f9300451c73cde5e005a1a463782ed00f3e76ce0e2cef40196c1127247b81cf4

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 00:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a8c5419944f576df85abaf39d9f88bc9_JaffaCakes118.html
Size

3KB
MD5

a8c5419944f576df85abaf39d9f88bc9
SHA1

5ee68f147761c0631ecc94015d0e6f25853c4f2f
SHA256

f9300451c73cde5e005a1a463782ed00f3e76ce0e2cef40196c1127247b81cf4
SHA512

9fad4b1e4e078996bf11a54c303ca9212fd1fd8c47c5edd5746beaadee280d2805c4e7b1c2def5037615d238b63c37b4c3245041943cd01e300adc8bd6e102c1

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000003c0d6dbf74a8dc30c23f3dc696a572659e75aba0fff64a37409602c4ee4a7852000000000e80000000020000200000008021a80a5a04257e585ff30840ab0e53fb88f774309ec004652e6c678cc8c6f8900000003ca9a4218d4da6e44de9e1b5ef1d90c80b48ca90124245e17ac73d3069991a070262fb02fab0b9a840e8144f060385b403107da26e5c05a76a7a90745f20aaee97be2a3d0c0db3a4b7ec6bdda55dece821d594b251c006e49a33212157c696ad885064bd8a0becc6f0509de0037353d9057f6a13c7ab553f8ed9a5ea8bfc26c3b3f466c051d20520f1e8d8f9b6f13eb3400000003655e3c3adb4a72eb2c7f4203347448f55e41147b232f2680ac03b02bc9d7ed0a8329993ccefe8ddd8feff98e2c32916189a3801715077dd7e07916f0e983fb1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8EC102F1-5DBE-11EF-B29C-DA2B18D38280} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000fb3df97bebc96af6d8774d014937d3c1a67a15783f00b498b4d40489e3176d37000000000e80000000020000200000001dce3827af9f52d094811fe797bcb8038fbafababbb0fd2c6bbe0481ece9e0af2000000044e3db9b7e3f1e987e2859324d6164d9b8946c237e9d106d4d68d60864a98ac640000000cfe904272c19b35c05c7ff2df23ad5d0f4daeb0bff67a9469ef48ad1e2dfd064b8264c0b76628297c07972337e485a13b42970b07f30c579edf32c0f092ad6db	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430187725"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80785b6ccbf1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2348	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2348	iexplore.exe
2348	iexplore.exe
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2744	2348	iexplore.exe	29
PID 2348 wrote to memory of 2744	2348	iexplore.exe	29
PID 2348 wrote to memory of 2744	2348	iexplore.exe	29
PID 2348 wrote to memory of 2744	2348	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a8c5419944f576df85abaf39d9f88bc9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2348 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
c507f26693df1582ae4b09d44d2d50a9

SHA1
92e94ea1f8b0dc82b66f4c89b8b4bb7dba377613

SHA256
53c8c810a54aa8f589f436f9f0a01e8613e7bd8a8a885fe06c3a4ce552b25da5

SHA512
f2ac96e5ae6fd9e50088c8cfaf4cd97207b1a20380421185084941204ec5446772400e5e5c0f2b5d9986d9025cd7060316346a29bec19b01559872eb18924f6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8f8046755c64a4a5a9a0c3a7d421d43

SHA1
84513f14b99031d1fe927849469efb28dbc7a529

SHA256
4c18fe3ffcb5b5b7d282ac61c7e3b7b416527b9efdbbbcd66d7fe58c83cd47a5

SHA512
0b6c4cfde1bf84e5ecee42e5649f4d4a718146a8bf90d1f6422ba54cce0735486641419a640a46d16bf051076b84b9a1bf910dcf25b3269b51505a27cffe26ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12b54d408752066632b5336208c69715

SHA1
5f551a7c605ee9643fc60ae83e187c45ab8538cb

SHA256
6f14b240961c75b7655cf6144258efaaaf4f0205da733fee2665eb79ceae7c1d

SHA512
f5e322ffb0b0c7ca60286fd1e995f957ccd88a950e2283f6afa73a55bddc2e36d98aa138623890ba45c3c47b973e7527bce89846a689a861d0077535cb527416

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fcbe5bd5f41c33f01abaea3968bffe77

SHA1
625d3c30fe0431a28e0cba5b2b16c71eef151b74

SHA256
23e803c0c44f2cc09b3bf12cea15fc378178cbf174590aa66d0c3bc085d3c302

SHA512
2e5ea3776f7c9b947db414928d304d447f54cead5367fee5143372729cc2ae475ed48fd222173715f77b25a633a7991070ae9b8f171d82a7ffa71884d339e2b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ab87d0bb86679d5c74d7a68ffc43840

SHA1
9073f0ad3b99ace39298ef182f8c6c1d659d947c

SHA256
34e8f0b8cfaeb6c04ca8d3c51eaa49646bae04b759c1cbf0c69d648b0eb1600b

SHA512
611da3787047b3bbc50a56852050f06eb9b7b6de4188661fcef117af41b30ed7161f0981366e838efd0c1f485f0da5a81060b2642840e67ff457b96f0ff95aaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a975e9a6a1b879527497d6c864623a6

SHA1
3c75041bde9b4bc138ebae3c6234d8da17cccc1c

SHA256
9dc391d7b076e2e228de06238c9afbfc340c6ed4d7261a5c3807652c85fd962c

SHA512
893a350d1e37bcb087db3d0d9d997828ee5f8e77c96eb05eee6180c2de448cc0080903960c88fa26d126bb1dd638ad14c777659d76033a3db069cd5c7ed170fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7de9047b77ddeb62dd827e32449ec96d

SHA1
d2caa8e85dfe4e658026dbd2e8d51ec57d1cc56b

SHA256
549f71a6e0f3adb90254c6b7dfe71f7a65456f531eef92f3cd68eeffeed6bfc5

SHA512
10e31f72f1aa3cc0f950bbaf4bd4fce0096da1a25666a29f4d8092f7a979b2f07194c714189966c45f77b4f8a6042dcf966096e7a9d465423ceb9012e5395285

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64637fe18b12ca160c570dc37aa36bf5

SHA1
db5c0f040509f75d73c09ed7540a992c4ac9a3af

SHA256
b32a28e27d3161ffd9a25e76ec16e5ba03017d4bd66a17977371aa571600ad28

SHA512
7a514bf70df44926fbd65c6b234403e24924f3c051d17faecd8879f875773c731f2c7c0d8f3cc0fa2f1664401f8702c473db99266d22714457fd53c95206b96a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
720ed6dd79e838a489328c42a7df0a68

SHA1
5918a5f73822a06ad6948bf558e75bd725b87191

SHA256
b08b42e0cb1bc1574f37071b7e563f1f84f28170d4c626a9f35831c9bc93e2ff

SHA512
cf7deb01cc02696330f891df5a30120d53fc170f3e17cff12c4bad1896c5fc37df917e300accca6daabe81e6bb293d9eebf9c370d8dcac134ff01425854042f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c3d6f5c1c2d62cbcb4c9cf0e5aba945

SHA1
bb696923968d7e0f7fcaa199e31a533ae6848664

SHA256
5cfa4efb1d583ceeee2443bd7eaa9a48119b6d12852ba1056b804a9afd0d672e

SHA512
6e1a313ee6ac9d7c82bf243e54bc0667a8e003aae7cec23c0afac809969c25c517277cab1bd8460ae247d3f9dbf03c1b54e6df86b842f39494389388175816da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a14fc9e494f2660f1beaf362c20a62e

SHA1
629e65d2d75d1301eb680cf90b3a9df4ca1374d9

SHA256
56f80d3aefbd7b946eabb11f7af27fee20bba04ad313049f192cd6c3031f12a4

SHA512
2af2ba447a896d74eb9e68f113ce299b8f641485fbcb641d49fd0fb538c810400a70e284a634caf0f581d3c20b2419a05df0b4872f6bec7725053eeab437b5dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
5c14fc1b56117ad372d98ab015c53eb1

SHA1
77bf03370f0f3231ec85050d0e510063616d5a5e

SHA256
dfab9605da2b71b270b1da1760e069d1c5c8963e7580804d495d75c54c9e458d

SHA512
954cef3508639706e468e30c34ab5bd731c2deac39d28e570e3618da86b03068617562f64a0517c73bfa0d48315fa5c05712e4651f07225919e1d8070f77e52e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
12ec6e8116616a038af565a46e1a2bd3

SHA1
795b5a9cfdd6b1c02ffbc31618c679787ba39b0d

SHA256
733e8b3ac802f993f32e1cd628ee2026b3a4093436121965f77b99e1ae8c61ef

SHA512
259bf7880393d51fd5d87a3c6116e0ba00f8aae231bd47c29e1435f60c88ad7a9b4ef436f9cf0198176107aa25bb6c16063ddc6bb121a4d7d17e38c99bd3f0da

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA832.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAA38.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit