20b973325700ae50aebcd252e5e1d991b9d95de177f3172ae1aae426100f096a

Analysis

max time kernel
134s
max time network
132s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 06:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9fea31112463ff4191fb0f840c439ac_JaffaCakes118.html
Size

102KB
MD5

a9fea31112463ff4191fb0f840c439ac
SHA1

cfbcf9f170968e44e8b8b0f3e1d26244295a8744
SHA256

20b973325700ae50aebcd252e5e1d991b9d95de177f3172ae1aae426100f096a
SHA512

24fe6c4ddab575b21ab1e2c3e8e106a688a3a5d1dfd1ac99ceec03917f7296a26b18b893b6818d221b91a324c2f85a01599dcbd06a38959375964d0c25f9fcc7
SSDEEP

1536:e8eR9Z8X0Qm7Hi5XPyvyKYyLkeXPZ2jM6OWxBn8oEzyQ1CGWxLZl50PPR56uM9p0:094s2yvyKYyLkyZqnjrEyZ/0PPf+9p0

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90b3ec9d03f2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430211796"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8B537071-5DF6-11EF-902B-EAA2AC88CDB5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000003f8d2b7a57ff8ddc8ae43d321d92e6b78ac702346bb40613cc7b796f8f2284bd000000000e80000000020000200000001e6e544b23905270300e5ecee59ffa327d8f7b25eea49cd132c594af227f153620000000fe2d0c2d5ba36cf2e496782b94896709b5c3de37c3ed70f29b1dc64abcab4ff140000000d270b0e8dc981315ec4f0ba0870f3fb12fe9c275962077ffa80cc60159397ad45c15938defff10568becba787c777d7b21812041d671356f74375d2987bd1be4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000002de0478dd734e80bfa1df47809080d69df1519f252140a5e09d5c747400390a0000000000e8000000002000020000000f49923963b76c93b9cb8c3fa45637297a0ba016d780654d73fceab16945e83a1900000005978a6fe135932c1c8b96086b5c00967a10f9d2cd2856ec190f1d39cb7fb7e227748880cb7bdee0d594ba530466bc8c73a565d4d13726692e1212d6c9a68fdfb77c255318916b72e330bf7fbc1287590af02bff75b451e219419b7381c609afa1118e857c940411862097c0a1f5a135aab7b535ff66fdee594367235377a59fba09b1a8f03996cfbd8882f1387d8c89540000000d1a8c69bf6343d7a658b2cd1c1b5ef14646f3ad04c3c56e269371cc7737975e4932509225b0458774705be8097fbd53e285fb5d9209db5630c2d4fb3b97a1e2e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2524	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2524	iexplore.exe
2524	iexplore.exe
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2148	2524	iexplore.exe	29
PID 2524 wrote to memory of 2148	2524	iexplore.exe	29
PID 2524 wrote to memory of 2148	2524	iexplore.exe	29
PID 2524 wrote to memory of 2148	2524	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a9fea31112463ff4191fb0f840c439ac_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2524 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b47be68a2f404a46ff2c54da5fd7da74

SHA1
f349a6682a92c139943db2f771abea70cd2850a0

SHA256
4541bbb5b3c9ba8ab35173c96eb78815563f5428a31771553b79187abe5bb67e

SHA512
a05a82ddb9eb4d6b58a1b789600fd9f1916d943b3c1eae4c4732caad30fb7897e1bfbc37dc90efe2dcb5359081f24248e403cd183d1ab0f7f76a578c808d6a55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
057ebfb5d023e9cfebfa51cda8696a99

SHA1
7ca02b5b4ef209e1f3f88fd77923a9d280b96790

SHA256
17612a1cd92e0a64b75eb874761eb8b8af63ab32f29e68a959be66ec592601fd

SHA512
5772be95a548dd2104f75245caa83553ccb67107e5c8f453ae0b154c69a56d7c6849300627a90061c954a3e239dbcf193a09c358b0fb4f71a06055db2a3433cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61a47ed84ecfe5ef88a165e67d9b6dca

SHA1
171ac7604378758b461cb6c1f5c379836485c76a

SHA256
62aabc94b71d2d9bcf911f59ff1ef96c3795418a1c5dd69b0acd3c1cfe820204

SHA512
61bfbdf1c939d6ec4dc6b738c85a1868e04d05be0b057e40579a7998fc8e949468bccbecd72656b6884a5849b364bbeaf6d9b4d7c42dd0ef008dfa9c97e66cee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3bbc5a1a6ffb4ae684ec1dfa1aadd071

SHA1
b246a652bc264ed713100fa6801a5c0ec618526e

SHA256
b3eaa57c0d95c75076904c98eb6e1d8f24bbcae46b1b09873e74ca4cf9b5fc83

SHA512
b71149551982d7093fe154f7c390f360a424fa6ef8f3ef3eb816f3b2c67dc76ee4c69774f7e17e8c64f263172975439089dff0c77cc866b2e049bf3ed280b681

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6bea4ca425e87d69f4c1c5fc498fd8d

SHA1
d4cbdab54751d74ee9f4525af5c53e2748e9a364

SHA256
845bad64979fc8bdd7933bc764f9a805aaa23ef8434dfa6aa26dba42c684d126

SHA512
9e00fa51ec147c96056777f205cdcd095fbd592fedf9f47380ecea0626163446f8e0fea7246e2599b91640a153cfd419f234a77ccce9370b59f90cb9a244346e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c954609f1cb936e6eef283a07583111e

SHA1
f1758b8813f83ab2d620a9b412f55c4670db72ef

SHA256
97f7fa660d5818c23877603e7ff9c5486286f8b636c47ba8ea0822b7ebe051ed

SHA512
a21ee0a63312ccf7feb1827da26e86d0f0a09908e3f6c2f32127d23a1845b2d1b8bcd5e213a05490a0fc3875c62cdd5c6b630de25422488f002d22165abec905

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68e4e332463cf115d9721e5a0e7eb4b4

SHA1
cc658b3046738dd6fa1bfa32c78b2b3a23e91269

SHA256
720aef6d4f816706743586b9da5f1caa0fdace264b75b27adbbad609ad529e8d

SHA512
4bdaf586b78d7f3850176853abdb495200c5d6ae07f844e6e90a754175ba112d973f95ed2d3db82bba765b7a80c6db53089bcc486454485cdde4fee84230b320

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
176628447b9a391069e8374dea561cc9

SHA1
be36f10f89941ba9210ff1ed4e830c23e6e7c6ba

SHA256
dca737869c539c2d421b3406ef1711c2d4dc10e2ff87bd06c78816536d5f46b0

SHA512
9cc98b5eb5c5a426fecd0d00b0c8f65023573493955a8a5fa284ccc3d9ffe2c9b5fd109e2887f4a72411726f7bb2836b0625942c9805743fa311c55cb5eb74ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
834cc89b10f920262b2f4839c9577314

SHA1
bbc788439003cee4ea451447a99031d2cef2b86e

SHA256
a432843d894b3f16628ef0df58612c212a8a1c7a07d2a08727172dd4a3edb5e6

SHA512
a7a671b5addc6e05f97b398cace6e86c3cd22420f8844e9c09a5a34d877c01960fc84e2e26ebb521c65ec25787e266e0ba98890d4aa8d21d7e571229130ec606

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
804a1530aa2c305fcd1bf281c5bed4e6

SHA1
914f0c17e2b193f069d1f4829aacc4f7fad57578

SHA256
e89aa7115e6f7039772237aa836feda15e63c473f8fa86675587c1e358ea25d3

SHA512
3b266e4496ab746b753f81368181f36eba902a91e0fd5b41487165a943b12e2df5aee66741a9e161a64c4a76316220832faf6b2ac634e3bf6e9b4535c5999721

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab711D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar75A2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit