591063c126ae71e7638dbd09799c50f660f4c5f54ec6b3e9877a5efb126cb4d2

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 06:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9dd5420026ffffa5f76e4e966185a35_JaffaCakes118.html
Size

3KB
MD5

a9dd5420026ffffa5f76e4e966185a35
SHA1

33cd50e88c00af079eb7516fa74d26ca1441fa49
SHA256

591063c126ae71e7638dbd09799c50f660f4c5f54ec6b3e9877a5efb126cb4d2
SHA512

38391a5f32e94f003e4c362096a3fdc280afa9105cb61bb9f7326770f5b14d7e65c106dbbf276550a3e2bbdee4c92146160e26efe1275786c4ac630fd6603742

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000fa3046d4ea4ffe8ed3f83fb2b38d444fa6d60cd1cd6f7d870f3746ced082cb17000000000e80000000020000200000000e53e23cfdf0e735d0938a246dd9cb3dde9185d732df682292b95ab769bf360390000000b537f61a976c7db7b2c8d6af14bbeeb97d9a32fe4d1d21f4a02efddc791161c8483f4382c69d7b0d713b048df487ef400eac76fb8ebd91eae2ab8affab585c2410f551e1c8f3729c22f478b65a48783de4112e218a7de5cfa10d8e09a45748404779bf838b9012213a2f9f5219547ce9f567d19c85e59dd7524e13788fe5d7c83d920127aa3fc236df228e8abee55a6940000000f6d84d42655a85a8336d9c56b694e592dd8a03206c4c14f9a3e32f40b40fbd5ed4ad932c698f6d60c058bd5e8ef45ddf0e07bf29ddeb5c3bcfae86038b5e2813	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000007dd27bb3c94169c86d9f442e34347db4891603d9cb08e4783f396bcb9afe4c9e000000000e8000000002000020000000bb5ab3bfcc12a6112cfa66a070a00fcd2c5034af40b331d7ca8b9955c2e1667220000000b2866fdf92ca357e5b4149702f2b073c374e751d3c151fb616508507e5f0e3d140000000d205dec4568d4b151d6d48d78af79789116286aaf6297323aa09acd7ed204ea89b6fbc96ea6a4bda849d42002f282fbd059ca32477b7eb6487f1103e755513bb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7ED97F21-5DF0-11EF-8E54-C2CBA339777F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430209165"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 306f8f41fdf1da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2700	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2700	iexplore.exe
2700	iexplore.exe
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2696	2700	iexplore.exe	30
PID 2700 wrote to memory of 2696	2700	iexplore.exe	30
PID 2700 wrote to memory of 2696	2700	iexplore.exe	30
PID 2700 wrote to memory of 2696	2700	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a9dd5420026ffffa5f76e4e966185a35_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2700 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15fc3af521c98b23796e60d1b9e3046f

SHA1
5809acc060ff606e7a9e715cee37d9c69c256cc0

SHA256
fd53f8aff871a7d15fe53908e2ef090123177df0430fd7b19f0f320d118804ed

SHA512
61ad61a2853d3e829227291b15d7b0be12bd0d8a5f2459655191728beb2e34c8a0e9da0edc14f4a13f2cb70a76259f16ff0ff1dacb81bbd31de8363af36857cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e46956a249ca116dbafaa885dc44f9b7

SHA1
e3d6d4594f93640ae79f3dd9200f13fce3414f93

SHA256
251d23d22feab72e9aa1101b16a1d1ea53cb987255c262d3cde0a7833d921091

SHA512
9621f80b2467d1fbea8654944aa2efe01d505e61dc4118135796571a10db50979ddd35e5fb9356b170c8483da58dd99a3a865ac5ab0f8794b242bd679efdfcef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67588228a7413a11324a71eac260b6e8

SHA1
75c367623d3db501cbb5bd2e780b2fbe0edb068b

SHA256
438187b5c77286aa69b7ad0a051c18dffc95b8cdfc3c7bff0ca55ca814d851d4

SHA512
7bc36f2a1d699fd401246c5c955dce4033a6d0eddad4569cc9ac1f5e47ba8b5e1ef1104c9ab1596b985d0c26ae3f38e3d77e607c7c5af2e4b20932d43c8fb370

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30bce79367d387a5ef9fe3f0d49c0a63

SHA1
3806d8c574362a88a311c79ce8f3a32446e5df7b

SHA256
da44e1bcc93d9de85b7c53fb66d065f09588afcd4b0bd1e0cbb6701ac30cc148

SHA512
4bd6f2e56a17ba86bb45c4c8f350736f341088c0bc01981e6d88cdc8376932d1b07db8554d20c6bb7e52b4f8ef766cfe884c3e3fd3a3a626cca2f60a4387d624

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f66c52e330f091e14139298a91352627

SHA1
f3ee925814b3d9b97ad0d19fa9de80bb5145f43b

SHA256
b76212fac1431feebc766ec800ac53672ab2fcc318cf97032b7dcc6e7e634ab9

SHA512
0ced5a1ad5c17a7bfce89f42db8446568ec60c69fcf3040dd18818fd83fbaacbb15e3664b8201e42636355dda5ac9503d268264ca130aa176ec3a0bd652944b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
133c284176fad16a0806499f15c3e7a5

SHA1
12d5da78b33086e97f7b482d60572a1bae32ce99

SHA256
c6565d3e93b0887ee56a293d6d693e1c29cea8000556e31fce060b8b0757699e

SHA512
61cc4a6cca7ed69a667412eb368cda0fc4378246ea9e1830af6cc1f5fa03a4ae4669597bed32dcc4e8beb8c321a3416e56e0188b1d1b4d4d580d12fccc08407f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bba13998c039ae5278dd93287cc0fff9

SHA1
e89dd1f8590b20258bb341aba6e1799aa6d8abe0

SHA256
dfe1624e2cbe66a7b87d6e092f2f909f31a09c4d767708f64eca16903a908660

SHA512
b022d1460501489cc769c6cb9ebbe0649d5eba1ad5148dd3a443cd3f876b55a52ec39aed5f0d60434e5e46342f543c064e443e192e4fd3198340f5d019989fa8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0359e3048d22f0f6c28295739c5e41b3

SHA1
04ea93c8052aeed0739db725cb40a730f0bf8d04

SHA256
1a6acb06285c7d3fbb7535be872c562644a4e8e474a459a94f0fe8e56b6dc51c

SHA512
871cdae3898d9b55ffb118d5e735d0cad61b34aacc67db2b3733e302ffa2c11cec0b3265849b4bb0cef4eda2f43640949a4b8f97dc228276915d7b79403070c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3990745cf26c14780630328d7eb2333d

SHA1
f70ca325f7efcad5561d4c4a4ce4ddbcf492449d

SHA256
320feaca276e0933227131548595d150306c0dae7819c1df29ee4b30f3132de3

SHA512
d3afca682b173f7b25aec8171e88e3b2b25d7c9fadfe8d92f3c41e2510a7899a2b9f2f3a692b839fee6ec76a5c12f88ba80033ce494dd1d817f94dd91d0b3b09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
269aa3d647821c76b943b3ff4ad28bbc

SHA1
4a7c6d18ee016edad7fd6514feebc7ce01a8a64a

SHA256
7d735c8ee2482f173b30f2534361cb45f21b2a00654380177a64a4310560db2c

SHA512
fb2680553d9356074e2cdf3a59a152df2503b3f68064f207523573063c8407870610a6389780169cb7a5e9a66cfa1a83feed3222ccd4f69a9e045cb4ae5635d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30103e96e46fc1c3fc4434efe7bc9815

SHA1
97fd13dbb2d2d5df1720eeec65e642e9eb651cc3

SHA256
9e88a6d7027cd11fddfcf91ea392ff591d0f8433bf92e1f94449b579c2986c0e

SHA512
0a2183278777bcdb4fc29277a81c30e1a4f4a3e7a0e3ea2b7849961e509deb66cce59e1e39146a854a1e3554290df943a2d0f1f7ba6004fbda0bb462161f25b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3ce7cc1bbfa85224b57d0a475526010

SHA1
c1848a31e8ba06a7b12f7948177607d482ef02bd

SHA256
836ac741da4458b2a8dc255b2bbf8ed4c3150efc9b2ece7e90242151cc9d5c07

SHA512
ebfe7929b8f14e911f2f298cd20d7418880c1e9a35dbfb3f220cb406cbff4dd83742309170ec188f7bea45e4270ca419c4566cc426033f3db1b666dddadcbfdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4175.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar42E0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit