83f56326b8bdf65471c4e1d554e97276b0b858fede5ce03ed123bae2995a0a3f

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 09:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

aa7c1ebcc14d9ceacc07a0e49d947b1b_JaffaCakes118.html
Size

80B
MD5

aa7c1ebcc14d9ceacc07a0e49d947b1b
SHA1

303dd764ca044a8d31e2e9b0b665c2b18a6cc72b
SHA256

83f56326b8bdf65471c4e1d554e97276b0b858fede5ce03ed123bae2995a0a3f
SHA512

4441f1c77a0ef4db4a82d8cfcabea0c7b53b4a14d51a1c92251b3cff13047341acc27ed2473fb1596b8ab0ee7582e9588466c559882315b4e44f6d945ab2b79b

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430221845"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000f2e2791441fa98bf036fd6edc4f6fb8d07f355f15d1ef057e6e06b00089330c0000000000e80000000020000200000005980c7d6041146fbb027d880eb58897441d9c8c939cee5e6c9e423e5e751a1162000000033e4a7b78ca71545957f4af4ba3d4d9106ac1a80c37c9c3f40d01931f4aa150640000000134568c5da026cb0f50d9d548489015709e4eba84bdd8b02391b79c95a75c98e2730e6597fce9c1be11ea1cd866b54b45669248191fd3a27493ea4fcb9a2d7ee	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000e02a35700d59d02bda6de5ff9316da585c3e2595603f607829d6acb2ee9fb512000000000e8000000002000020000000e00a5f45ca60ca4c055774dcc76d6c7f2c8f36aeaae7d58085ef4e73430d6ff290000000e9684649ee4fc91041ad124b256e14bccc4bb0eb4311f0514c9e79d8abdd4e207c6ae02e72d4d2f4b5f67e4e192b39b2d1c0288a71c6a09e98e92d05102178e5902bdf3539128c2cfad9411811a8086556b8dd5740347fe0d2c9ecddd69103ff6c80247be0dc1c0dc2f6c99641d1c88cbc6e2e933e2ecfad1697a0e19bc3b514d5d4d3fab93a45415b024f7eb428b2d14000000002afcbe11ba9768f8e31aa5cd3fa612ff2bdc6cd570e7d9c5997ec0a2985084671ff1670b464f0f86f19041f0c1c94a092609e6a4ed96799157e7c81684bb61a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80b115d91af2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{04B11551-5E0E-11EF-BCF9-7EBFE1D0DDB4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2372	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2372	iexplore.exe
2372	iexplore.exe
2756	IEXPLORE.EXE
2756	IEXPLORE.EXE
2756	IEXPLORE.EXE
2756	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2756	2372	iexplore.exe	31
PID 2372 wrote to memory of 2756	2372	iexplore.exe	31
PID 2372 wrote to memory of 2756	2372	iexplore.exe	31
PID 2372 wrote to memory of 2756	2372	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aa7c1ebcc14d9ceacc07a0e49d947b1b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2372 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70dc0a8828006dfc6073e259e17ddd9d

SHA1
9d788b6a531d2e7e39500155be8277e190a09310

SHA256
c39bcf5fc955b157093a9a21458ee4a8f41eb34513a52c3bda222b87f9c6c7a8

SHA512
d067460af01496a807a4f6e0fe57857d9e0c88ac86296fbc8a2a34a7f10ba0c4178411f7a9d47a6f77a028f5b39f02646c4657794fb114a95406971bb966903b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6eb04e55e28c3ba4bbd09052b5e8e13d

SHA1
8d1290ed29f6f71226c23fd828e1e8da51ca4db7

SHA256
6e8fc6317a968755df948240abbb4a880105bcfe2ef4aaf32300051538e9c0ec

SHA512
52dc377cc7c0812f4ac839c5561c8e1a47c68dfd6338c3b6e212556f7e073df866d53d6f7178db479dacd727f7fd2bb117894f3228251c32f607353e97a6b377

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b395e116dbfdd7a48ad409477d1773a

SHA1
2712f779deec172f2250861f0b44fb802a6b05dd

SHA256
c944cff93f3af743379054d46b36826d1facf25817fc11ca39d64d01d1e2247d

SHA512
4329432b793ae65782693b86517d36cc7e2366b90c2366c0cc232049dac57b77688f082d9d1ead4424d27a98e8b6372f9ee6b601985749038d14e2c608359ac6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bdfc2525690145d9cf1c9bf52c7fcc87

SHA1
eff40d49edeab3ee884f49dcddbe77347580e636

SHA256
8dd6290f2afe43314b6d5f704305f523cc009ff95428448ced824c3b3bc4d596

SHA512
1a792e905ff5cff0833c45b43d81dadb765e942887caf844ccf9981f5dbcbd6f10a988356313dcc04f914fda1dc655d56b027c7ea7d2c31c8089330965e4ab09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b01cca9b5bacfdadcb9745b348bb361

SHA1
17dd6b3c2cd76daa346de1efe88149578f6028dc

SHA256
e11d7dd4e62b1324c84a6b1efb3569d11ed10a254f3be1a3f8c63b2f34f14f07

SHA512
6140c05b93241836bb6dde0414281340c75980b1db9e651d85ff868a977c544380f7b86d5c5c03d3dff5be0fbcccd25fd6c60bb27f94f478af7b91d6d128386f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea2edaa06cb491368ca69a1ddd765b20

SHA1
ae53a37c04a8fdcba05428e12a2845b628c122e2

SHA256
5bbe96f248a68bc9791c92ec2fc8cf545a6ab802bdb9636c6a5bf622d77bf930

SHA512
9a1fdab50b839bab0d44cc1b30a15cc78d0832e0ecc3556e0efdb4da52dd2e13cd78a0907a4a3c03cae2dce4c90ee83c4e9e47859d7dc55589aac3147eef7006

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5ff661fa87f19a8d8ae5e311f27058d

SHA1
0efc51960bffc2cb29f94cdfbc667b6f4863e2ce

SHA256
ad0db501bd8078367be439a04048a02783c215fbfaf38ae82e11e6fdce3a1124

SHA512
15f6f2333e45226451b7f4eaf593a61a59d83ac8ac97d510b0e95c21cdd70c3e2aace885c68b74f5f3705247d0b44528aa601ab4cec453b79347a48e6154a196

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d86ae2fbb84ff0d67897c470f545ccd

SHA1
f8d6354447ef9dd8547e99b01b9a127d2d9aa9ec

SHA256
83be03946e665f626462f03531a5cb33d208dba0c3b2f00daef9c785a83c8c96

SHA512
2e701b5e8831290e8d7fb66f2eeb23e7e59287bf33d874eaa23bd4cfb0bfa80c2076cc7abb8d957124b6b95e84a580e7ed069624455b24569b893095de82f058

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bec0f79021ef3b668158d2f75fe7b986

SHA1
80cbc970362232cb65d14f8301ee98b014587a99

SHA256
a5dbd2bc410abb87057aa0f698f28fcd3d2156710546214514ab6f8aabbd619d

SHA512
3bf769fd96866989afba336d1c803ce4e74d5b7e07a5cdf3c66f857565a95d69a5d3fc61bc1364230531716bdbf6f371a3bf699ff5781b91bd04a550393e1efc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d773afddfa8ac97fc65d589d31388e6

SHA1
3e61c8ee7ed8d0f9d321e8e91dd7aa2fcdc771f5

SHA256
ad43ac0d07adbf4319058201db60a653ca0afa29ea66a00797c4f1ef574336a9

SHA512
73dc39aa828a68c6f95b30031893ab57e9a8054ed4970635f63c42a251ef9c32ef10b693bfc845513784db00647e260153fc911a092e4520a3eabf27cdafe39a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c94fd55563bca0b6461f6a3435cbf9e6

SHA1
22d64b9bcf1fb17c73764329a33b777882eb71bb

SHA256
75e02a61c01151282d4894799e7fd031e32e5fadded960e122a8dd9f092a306d

SHA512
ef6f35e24918a5f877b2a82aafe0cd54fe3d1ac5fecc182397b652dcfd9cbdbec1395bb34afb6508e8748d654ab697690e04d26608461628e95d52980f5b1a6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a0ca35df00846e655c78752aecfee93

SHA1
dbf9c25d7421795a2452589cb8492d36657777f4

SHA256
dea21b84dfb53e70866902a283b12c47c2fc0995defe64fdd525e9d8a6177168

SHA512
799e291ccd81bc4018d9d42ef72377138ec8b72223332371b97626333e1497ec42be3e1e1b582c1ae3ce86527eeff7bafdb4e404d2a8be92a89819fcb556dbe0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38ebf7c22402108b730e8c539b69b9fe

SHA1
e3f2b8f3a2a59d00829d98ef8f6f9095b19c8ffa

SHA256
ad654a82deb2ee794da04fa1255153b9c34ac81a2050753cf8e841c3a969f65a

SHA512
1e6f190dc492756aa3340ab394bea826e20c75011a41025f7f856be8be3c112cf56d4e42c02d6932da6dea05f3d7886fafa54ac108ddb7e888a41e9f12a81ba3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfc3184e7de9cfcaa98595529152b8c3

SHA1
5ee55a8ecde947dcbfa32af59351c97c8b41789a

SHA256
cac723e00d7ce4d0ffe949606fea6e5a5db485f5f5a077d5c4ccabf0227ef783

SHA512
47de681d313dab381f7a24eec5aa45d2c1fa4e867bfb4564fdf1d561cc7460d160717d45efe36279214351697b64423de7004238bb146dcc4cb671461318e617

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9125fd8e6efaf4f25ca879f585de5372

SHA1
567efb16c89f66c3a64d0bac8aef0a460e188142

SHA256
43c2ee9cdfda895f221f9591e9dcee7083b45f49732ddc73ae8daa5ca124e723

SHA512
050276af958ec29bdb8767924c35d5de87abaeb3c470046fb8990e971a0c1fa19f2e12ab84fa4f2a24a9bb9ba79fc5fa1eed67523c589d8c62d2a6c393867baf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8d21df4db13717f45c12bbc4018b43c

SHA1
0e881296a6a8d6f6bf7bad3fc0906cb9d2240125

SHA256
50fc7431020fb1ea509075a24aecf8290ebad0abeea2e0e7be4dfbd66e15de12

SHA512
defc01751217f922756c6f0a8afcae89d4b1113f88e111050a6152809cfe0b2495d70881a38205c41945150285534b37075523b40bc775be97c219a17e830f67

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3DB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar489.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit