3e5c828b4e1a9c1261a664b3c3a44d37e7495b457ddd7ad3a880ecc785d916dd

Analysis

max time kernel
134s
max time network
134s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 03:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a95bc44cbf8a6bb821f4937636cdf5aa_JaffaCakes118.html
Size

27KB
MD5

a95bc44cbf8a6bb821f4937636cdf5aa
SHA1

274ad58dbe2bed283cbd8ac2b344acad9bd53c47
SHA256

3e5c828b4e1a9c1261a664b3c3a44d37e7495b457ddd7ad3a880ecc785d916dd
SHA512

7019fd5a33fd7abdfa2bcc758b28ddaa9b83f5a8dd6126801d090bde24b62b780c691fc86a4afadd585683db6712c7927f108a8c1340b7d9e2e9b0adc7407b9b
SSDEEP

384:4CiRagQ4pAS9qgtgcVfrqLFtxwRagQ4pAS9qgtgcVfrqLFtx2:4CyQqFbXrqL/xsQqFbXrqL/x2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0575ed7e5f1da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430199081"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000a91d5c4bef84ceeeb9e1269675664bc7a81da8841eb3c96adc6709f9f57c7437000000000e800000000200002000000061da50130e1518f060c4c6bacbe76440996b2ee6a767928ea6d93a32bf76fb1e900000008cd315f770657c480f473da966dff16943a5168499a85240514723c71cc231df342b67b05f47fa3b29cfcaf3cd64a4878b955d426501bae89034b148245bbdae93b2887111cc56313d76167d7f7a4d98c17a881ca0a770efb4e778dab1d201f3cca305e878dfb0ed0472fd9f882e7420431d47ceeaa08ec8bd9c6a76c17926f21f91ee03d2ff2adf4f71d5e5f574be08400000009913f390c30a7d020b620943ce790dad2083aff03866dd4dcbe081b195b51c6854e294f8079211cdd5a965d5feb761a12a7715f89e408dbe99ba07c5e55c5d45	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0253A7D1-5DD9-11EF-BD32-F6C828CC4EA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000008d4a49299708e345aba0c16a4e5d8961d9d79cff8b58656714afdc5fab26b3fc000000000e8000000002000020000000cfb92e39a7e63b5f5aa5f055204ab21ac4d6caa725d32440a7f9b092998657df2000000007d6a064adde2214a5a7f5abc4d6aca9ff4eeda50297a489a03488820bbeefc740000000ab15b7e5643be56f6e7d4057c55a2e2dee74b73174939d89c9ae10ed44e3cda21c5a79100deb8a532972fc89e75e517e1fa51b8a123e6fa2ffb86ab8069277f3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3024	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3024	iexplore.exe
3024	iexplore.exe
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2236	3024	iexplore.exe	30
PID 3024 wrote to memory of 2236	3024	iexplore.exe	30
PID 3024 wrote to memory of 2236	3024	iexplore.exe	30
PID 3024 wrote to memory of 2236	3024	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a95bc44cbf8a6bb821f4937636cdf5aa_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce0a0c8b4d985370786030e31b7cc086

SHA1
ffa63faf49041380c61bcdb1789f26871e3f00a4

SHA256
309c9a4e620523817b6a292c2120cfe59b9099060432f0888805729c5e4b3d8a

SHA512
1b83b3232b0551d973dc502fc7be92ba63a9420c94e139d908e230b05006f72efeaa219dac0f4410fc1022bf660d3a98f40a914571b28967e1eaa346bd93364a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90dfdfc95bb3c2233e6fcdf7b72c02ba

SHA1
6e8e4e72718e2ad4f9ea58e5ef9439b060feaff6

SHA256
d42731a061fe50b4b31661887bc95cb5eb931bcbed194e3ad2252001f0b218e5

SHA512
2b28849469c18dc7bd540f006bf2c74ac863e17c7119984d6469f45acbc231addae1b8378237c3ce7ee6325e45da660b1c3778716e98867b5325e1aa0f532552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9834835f6516a2f7a4037787edd5b7f9

SHA1
ffb933b39a5301157e16e3e9c4fbcbc08206c094

SHA256
cd024eafbc4e8147b626fb35f687dff7d83670e16c7c7281ed9782051b7f618c

SHA512
0ba2d29bf56970562e2e3c94fe85cde63aec08d1bf863500408be1709552a57f2f058d1a6f3dc39acb30a17bf6aed33a5e76e8734ce3728961da1e6c346119b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6563517c520b640a4743225191fce3f6

SHA1
4cbc318e7434c7b481a483a988df6d754d90d2ce

SHA256
4ffae7f748c685b7686de3ba68d9daf290f83107fc738f0778f7acd166fb8b15

SHA512
8b0645b2cf2550daeb6c682a1fb850df079e7813316189223e6ccbc3b378af05568be7171df15889db7a575a65ddc2fcf31c0cf6d919fce3163d33ed5062ff7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d77de4ff5f3872511098fff89a247ddd

SHA1
644c0b8dfcbfa5f741e393b0fd789e363b9f38ba

SHA256
55492f0de88b3129ecfda2ae354ee888de1bd151f429a498caaf7e29e76a47d4

SHA512
b98ff31c67b718c1be7053eaf3b3aa17f41907bf686b61c13544ababe7e7af5ecc61fd06db63a12fa11738c17841aacea51987f942e8b862f368215de2fc8739

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e9b24e6cc80535cf38104ff9074699a

SHA1
7ca95c50d2a5cace1354f5cab0b31375a4a80e15

SHA256
69c79ecee32f8944532eb1ff6e073da55f85bdee816a3019aab0fd98f833dcdb

SHA512
f72f39689b769e8d77d8ec0e2d11df8187a1f1fcb58f0ad6a0f47a961a98da6ce054642f16137633b634a4f7907827109f221e9e414134a710cf9c2988f5b160

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0fed8ca0c80fa6464930b85bbeed1dba

SHA1
ffead583b2b944db36bce12085142c95befadf45

SHA256
fe0e00cee3cca32476549224ce6ef2983b8b9e206ed10496e948cf0bae72652c

SHA512
fe599477a5a9a2d8e4a11700c5431b81b880324cc49e35a04583dd68d81f9d2c03b7cb3488dded721f7bcdcede84090372ba448e5debfdca4f6d7c149e01e558

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4318ded9b53b987df4a1783d53730ce6

SHA1
37f3e2213fef978e738eccad0e10b2bd9828b8aa

SHA256
033ee890be53cb23464ea4e2c7d0ccb6d7b04a7bb6c09666ec36774dc0089599

SHA512
1d0b5ec05185821fb60c4dd635961ec3c3ad4d00d4713906cf59efb48e9abed7a7b428b9581a578e9bd6cfc1ed9b9424fa8db996f74d66a527d199d1f56bd6f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
581670afa6bc8e53934930337bbbd1be

SHA1
509447f77ab6196ad4d9ebb96ef1002f38d5bdeb

SHA256
df09293f8e239005bfcca6e1341c0a08f9053f01aad37a816c18bea7e9ad2b39

SHA512
c6c4b2df0dda5de1bdecdf40492b800d8b5a239dfe7ebef58a588f3b06a8eca86e8238e9f3758643c5090a9980066f265c8aca104364fea5b786866f7ad3aae0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93301a3ec70a2bdb879601a162015d76

SHA1
e7c050fb61921827e4b83a70ac36f75acbb97eb3

SHA256
b20b4ff74f8d5a3d3257dc731b5322f1091e2b23bb65219459222fb149f9e58c

SHA512
87a479b031ac65c153ed8930c034fe4d113daa261478525f7fc11b9c5a8859f5daa6de5627241f9ee55389f032ed29497f8d6ebfbeae30fd278cd9f9d004d0c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
876b6837a704325b66515cdd71b21356

SHA1
a117da74fdd57caba6ed5a150a56956432e0e890

SHA256
c7a08af9086e8d6ef8c02154ff2aaf0d4d551b973ad46f1a801130c17b9f1b6b

SHA512
d2f3354548112f07d74361a18ed910e0f7a9c61abb0f23e7ec73a8989b7c2de93a5809307a2644714b7fea1226ae4ae7bdfe3996b3fc34e45b771f9e2d0a565d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d658ff157917f8a5125137ba31691d38

SHA1
9b64af4a78f7aecc1b3928ada49650f6418d00b8

SHA256
d4981d8e0de56d7dce5ba5a728b6ad9d929fd0e61130e414eaccf501730e5693

SHA512
d7793cc419279caadcd3cdfb185f5478f86cd7257fece216d611e7a3a474e64fdecb9273c983831636f268d2700faffd3e298504c55036d398a7577e0e5e4a9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f55bbe1b267d8174b657358d0b90ff79

SHA1
bd8c78efa736b3a0d717dacbe17ee2049f72d9af

SHA256
442f1965e9469c346929672f7fee599e7bda053184f059caae2299097093185d

SHA512
8ebd2aa03cac1d9024e27024db35d287a10ade9df67da4e1e453e911bfa82b1925e6c06c4ec190ad4d79aca81578d6988454f00a668abc5bc01aa7c0dc0220f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa6865f05d4588c4d6f2ddb531808878

SHA1
c1d4c6c99000a3186f3e09667fc7735aeb1873a7

SHA256
8d82a86b7d096c0642ab9f58f2fac17fca18adbb2d7f4c49bda3d521a23f06fe

SHA512
f3c73f73b573495dc22ff16c713021f3db8210d4bb11a55e8ff9c0ba8887e96c240eb390b12d90a001ef10d8967431d1006b266f62eb788a200e8d22e32b8a1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB59B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB65A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit