432	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 2432	1820	iexplore.exe	28
PID 1820 wrote to memory of 2432	1820	iexplore.exe	28
PID 1820 wrote to memory of 2432	1820	iexplore.exe	28
PID 1820 wrote to memory of 2432	1820	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\acbd4434fb76b43fdd10d1dd304f0ac4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1820 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24ff5e3199f30ef9e6190ff3c692e0e4

SHA1
56ea196919fafb8a0563882346369ea2c396edf1

SHA256
a5aac017699fb889535f3b44d017e393ed6419cd46b4943a3c17c7bc7a31ca70

SHA512
9afd6b0746211a6b47f723071e169ed479ab94413fc1861e8679d6dafccff3fc20dc5a22360b6c9da2a0fd2841b3a046d28a0d81f2b3030f0b8ea0e7a623e1f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0acb4853b5b9ad291d61dc5893ae619e

SHA1
c137c71f3f8d943dfc0beed8ffdf2bdd74b5756c

SHA256
de83b25e1c36f626827ecde9f0eb9e2c61e0707382ddf4bd10adaa7a0830eaa2

SHA512
d5b367611a40c028c5683ecb9e50bf0290ab4ace56ce0d8941c914af51a27fa25f272cb9ae20a5fbcc2ed7598a1a2679e9e25388d765a2ac3d57b63236e1adbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d04699852218d6b858355f85c6d3642

SHA1
0c78eba09c6b0dec98754e5f1864950c748335de

SHA256
c52eae651eeba9c738f84592a92b60c44d3dc01ad2aeeee72c3903903abfe907

SHA512
5b0d88557b6931601b932a23d42ae810af3823980bb8e8e7f1590d9b250ef3160115c187ccb67684839da03372ab3ce86ecd558cb50e00aa080882c547d7e472

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53eff81a141a0ec887ea301389964889

SHA1
884d65506366b5c6a4bdd3c7797ef0f28580f015

SHA256
5fb47a61e8726bf682a54e4cc98d1bedbdddafe23f607fd9cafbcdf05e34af77

SHA512
71072e9ae10fe962d71bbf76dee282c7b25b867de3caa61a6e76edac660ec91b2fb742be8f3a2f216ee11f64d81201bb3a540581fef544b02f10f8b56bfe877e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e940513a842acf0040a0f0bf0e35ec0

SHA1
0e918d2e3be6fcdf1b8412897d7f5142fb34522d

SHA256
494f6ef02e6fb4970100a99e7c116b208fdc90230d8216005d7df1ac79a127d9

SHA512
ff6c8f2ee6118e2a1c1fa5630eb0f976c57c585c97965f21bb574bd9d305815cd6a4477d68a2138c8c37e311b8fb2348a343977671d98b03bf6f8b0c887338b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba0a9b37f978394aa5539e76859acc20

SHA1
96c9b4c8fafbb07c7fd56729f16ac4c05722e06c

SHA256
8f998772b39c595eeca6ef3398b490789c2990122c38d170b8f6263bdba10172

SHA512
5b5beb6b3d134acd48ea416404666fa1e51d417d90a40d3470ccd142f3797c464fd38892cbd223850c883ba97d5b374e162de1428a8ab7da8f58d51c74c8a39e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e46293b65db4bc98b1c9b84cd92d6c3a

SHA1
de7e756f36edd3ebd5dca2d8974044167e9fbb63

SHA256
7b6e33b211984ca1e89339567ae7d29cc20b0b0384b788f41c1e7777cb6a7527

SHA512
eedc3c2c832c32a515bd2f65e1f3270218ea0e5ed74d7dae09ee1d74c113b15c53c3f5e203539eb9fa1b9349c57146324ca76ef169fa96f0e14cc33312eda3f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51957461f073e057d1e5d1fa3c128ca6

SHA1
010bc8d8dc120894428dcde423aaa0c64d28f94b

SHA256
05f3b0c1e5975fe20509fb7008d8a7759599ac4097cba6c143bd4deeabe9248c

SHA512
ce4504766d37271262aad84a0075c7c11cc1af77d6378c22068d0f7e9352121ebbe95b0b9282c625d9aed7cc7ab414855c2e722e1c18aea6db0967e181a9552e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38dc647fd081d4791d99f2aed630b595

SHA1
39c0db1210e48d253113fe857b780155ef9b31ff

SHA256
8884cbd6f8c9b7186627f40dc3771cdaab6e98f85e0738c6930061b3eee72eb2

SHA512
0d0c65166cb0f56ee0f350672ce25cf65d153773a423aed0b0c8471915888d91e8d79d2865a589d13b704b065a66e0e5ba059914fe02430046915fb9f8873634

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5a39be9e95d5a6fc01207f363c53654

SHA1
b2269e5b07a87badf194d3862b6b81167ed43d97

SHA256
53a9e3a84929e6ee43a9950c6330df8ae6086cc345947ebe08c29da3e2d96879

SHA512
c28eccf718b6eb2d127fadeced8a72f582e000466c7b88ff9fa10ab5d7a3ab0f6b2238997e12d868aa49b77e6e838dd62e46c2f2fe6b04dd820aee8dc780cab8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95ad62541c19d38434ecbcab87e21b60

SHA1
9aeb5abb906e9d0f0521b087531113454d48c356

SHA256
ed14fbad9e3cd74864d5f244d44643f52e476973c7d56f159717f0c26cf61290

SHA512
7269bfcf1d82012424cad64ebeef931fbc5ddc70e8523527993f98a03c4ed3dc85c0322a68825dd07af5e849b0f847e4acec6061f7a8f52ce2c2829bc4ce7227

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b36c6d0eb81c788642e8f81337ebe0fc

SHA1
d0fb60fda9eee60f65daa9de6647d7d3180a2b3a

SHA256
c222de7827af186f814226555ca61c1fd426bca7d3211ead6e04a0f4573ce7d5

SHA512
c8ba53a05870de4330f98d5a485ca420d41fa720c1baaaf0cec652addc5d3b4578365e570298ae18aada3febd4c1f08d2a25cdad97b6a2b9faa4aae9496bc0cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b091767a897d87c8ce8a05c4379a0868

SHA1
07527e9641e9ee3486fdbbaeaf2422482d025263

SHA256
1a27422f9fb92392c25854f2b64b0ae246040ccc038699308ae3597e97ca20c5

SHA512
f76303793a2816dc8f64fbcd178750c3c7a673587f6ba59bb45d4201eb8cc052e9dd5e6e60f01ce699b0f120dffd2d1a2facb8b75e286700313396a5389bfb2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c585772efe44b0e438e397becaa050c

SHA1
a7b8ddb92e6c4a1ca63a870b09892474a2d91a4b

SHA256
0ced6ca2f9e1ca4c4aea52ca5a9efe2b11aacec66f236a91f8e7bebe423a1aab

SHA512
28607422e335f1c3bc40f7f69a18cab1a45b2b8a262cf63172eb87bd18aff51c2d63d6ec1d89a49fe3b80460ea1676be9f170a1333a0efa041ff8dc7424b2bc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae4b8529ed1a4aa39d826d3a55959bf4

SHA1
62efa16d9cd895cde728a3623203e86451d4a2cc

SHA256
cf4fa90a5e6b648199c8b3e3bc7d754695f370723a9303863bab76532fa22ca9

SHA512
41b1f1e134fdb89a246ba3ebc40456448bba43c234ccb62f92b4bc0d61f976418c6097c8bb1fa517a1055dd2b49edd80a0e0e999d311a6ceea9648117329042e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAD81.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAE30.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit