0121fff9ffe79b3fa77a8f5fbd24db2d07bf2c356164d8eda317070d34570025

Analysis

max time kernel
134s
max time network
137s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 00:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a8da3a9b317fb8fbf6995bb2e1ef0eee_JaffaCakes118.html
Size

20KB
MD5

a8da3a9b317fb8fbf6995bb2e1ef0eee
SHA1

18c33147e4bc33cf2471205c4ffc08d885f94162
SHA256

0121fff9ffe79b3fa77a8f5fbd24db2d07bf2c356164d8eda317070d34570025
SHA512

923d87ed3dbd7c202fb316fdd125d4490cb8a707805f98bc897b1aba3cf836c33756e2c001758b18620b9152bf4775d0830d7bdd858824eb262d179ae43d72ad
SSDEEP

192:eYak/aQjRn1B/iBRqHq1iEjFVwS6ZQ10o6HCKpF2hBq4ttTHa4ew05dlfo3WQgNF:eGHxa60imZ1Df7a4eX5dlfuPXGD

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000bb03baef4a6c663b3b97fa88d71fea34d71c931dd78b323ded4d19d39d9ffcd2000000000e80000000020000200000009e7910261a96bfccfa7a4112b424cbd7ab8b88420294eb6c306769858ae66d9a20000000bd5abb9460934010c2cf27c72feece243cfe763e69aa59c60c375948667ae48540000000b0d0ee63f05376c9c036a180b1a012816c487d35d5c069586efe7f0698bed7c49a97c6b27ec860a858138b63579e849640f2de514bcd65433e2f24b53352af78	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20934546cff1da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000001917726ccaca7a8d40885d0b531c5a6eb00449f887837d69d5f5cec5abfa69f1000000000e8000000002000020000000669ccb5341ac9ee4b73f73ef76489cb6b29f7b5470dbaa5cf8ee8aaebbaddb1490000000cea5f0b43cb77fd7ca07a98100f2de000982b99c94ea00bbeadb37993971c9cef507309d83ecf6adbc30e4776b5dbb77cbaa4fdc609ee5ad97a218a2732265c2daf07fd8f4f06764898a1970db4a2257b361656ad1029c620486dafb81761450eb5cd86b849c997547d3ab98ba61d9c821c9ccbe360359a4142cce0c42dcadf57a027f0c7a14b42cd09b5967a82bf56240000000a4e9400ea7a41f3e12afd83d3d060515b1cc14d46877f3859f57e40b7d9843e36139282d5761fe5cabd676d4aa653588bf0312616d123d67cdf2879526e673a2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430189372"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{69445051-5DC2-11EF-B4E2-F64010A3169C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2860	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2860	iexplore.exe
2860	iexplore.exe
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2676	2860	iexplore.exe	31
PID 2860 wrote to memory of 2676	2860	iexplore.exe	31
PID 2860 wrote to memory of 2676	2860	iexplore.exe	31
PID 2860 wrote to memory of 2676	2860	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a8da3a9b317fb8fbf6995bb2e1ef0eee_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
335228f2b56743561f334f86c62f0ea8

SHA1
64162956974a99c7009160cd862911cb8f486812

SHA256
d8884ff7823bba7f5aa77fb82430e0f96015f627f5102000ce0e9f47dda7f64f

SHA512
262bd77102bb471480352d88c03a0c3166570cc60ba2a193df4afc159ac8f5bb165a4e20c37c08e1b59b812d014f1deda2557691b15ecfbcda5e855b4ee2d4da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
db08377950eb5ba3044b876196fae72c

SHA1
e032b538ff9a410a7aaf2985bc7418079224dbd5

SHA256
fa653a0edb6dc8b2586e6686f415843f9523b8915ff37c9e1341fea6935a6bff

SHA512
5d83a383eb9e60c0d012e6c0cc183c82ed94757c8114dc7f9cb4f0054d6144372579ccff56a6cb913f81ea97e5ea4fe76eb8df06b5d086d705e8f3191b17195a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97c2c117aab4558bf5bbe8d494019497

SHA1
8b04f51693020e741413c1861b5c8a8160100d7f

SHA256
3dd438c954331e2dc1c59772cbddd3efe29c951435d9330a0181fe761c2046c5

SHA512
e743e01f9a7385fd92bf13b83d73734a4537a92fc0935e8d71b5eef861d72d1b24cb7e06581f8c47e87b36d707c91ad35629e66834780263a1b72e9c2d99fa06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a79b7066e54f7c759287c945e228f53

SHA1
b392b960951a8367135a6dda8b080e3d782a2287

SHA256
ec6a482cb5c79defd7651ab22cdff7cfe164651856f5ebea1ba72a0f1d957467

SHA512
c470b75f4bc5a274658bde258d8d50cf539e9425e52c396b7ef48a865848c5debcc4e4333bac90446b65bf62ca1f03d1026a9c941083e37a5fd6a91cde1efeec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce8ac62d24fc541060a8b6323c57eefe

SHA1
3ef4e5890b28b6c9ba65b4aa8fb3a31f182ef560

SHA256
2b06a33e3b720f6d1f211a0781b10a56700d7d50853219347a72ab9bcda47cc3

SHA512
2b4eaa68b433a638e43ef34d92cfb93411b8a03c57109160e0c1ce5d93ac6be78f3f67568d9ad24f56be07393f3200fa8e52493689a962343aa8fdf96462537e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b248031c46b1ccbee11e042ee592171

SHA1
3db31827b72b0ce06125338fed10c2a3cd672a06

SHA256
7e4ea42e72066a9018f39bcbcc7fd3d9f7c190705142c0af9ba3316e40f15acd

SHA512
128f38f0bb74ec6b505fc1cd7244ea5c253af7b57751095a39bceaf3832c55af65ce231f9086dcbeb89165d1be850f3b73e0ccd74419115b425655affe067565

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91147a1c23544ced260d1c24d9233758

SHA1
7593475a850f45c75188df65eba562510ab6fa5f

SHA256
f386ab66bc712bd35133aeda96df096d834be45126dc6ea555e3a22f13f5281f

SHA512
4dbe6ce26a4cf60800a4447a0675500c2b08a5d3f84091dece4d229871e84c545017ea14e98ec2730ab7dd88b6a907d5a165c09b90bab222983d52cca0f4ffc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5620cb21ba1295d7130a900805dd5add

SHA1
fda0cc836a28580359ca0e9fb357a4c3f4cb97b0

SHA256
c1d4e0e2cd8f53efcb627f74639068acb75e43db303756befd824795b9b398a9

SHA512
ccbbea4866341b11446a9f7a4e99494f8ae8733cbc374acd927e131200c54098d2a28f2a1df1bf40c03f7aa0a577c49188ad4e35222fc80dc7d44debbdbfeeb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35f9f4f538c86294a80d064a0edf7112

SHA1
29145088dc5e56de5c2857afd7f65df2894ecb98

SHA256
dac96ab83b8f693da539a153929ba66d7e21f42513e0380aa766fdf525f1c204

SHA512
f3f03eabdf7b9927de233720cc7f1399c1d0023fd458535f44e9eceec08d5871d5f5edbfd2ef1193259c145b7b61a0ff226a0819323064c8037164df1aff98b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f18ca3ff097a28e8e48489c288e12e4

SHA1
4af5adf160c4792904f4cecac15050add37617c1

SHA256
23c2f55c5c9956e71b26d1e67b4ec238b5129d1737f70ff775f6c46a84b50256

SHA512
19ab80b5a6bfde2529ff1aeea6d792552e81721c8a6ecf6daecd9a9e201d7121c5f7ada4a30de69e1f9706371cc96b2c650178e5b06c930623dbe2f0ab551c8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
5b56de8f91e4b5b76d748eeb40b06c17

SHA1
ca078cb993899338bc09aade4eaee1c87c174d92

SHA256
d87d498645a2edab270280886433f6f3231c67dad6c8ddabb5a04b24f54b3e23

SHA512
f6dfc217d9d7b9726a653ddd8f390baf582eebac19294a20d209f362e1e42368c2b50cc5e487fbdf2c1cd45af17dbd734fca654c444a9b49301ce19e89dcfd38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPQ313RR\user[1].htm

Filesize
162B

MD5
4f8e702cc244ec5d4de32740c0ecbd97

SHA1
3adb1f02d5b6054de0046e367c1d687b6cdf7aff

SHA256
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

SHA512
21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE37D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE45B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit