18f08c8f48dcba6035961f6a9e943fa9b6fe2584cd2bb0ea242cbd324e2b3a8e

Analysis

max time kernel
67s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 08:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa3656b0852c0c7aeb6042f0d62b601d_JaffaCakes118.html
Size

53KB
MD5

aa3656b0852c0c7aeb6042f0d62b601d
SHA1

23a148cd98dc0136b54ff5c6c2cb7a9224e12968
SHA256

18f08c8f48dcba6035961f6a9e943fa9b6fe2584cd2bb0ea242cbd324e2b3a8e
SHA512

ae1441bed27c598b9beffa4cc2254ef6756afb37d646a5f60c515945e538871964358d811204ebb25574f35e9eb7df5d84c743d1e1db885967238754b15ea28f
SSDEEP

1536:CkgUiIakTqGivi+PyUSrunlYe63Nj+q5VyvR0w2AzTICbbSoz/t9M/dNwIUEDmD7:CkgUiIakTqGivi+PyUSrunlYe63Nj+qy

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430216415"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{60267CC1-5E01-11EF-A2BE-5E235017FF15} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000d4f85cb4cdacd76f0c940fdcee93fc86c07390cfa15fd518135141a390523644000000000e8000000002000020000000b175d686b1d92ff86e3bc7166f20d588fe3705df065cbe436ae6d4db290f0bdf2000000094f0cb1768c24406e7d2ebbacc8fcaa28328145bd52c1e56671acb7be7f1b79440000000583fc185256f511b6cc62fc27757f3e534e76e5f259e62d8e482b078d953d8d0bf950464b8e7e8ee26fc1f12de7e929ff2ac85296b55fbe40c924036880270b9	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e005343b0ef2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000dd1318f68f4e7ef22fa688575c015a9ca59ea38eb4ed26556976bea3943ab93c000000000e8000000002000020000000cd58629dd58294eb11035b781d4709009eee56ca4628e854fcc8cf7961fb549c90000000ed2c210566607f4fdb3542fd22d014976e139541202c3e55cb0b0229a3c528e271e08d7e25fd1c46e6260875c3a12a3a6ad4879fcf665757ad0cf67ba110aad3e68d9ed304ab1dabee33093d6300b9478f31e77ec21ec51ed0bc83db16fb519d8a7ef9348829a7d6c042882fe358ed236e12030c207a56869c17ba2df34c87cf988630aa48ca514fe930bdf10b891d7f400000008a48291ada2948094921401512731e1682a5877e289f1c0e6a9132340dac41cfbde1e9e46bfd46ccac069388acd140d0658d729bfae94a8d05372f4693ff7e47	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1328	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1328	iexplore.exe
1328	iexplore.exe
1772	IEXPLORE.EXE
1772	IEXPLORE.EXE
1772	IEXPLORE.EXE
1772	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 1772	1328	iexplore.exe	30
PID 1328 wrote to memory of 1772	1328	iexplore.exe	30
PID 1328 wrote to memory of 1772	1328	iexplore.exe	30
PID 1328 wrote to memory of 1772	1328	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aa3656b0852c0c7aeb6042f0d62b601d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1328 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec68808ade6b55cc7979fc893fd53ad1

SHA1
ee4ea8656457e3911a76674e7d4eaeb4969237bd

SHA256
588cb3a251e10da95eb3d94777c03137dd4534e42e6c23a0d2e1ec126d74e2b3

SHA512
ef25edb44555032a041c0cc98ba3d33beb80784afb0b5982417fda092ceeaf95107d7591980528def9ec00e877806a0935d8a9cf6ed7f0abc9267f93f44c41bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
323f843410d1269d9fccee3bde5bd576

SHA1
329a1f31fc3e38571f31ead4b1bcf3f8c53b538d

SHA256
df1177608f76c1684f41a5f9157c3e7afa6dd7659403c39c222fe41439dd3077

SHA512
320880384cbdd632335d105b7f31fda77da11a97c672d5978eb8d25a868a7d043070d96afb842bb206f835e4a2b089b96350b92b0c406e2b084ca0e164ad5631

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b0e010409237d74b9aaef60ad074d18

SHA1
27f3942660bc15bd508e2dd4d47f1685541f78b1

SHA256
ada7d7416208730404eba349787c65d72c8920f1a56b5d15162df07eb4eb82f1

SHA512
76f5ff47060baf3d56816abef1fc6b4b9ee2ecc394ecc46c5b02670118dac75e41bc9a83bc6e231fb451e2a25e012d099c8bfdc343f4a924ea643a7dfbcea29f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
659c2e39c3cf04e44eefa5a9a45c973e

SHA1
6e6201da30fb3454370578c0b583f3527e0a17ff

SHA256
3d5ef8929f79873586dc0ed4b423251886a43ffb06fc66e70c1e31f08ec7b053

SHA512
ceb7580a0afb6ae1b3e66ef7389f01a24e7ec0fb1af599e0fc7c4784f1490ba48ad6be0bc296d534ca0afcfeab3f94a603aebfdd021316fe4f90faea898c1f50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd8c77cb713e0782b6b78781805d3316

SHA1
ec2eb335e72a8c77a635062fceedb19ccd0df913

SHA256
54769a3b19fc1096317d7abf721cf7cce1f966f4fc482382c0a5955f015ceda8

SHA512
5cabc7a5b5d449e9c93845e417e1c9bb3ce1fa58eef58fccef8425c7c655f7b8c406f30c15234df1cc15d5296957e044cc696e3af08f9c2652b72e95f3cf4234

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd2749774d8b966c517311c3927c554d

SHA1
c722647dc1dffc79cfc74a962e7edc2ec6f05cb4

SHA256
6fa4529288e9a5a72625e3f2b912ad3d8db0f63f86ccddbb44c3aa4226797dc4

SHA512
d6441f0d114304cf25bf8631196aba9daed6c21b564a726e62e9b6d01e46956a31ec660cb7357dd481e94efd50622b24d871333e1cc6e2caff2c979990b2eb20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4698b2fa4f17677da7ad370822032f1

SHA1
694a2fe93efd36b0e1d683908109b97ca37f5ef2

SHA256
d5e61d4142ecaec94b178a97bbc21620fef673b59978e07ac27e96897c57142d

SHA512
c99a33d942af015f692d8f4691828f4cb4e844f41188c4503a4d39dacbb6695eda730d516eb7cd9cb602205a3b6e365a4271d1ff13f3063206b741e1bc76612e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b13c3cff7f694c03b754312406dcc001

SHA1
bde2299c887fe83f6f92645e3e17c90a36a203ce

SHA256
94c76f1ed1cd00477eaeb79b29ab4161c505692674a20553740561e9de3dafec

SHA512
3c007bcd35569587a52a964c56ab46e2e2a141d961cab6f282be318094d6ed7c2bc3563396e69797728ac2d844a8f52617fececf4763b0f351009d2c9eff33d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0082d65fb1d06842fe5b80b446f7f5b2

SHA1
b38d12637fea8005cef4643c81fa219a8f430b95

SHA256
27dec2282bf7669e26732395db89079a33b690160b26a65e3a5a539af58bd413

SHA512
0e7375b61c880e8c5aadb44b76a435e2fe9f0c60cc817af807cf10765e52eb59a59b7601956272041edb3ca4b07642d8e25ea587e6f270954f658110a9357b63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b90f57aa8192c0739c6eae11f6edd9ef

SHA1
01d1f6024ab35a9791ae451d9ebec880d0863093

SHA256
02f211dbb11e27e67df6b1a3ad72f6fca5ca7d0716fd97192c990371575c1ec2

SHA512
4bf06acbd8ba694faddc0f9d1baf51279517f4aaef55315c7f1f1a824715895eee80d5eeb985fb1cf9b5d552efa308748dc7753867972ffc87e24db020ed8a3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c179bdd51f71d9ad8514a7e54409c85b

SHA1
1f0632a81f8299b03238a7225a2516cf8ce142b0

SHA256
a58bbfe6e1048b34f59d35bdb24e4429a8aac5ba3ae9ae07e76196fea8a6a343

SHA512
09f44168fb108dd8c81111a9004944b8bea47041149d1d93b9d7873df94d5e3fc788494e6f95cd714a422846f6e31cfeca523cd889545bbff3c23e65025a4037

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b4606bbd2aac009961f7d54d81c235b

SHA1
847d6aeab767667f309a9b396a4987bd3fba22e1

SHA256
f9436091c8b1e21c7d25d6314e46957c2b4574654f4e575988941e73a8c92c5f

SHA512
be9ca7e23fe30e4f0343acbf3d28c5b441c0c0795f92e774cd46fffcc3e679535818b15942e04ee3e44fb2907f9504354418832da3ba4ad4de6597c0baee468b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05d1b6a8caffa873ac014264305d503c

SHA1
68079d71e860feba949691b23b9713a238972ee6

SHA256
d3bd09e3a2da1aaf12c57060e021191def6f400e49eb3d200257c54a90b0e038

SHA512
f80391d37fe9a94799ffc44342b690e323f6f8bfe878439c40e6e88b3d0e9e0cb7c5b2b5ef7c2438b3120a6ddab05922af03a48a2461a16fc89c69b284d4ee62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6123e110ad4929ae9a8e9bec1d1405e

SHA1
35eaa158d2f7afa66fd4ebb555bd1229518b8900

SHA256
3bbbf8e7a9d213698a572b30aaf55143b232f5b6863c66dc37200f054d34f9cc

SHA512
d10f0ddfe2fa8703513930696bd1640f8f62eb3717655978c56560d552fb80e82c39acd4c9f0d29650df8b681bfea86a88dd0da454d78fb713a3189dd50ceb82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0E1IWGZ4\filter[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE2B4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEF16.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit