1c3f6814d05f40f514d35514d493896150a6be8ef9c53f5e51903a8ce4c22035

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 02:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a93990da14283dd62c3cb0289dbe1921_JaffaCakes118.html
Size

4KB
MD5

a93990da14283dd62c3cb0289dbe1921
SHA1

a78f91ab631dd7ee59600b0ae8c5568201e79631
SHA256

1c3f6814d05f40f514d35514d493896150a6be8ef9c53f5e51903a8ce4c22035
SHA512

aff72e6e22e9ed4d4ba8689abdf315ad8faae9ff4203bb6ed99fa0465d886f1d134b2287bb39fcad450b646eee1d3b613b62b5c60f4ee3af3644e5702ea6f09a
SSDEEP

96:ExlXYbaTPEf1fcf/XQtfifof0XNCyflYp0XzoGkfl1f9tfXAoDPQimPf5fMYAmp0:4XjTNC4hk/DPQDmC7zSPMUPZYE

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0279fcadff1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F5F5E941-5DD2-11EF-9874-7AEB201C29E3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000304e5455ea2c32afb02b5dc6191d1d560dd893344eb1a2aeb36820945e478dc2000000000e80000000020000200000002cd759d8ed24c0d6a234839beca7643688e1a1c0e05f28495ad35f3a218f7058900000000127c982986f7e14ba6d5dd22fd657f2b0182bf4b5e441bd31be877d846e402685aa759e60cd63f209535fa86f2cd4278e6a95b9cb24f29f7f7b0e1c097531191d536f58c71b4014c4b4aeca8e5bee0dc024f735e576adb1fcb7813cc44aad84ec1417cd7ecf5b4c9cd4aeadc4e8cdd427f817e2dda33ce7fe4f76ac01aa3fcd380a9bf3172c255c1abe4e79fba3cef040000000b59ea6c70443feae9e79e2d0ec6b6649c419021e338792e04727a5e6107cd9e4c9bb6b4299a279a0448a89c2fe04d93584e9c6f87d179c5816b74832567fd125	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430196480"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000d438ab9d6c6c5e2d490bda0076bfdbff82611f3f7c507f934ee59fb7cbdb99af000000000e8000000002000020000000b4ede030626f92bc608d952572be8daa92ac116a7bc3e4d468ec0533f509a4a2200000007cfa43a7942a4aee28a3b78fe43d4559f7beeb9b9f18bc67975c3da8c75a42f04000000039d082a159b46a76cf977819943226ae3cb599a83b65c924619a1f6ab7ab6b3f05305dc7a2656077c56517669ee34ab66715c204433af5b60db5cdb8d1085125	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1772	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1772	iexplore.exe
1772	iexplore.exe
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 2060	1772	iexplore.exe	29
PID 1772 wrote to memory of 2060	1772	iexplore.exe	29
PID 1772 wrote to memory of 2060	1772	iexplore.exe	29
PID 1772 wrote to memory of 2060	1772	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a93990da14283dd62c3cb0289dbe1921_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1772 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f93fd6de7dd89d550f5525ce4edc951

SHA1
e2c0eae2199cd0f10fc72d428ca7c34a01d15272

SHA256
a178960e0ae1a4f1906b14c4db817f15fabf38404dd49c91cf592dcf39d23ccb

SHA512
25bef0862ab8b66c78b1b09e4000bad4bf0550119359255f605a05da563995f028bb5b6f1eae7d7163c1a695ab80475a549f3ac82ccc77da795e7e255c8b350f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3a41d4539eb66d44006533b1e1db81d

SHA1
2e5ca5a73cba33c12b532ddba2a13cd60b43d8b7

SHA256
8ea3a0a5bb8030a32e154128a9ba21e67b841a5443f016f7916eab1fc3d5b34c

SHA512
70cccf91cf56f5d73d2d0968e483cbf9945be587950ea0efe3ae050a9138d4daa2fbb6113eed0f61f75d5db603e76da467f560cb6fe5782ff364b5ff9bf7e231

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad177d9730edbc854f227801a752d38b

SHA1
2be97b0d5dfb5c30d8735936eadcfe5d695b3c82

SHA256
258376fa197d1029a03b88d7c4eff17a30551c5863fa17dfc80b9d57a9a6b949

SHA512
c2d1ec9a526fdf588db7c345f695ed36902958f0b00837c51a90aa1088ac13527f564f1edd27eb4f0349c5cbbbe3e9c208f1c8699a96f247013329f4a2ea6ff8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d1b33a38efd24cc4e85ad23045ba8ed

SHA1
1d0b5a3aa9498bf29fd925589b6a9e3a1c47c4d1

SHA256
c0f3b78dc533b4e3db08ce02985c6aed5c210490a6d5f0446f416bd23de27cfe

SHA512
bc302cb74ab99a17ff0c4b443e5a42262b02e472e38bc9c1044c81331c23ba48ab320a8d4709d22aa8b68797eb76e1dd606945211181dd6b8091555dc923ed08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9681742c635215695809142f7d43f60c

SHA1
115837cbac2f6ad8b81987558605a174f29bb842

SHA256
19297496e4af3b0a063ff543ec99b82911306b1562dbc5c74e90d476dd441649

SHA512
f5df0f4ff04815ba32ebf65a9e74e4d646b4f24794cd617ba4bbd740acf48462fad3c84c95e4edaf95ba06e1e8a52352edf8403089e3a1d1876735c04768a76b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83de39b3381090cf430c5fecdb425941

SHA1
9440f25bd79099e772bd3d282166a90ed3eb98f6

SHA256
b2d6231311cfde25dcb2bcf52a201446bbf2c8e19c10590636a65c698b55df34

SHA512
354641129de953f399087f5cae6c0c1600e5409c4e255c5394a4a4d0954cb9614eac93a4fee7885c839b588908d7695702cc90721e471d7ee596da7f89685904

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
524c16083d725c1f3ff3b083713f60a9

SHA1
92d70f11c03bc6c865866d715f87aa7662fb3705

SHA256
244ec7c1e2c9e0c09cd3b2c7afe10e19d52138b41acc3d3e54baddba353f1850

SHA512
e248585373ff9d59e8daf079582f83d44fa0f75e3eee22b87b7304983dd49081708fab8ae13bff590c77f63e368e84b2612833f2445cf4b5d276c3a855014351

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6aedd6dc761061486f6432f5a4c5d686

SHA1
f8205366fb022b6e1ccb2a72ee591fbaaa9ae01d

SHA256
2fbf801c189b847251b9f43bf7f2ca820cac0f04e53c74311633ad36a7790bc4

SHA512
3e343b3828d440811d70886e92f4d453ed4a4e48868879e1c552e6b916f993c9ecda0877dad1928b7846706b22d735c40c2b57a8fb1ba533ade6b200cf0ee305

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70699097c79c07221bdb00751d9abb98

SHA1
aaad61fa5d90568f7c470dbd15649803d9618718

SHA256
4b2e520b946ccf4b2e40211927133abd2978c8a526e61354c1cdc756cb6b83d7

SHA512
63de2b4fd046ec7955449d4d2f1a582a6c56c882501efeeb3d16898045ebd3aba5bcf8f6002ac89aa1d9fe8464361183b17f05c2b8d7b2369dc87fce5eae28ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b302deb7657e61630886e997a83b911d

SHA1
d4065be86a42fc323509830162cae592e2523909

SHA256
b8d396f06988e097a911ba552004ec01c62adfbaa78d3838dff0a98856d25d49

SHA512
3fdef90f09e16372778e06e3dae4d3770e1d47fbe0e891811d93f7ad74e0e90e940967b351ea2d3bcf63d527f3c12fc69e351543bfc1211e02f4453612d867de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f912601a6d46f8276e11725b102b68ca

SHA1
5a8a13767781356eb7d57632c0fa305581ccd3a1

SHA256
830f5ee11f355a1ed37ebd5ac5fe11c91fd8d43ce30185d225ec6f51bb214c58

SHA512
0402be1c80f097cf80a89bd9a743c864a4659b7154e1755e6eb05fd10904034e217287dcdabb94d69ab5a50a5035a161f9de53c35312f293c3b0eeb50b292b49

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab149D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar156A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit