0a0bdc949be7f8423139453b2b17d1224fa01911c550ef6e0c5ed60f51b73647

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 04:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9883dbf730475c670ac55ec090a999c_JaffaCakes118.html
Size

3KB
MD5

a9883dbf730475c670ac55ec090a999c
SHA1

1f87d16a7fc095da70aa492adb6503a4cc2d47f2
SHA256

0a0bdc949be7f8423139453b2b17d1224fa01911c550ef6e0c5ed60f51b73647
SHA512

3b2b0be79ad598c1d92612bb75e919cf7e9f825e32970a816f157e2aba1aa3ca11cf18434ec5499649169afa13ef2684250d065fc5f1c0e652f68effb6d8208e

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430202520"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000f7574c3310a16a0ad6c46b380daff2c398459a1d96a2fdd4dc432ea921170b76000000000e8000000002000020000000d936f217a609f1829893694cdac6cc9657275cc47979959350a43e4f7a28f84d90000000487bbd93fd99ce8fcacaa8dedafa7a8ddbfb7d73a76eeafd44182251bd5e76e38da4fb58d6c14293bde6f6211f74d2854d4952c282832e44dc5f0a8caa6646c4dd890ea6ab8b64ed7ecab9a93462fa587d9fd3e0ba695dccd286ccaeb26dcec00b5a6bafabe1aded3aabf64fe11819506390f155b960a799d935ee75b5626bbd03b3b9e34bf3eb783d0c09bd34e25ad9400000001822e1da1b63dcc303a372ef91e4f36c64fb68da9a618e49c60a59344aad806993dc684f2a98fa20a04417db3587eac9c6417ba32eb9041f861f957226655464	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000f54907197544e0ea1b6fa8cbe7064d00f22f34919460f574ced00aa273074c42000000000e8000000002000020000000e2a22ef941b0124c9dcd31685e8b64fd0c60a4a5e5c692d2ed8115cf3cb420572000000069535435bd22b331b4db67bfad3b8e9683085be5d6c8aaa9756e4906095ccd6e40000000965706c4902670143976b8bf2592f60eded98ebd05e123d2c02c1d0315e81c545ce3c2e1d7599b39b6d4ba691c477706a85075eb90f9af86ee93f7da5a6c5c16	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{057DAD91-5DE1-11EF-86A3-DA2B18D38280} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 704d18c8edf1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2564	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2564	iexplore.exe
2564	iexplore.exe
1908	IEXPLORE.EXE
1908	IEXPLORE.EXE
1908	IEXPLORE.EXE
1908	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 1908	2564	iexplore.exe	30
PID 2564 wrote to memory of 1908	2564	iexplore.exe	30
PID 2564 wrote to memory of 1908	2564	iexplore.exe	30
PID 2564 wrote to memory of 1908	2564	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a9883dbf730475c670ac55ec090a999c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2564 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3b755da80e4ea385e184143f2711cd11

SHA1
10b085edcf52b5869b3b0aa9285172c2a288fc31

SHA256
5ab65e80d9af6d25a0a53c03df7d6fb49542fc668efb0fe8c66dff99ab22b7b7

SHA512
670cca6c5fe27fae2d282c4879cc95872987d9a498dc963e10147a5014ba335d54c66d595629a03bf7507696ac82ad9d6460bc768878482f9283709e7494514d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
dd35e2a8b99048fdd4883bc48a3dfd3b

SHA1
1f7e9efaceacf6435a4c6571fab907069cfca484

SHA256
1d8af6c4dca7e722e2bbc9046b4d5510deb31759c98e75e176e71047392447a7

SHA512
b5fee612a570f3a78d339f20f8cd53f3e242ce659914ff821940f147a7a4891d646de6a76f3ce194f0002446450042f688d79e54b0f5c2fcee99392ac9bfc2fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
659b9f04d17d65f6c4c1d4e98125db12

SHA1
b19a78bc701f3dfae08d50953b6d9d16f4ee9020

SHA256
1e16b252245682dbcd423395715fcb7da2de3ba3604014dfcff27d15f12cd079

SHA512
bba8b9081c0c8eac362914248239f1c97cd17aa12466cc1d5a2186e3587b4f351993fd23723daf772e7cebd50f65aebecb4f3643716fa7eb6ae472429d4fc851

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e30e3b356e27fd4acad4e28fe241d01a

SHA1
d349652df6975255899b8153b359e4417e3b6e0a

SHA256
51fd74b785b5b6a83423f6b396a2a141631cd2ca558c9610d29e081ca9252bb3

SHA512
98d3cdd6de0d738bca0e98e4dd09c3687c8a54a497c0166e14d0e8d05b214173c7e8e2a985b35f00fc4a8770fe31b2df601ab0a00541d0cf76486e83575451a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ee1a2a63de899688f4ac979dd42232c5

SHA1
cb3f7a7d37ed15cabf78e1840b3bf6f203eabde9

SHA256
08cf286e204f9ee64534608ea24ae3c161f96708a976ea399cb80c738746ee9a

SHA512
f1365225348e2555ab0982a8cb4ec71a0d563e86291b71b3737e4d9ed7e4eea23f45ae88eec823cf85cbeea23ff79ad0c7baea882f7b4839a72ad1afcd571aad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
53723df6323c6be96ebbd6e542f45c0a

SHA1
a7c595f177ac18bc624058c5332947ea717eb72f

SHA256
773af1f520005080419000877a24790a381482ad2cd66597718478024fe63fc4

SHA512
bd57fb44246cf73bc8b0519cb424c2f60f4e0a7e88198b27db4c364ff03ad9d26730241accc3065c751882af4e368304eca6f9ff7818e5a8524422f7cd05a389

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4287f3c3cf9e84d8b42902e31209f22b

SHA1
11bcc754f3a4a3ac9892b316b762131566be9e6e

SHA256
1ee58d5188483fb6fadf6f87ab8701fb5663f820fbe34a9aefe2165edd0a083f

SHA512
6b59373791a17739c9505ac2e4b383288a1955067a3766c5e099d487725fa7887598243e94852741a63e376f0e7935054acf18617c8ce4e87660b07397264486

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3a63336aba648e32f5e04442087f14bc

SHA1
b542f574d89ab3e72c2d8e0bafb3240806fc1d8d

SHA256
89e2cc7dc1c885d6fce34a0eb06d44411eface155b01bfd609fa0a221b492eae

SHA512
c8178256ae40445f269a5616d45a51d4c5ed5503f64cfd124dc452862d42eaaba99102c255914de97875063b2ae3fca4809ee7b98e4197822b69494e3e0318e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e1cbd398ada9dac5ca076d42d6b92fc1

SHA1
7edc386edd94b954fb98f1d072b2fe501ceda567

SHA256
70f0307ed83a5e536ad7c2c3ab6c517815fbf5f155822c2bd9eedbc32eb700ab

SHA512
f72e88b7625ab00c52992aa8088021263bad02e9fdeb99bc17260108ea17c25f6775c9cc6f21177db3462d3a966ae4984ff19c7b881c93d313eafefa18d7f6aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e74292bd8b9b2a44bd6d9d4259c4ebea

SHA1
2dc494e164904906091afb69a6882a8d80fb08c1

SHA256
6c7d847958dcdf7aa136c6c71047bbd056c098a6776c3330571a5ea6e68cabd0

SHA512
11443826f59f12d99e40789ef8475e8b23f3c663b8afeb8c3020a8649778b7e2157b3bf0b5557924e56428901dd0cfde45f09908bfb6f784ad0388ab79e10a2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
eee14983141eb525c86020151d10d787

SHA1
57c2fe2c042bcec9a195b3fdeb4b7877b1cb9ebb

SHA256
e6f0a947a12f4fa510112a8178641dba32dd7b2e4185f3759b64bb92c22bccc0

SHA512
b0b48c20b6da987ebe002d124b6ae0021f88520b247a7a17c090e1502bedbe2f1894c11f2c051f9e40b5b4982cbc5c87fe305e4b7f485ba591abef2671bb0180

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
bbc151698737232896c9673a224f0ec8

SHA1
546e4356b7463ea0356ce5e3bc2ef67b01d2917f

SHA256
04bdea0c18538af56f3c1f339701f795822694607356cbd5d423018893c72e62

SHA512
49c5639afd1960d69987041855ad541d5c91f8f4ea9922b209359f153c39c819241f8aa89ebb80bacdf8f8c8c82980f465008dea17dcd600bfcbbaa41108cc68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1d60ac8496d84351b4e6dc3e4aff3ec1

SHA1
f2efd1aadaa52d5a0b6a92fe212127dee4b9fba4

SHA256
815a90b6603f6a12837d26072c41401b2688434c1625f12d979b6066758fdd11

SHA512
93d222b2b903ac5491f22920084aa877550f6c527ba5c47774cca9e7ad8b4e42a270dccb70aa02e1ce8572f459056e19cd9b3af051203635e5f66ed32df880c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
fdf93be4fcf20b3a4f5dee40cd29fab8

SHA1
826daf211f69d71350fa855530643096fee355e1

SHA256
379ee55920416bd05bb3a767ce48dce8f3cb30a1725729651d63f679b1d360eb

SHA512
45deae94bef76a454fa6b27a396a2cba4c3c02da3ecdb1e4ec8ce522595c3bada0c7dbb3630e63da9523a8a9b28d1559e0bb15f3f9346a06359b19df903118a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d52165660e808007069ffc8f15304b54

SHA1
5654927333d7c0081ba3248f50887bceb5c72015

SHA256
120c9778e5eeb70481e149084891bfe7cf42bd1380e025b3fa6e8318e5f58488

SHA512
4cb358733e81f0d7efd5e9cc5d21eb0ba0c47ce4771daf73fe50d6131ec001b06c397b80d65cda20c6f7d74be07a75d6ba6a1b1afaf75011e304e80c0e964c82

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD3E4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD4A5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit