5c2627df9c06dd9f9e9f3c71e3821b5f6f8e5ba354d11f68b2fa533c57fcc49a

Analysis

max time kernel
76s
max time network
127s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 07:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa33d1fbf423cede5c362d2bd84e6430_JaffaCakes118.html
Size

53KB
MD5

aa33d1fbf423cede5c362d2bd84e6430
SHA1

29dee91bf7cfe39c9f0740211dade1220e639cfa
SHA256

5c2627df9c06dd9f9e9f3c71e3821b5f6f8e5ba354d11f68b2fa533c57fcc49a
SHA512

ae0d959f05d443b8784f8f502fd8a0416cbf63a075c196125bc2b56f287faae4d200deb6a2de86b8f33d0a9c039e8f4b3fa85028c8c9d3d036a340eb3ff9acd7
SSDEEP

1536:CkgUiIakTqGivi+PyUIrunlYE63Nj+q5VyvR0w2AzTICbbLo9/t9M/dNwIUEDmDx:CkgUiIakTqGivi+PyUIrunlYE63Nj+qR

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430216206"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0d7e4b90df2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E3A06F81-5E00-11EF-A641-5E10E05FA61A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000deb80fa139e30263939544e2f12871b695a9dd9be41d66804d94227e0a1f63e4000000000e8000000002000020000000a1ec3e28da8ee15207a593a483b340a8f7b821d41c3675b0ab923c7992d1c29b900000003288afba1c12bb1de83b5bf9c7cc1522c06c8c24f1da0588ee723d1d16d2ae639b98eb2e3ce7c3c7fa0a0037e2e3b79123040b88b362e7afa95bd0bb9a10280219d2b533a15799e4f79013c9e10a2d8842cd4bbc0704602f91620bdb0161a50dbd5d6c05dc6a2d59fc2aa5ef009f74ca70947cd2eb1a9ea851a656e382bed8e40a1113d6c28af06ee6f6d0c94e75d067400000000592131d79f090b5114126e8d5212f3579c04fef11a9212690a2bed6c7779c1efa85a7c681d95fcf8ffe9a182a42b58914074c1f1bb9d39e0967c862fbcf6190	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000f18d58bb240f1f8d7548889643ff8acba3e4cb85f2e08ef2b56250a3010c6a45000000000e80000000020000200000005d4977828b718e39401ee75741ba06dc8b3777454dd7cbbdb29678e6b0f6ddb5200000005252e9b6f1f6beb397c1ac945eda2ef623127a1269312a91e3638fdd0bb81cff4000000048db550a7b7bbae92788864a043b2f1808698f692effd4a8a0717c988f577fd522a76295e245cc6ba2261ccdef3a5b3bad7693cecff9587ab03b6dd2059b4a89	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1172	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1172	iexplore.exe
1172	iexplore.exe
2104	IEXPLORE.EXE
2104	IEXPLORE.EXE
2104	IEXPLORE.EXE
2104	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 2104	1172	iexplore.exe	30
PID 1172 wrote to memory of 2104	1172	iexplore.exe	30
PID 1172 wrote to memory of 2104	1172	iexplore.exe	30
PID 1172 wrote to memory of 2104	1172	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aa33d1fbf423cede5c362d2bd84e6430_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1172 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
556a7708c082c3d0007e5b6eee52c409

SHA1
f1efb4e3261974d584888caf9dd9ee406cf70553

SHA256
9d1f0c9427306373ea090f10eeebe9bc1d9066c38f3c5f84c7b2b8786f02b7a2

SHA512
f3ee78a77e487a32d02bf7c84ec8c32d5de9100a4e6026e2fafa475f6d20888303d81aec154237bec38d93aafb14e13f6e73b3f7b15f5b27b90dd6d70e9ca6cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64ddbf2934afb2a6384bbaa184c0f5a0

SHA1
39cda6bcf568a75c5ae41aea7c5148ad9499a292

SHA256
aa9805080c329db02193e1d7fdb3147bf6e93b236c1d4d855164304e5061bf29

SHA512
e8542556ebe91f8fbded816c430b82aab70e653b04ebcf3e1fc447da5ee06afb216e939403a1b6408bde178231b2a71082f0fbabd3627fc6d7275193bf233d0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
062c6d140bf0296b670c7c99080b51a1

SHA1
7e31b00499c2f2017a40a97b50e276356f80246a

SHA256
bee6f117c4de4b502041f1e1556e2b01d0493f19a976755cdc004a7a1de406e1

SHA512
6589f87f458c31be26030d4a092cc76dfb2aacec13e28412dd6c012b3a2c8ad4e66356cc29c7c04185542033e60f65ad44024ef4cf729e7c944b41a0f5e2a801

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9b13dd1899fa5ee31b23be102944595

SHA1
069701d6eac87dc3013f7ede8308d5033aa61bc8

SHA256
9959ed5b7b91d5d042d00f14c339bdf225c468050536055c265266175600ad4e

SHA512
a0436b54a4c4fe1cd6ece46078493c2a1be1ceab3d5b1d38463a0b4d6c8639425ed9479740a1199fa80e28ea5f90884e417b3ad99dc52e95bc653a98595daf6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f22bee34845ae47118fc12357eee2ae4

SHA1
33badfb8f5456d3be7cce38f49c345afd2fb744b

SHA256
5c1153109d8978d745faa062e9cbd520cf5e3ab09a1417ea9ebf8046488d061b

SHA512
0a133e70ee74d8b44362040ac9dee674eca99fd08dfa0c0bce7f1d81c04279b6c44e757fd1fe7ce7b5427ce2de054ded9bd76c0e53fe6c7f876c3b3202c58dd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64fe15edb0095866b6ac4b99b2c2f37a

SHA1
432da786c08a611eb561848a5083e4043dcad8a4

SHA256
5106a76242da17b70123dc470436bd7b634b04d64bb94edfbbea2b5186d5934d

SHA512
0a3a6df16523840a05a65b2ddf445522957987869a49fff5340e5b2989e315a56378039668985ab482266a4fa5a52a600233545fed531fdce8dc9dfb8f11e46d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed6f23a6b412a35d03dedf8de45f0870

SHA1
0fd8f0570df122efe76f6a2676a2561791b3f606

SHA256
8badea53012dd19d37d066a4cca76376b7f08592e4a827b89ba623945790659d

SHA512
99bc99cdf68c2fa862e23b5e7d523138f3075d77669c76899f4af35087a4578707af687bcbafd2ac9a7538076a782a36ef3a9629d33ea4ace70012a460cd7736

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5c089f28f4fd9846639e963a5833068

SHA1
19bbf4172ee5faaa8be13d6d008a5a488622c4d0

SHA256
d69c00fc30e3a081e02d750950dea389bf966da534ac27e1d93dfee8ce3939b4

SHA512
dad4110ad04d6ed6a70d9e5ab80462af820813747832a7d3e50226a9d90ad7ae27702a0dd37438f57cb2ccb1015cf0ebbf778c50d96a9a0dd178720009ed8c0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7acef31ddeb63044bbd352b314fa4a7

SHA1
ca5d80745c1720744d9478d683a092085e9308cb

SHA256
54e5bc8a6892b91f7f712ecbb7ce1fcf2b9104be5c913b46831a45b551726e32

SHA512
c8bef554ba32818f9c5c9befb86c5695dcdc84231e1a6311bbf2d8c39485523d5d6cf206051ee6c37bfc6e7895a7377bfbef029781b21256708aac68022454ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e0f89f4e710ad4be937edd5681ab3e8

SHA1
bbe356faaddd6a16e676d6ef35755cf32595215a

SHA256
f50aaeeaf54b458d843fdd4d028d156e4d3b5d7df604c7c0708e6fda0ec46bc7

SHA512
bdde8f0f87cacf917c9f98d1423f80182c0cdabb868c4c4f788963c95c2e957930ca0ea5f798a25c98d67bd72b1bb3e9c002dfd89b5453a06beeeb20a169969c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93c7c1fddc74c31a6f6a9babccb9e5c5

SHA1
ceff111d933410b411ba15c0b64dc924bbc48695

SHA256
3ec9f8f9244317b3d3f7f4d5349894c3f3d2e4b802ab14d933f7c5abbf3a0b29

SHA512
866354a9bd38e964046dde263fa78f372831fd5e9c3311e52a062ce894703fc9e2dc402af3ec43361ae563c05650557053586c8159cf8cb7882bd7e597e0c84c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\40WV1DY9\style[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9F6D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9FFD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit