7f5044111ccaaabdedffc4175028aaea1bca8ecf26b6c5caf6bcd995d57fa1e8

Analysis

max time kernel
145s
max time network
152s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 09:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa87d813a8f6924605f6814023790bfb_JaffaCakes118.html
Size

9KB
MD5

aa87d813a8f6924605f6814023790bfb
SHA1

d4f4118d9b881ebe565daa101ec10b799416d03e
SHA256

7f5044111ccaaabdedffc4175028aaea1bca8ecf26b6c5caf6bcd995d57fa1e8
SHA512

a58baa0b40305ff702a78f38de29dd0934a0c0619bd529da28b4475b26cadebe44c2deb44323ce389c579066828a5081371cb28cebb29869c53a69a58cd160f9
SSDEEP

192:pJu4yMp3qOO8I9uVIlp25WAkM0kZmVQFr6vz5:MMp3qp8I98IlpzAkCmaEd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430222659"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb90000000002000000000010660000000100002000000066a3a9a597fbc5ef1c8b38e5a062e2b66c2f7b5d19e9ea488b5c2fb5a46dedc8000000000e800000000200002000000043482c70d23ed5efccd1204c94151e66dd62da770867c0546e6c582ef3905d3920000000af1d7a9d69da301c23e9a312c664167f3d10b570199d34782dedb3e49f0f36f740000000f5a6ef6b25fed67e34172b2bf559585860bf81ee022b3f327f4a36b96c829596db580dfbd7fb641d0ddbaf69007567f6b630218251ea21b2a135ba96492f4227	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000001996b6508b3eb8d6bdf3763b9eaf3ed13f28224abd929ef2b7ae23a0e2f7cfd5000000000e800000000200002000000093db3413781f3ed98da9f5e6557f07ce692483593a31128eed935ea4e816814b90000000e36cb3ba709a8448bbbcf72cfafa86947632475c9466f14926f6164c3d9d035ee842059795f2d735fa368a18fc0602513a28f3e17b142a011f1662557407f35db026f849e9825827e0b0446a7d02b5169c3a1c1e5fe4da58e2664f28159e14523077230f296d391a8ebffa0e57e00d086f58724f58e65daa3f40ad93871d4a5651e61787912d68aba0bd9f917de82dda40000000af6f87ae3bd8d63ef951915d9afde6e8b146e8f1ca7f6f1ac4fb4bc422c14cd525d15354c055c144337a11bc5c61ce02784c984daa290b0af60ed9aeaa8077f5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 701772d91cf2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E9E2B561-5E0F-11EF-A1FD-CAD9DE6C860B} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2120	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2120	iexplore.exe
2120	iexplore.exe
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2448	2120	iexplore.exe	31
PID 2120 wrote to memory of 2448	2120	iexplore.exe	31
PID 2120 wrote to memory of 2448	2120	iexplore.exe	31
PID 2120 wrote to memory of 2448	2120	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aa87d813a8f6924605f6814023790bfb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2120 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19fa840801161c511990ebb34746a243

SHA1
38dc33a3fbdfa96c3a2c752bf38c84605f7dd384

SHA256
97a410405ed1d3bd9a6f918d7ad2abd1d52783f3c68d624e0565c6a125f321f5

SHA512
9330b16006719b436aa13dc2d97ec5b59aa4ad773644985a553fd8f4ba816dd2d62ec89a958628e7b6c881c23c148dabab1f7aad2992dc9f653cf0ca83f32ef2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f5f284190ac4a5c686bc517776f315f

SHA1
46d29ee8c55547a946bf5b01b0c61ef3a0c6315b

SHA256
91f356fd31d4a29dcfa2c9c9310dcc3d0bb43d6ae822172b3ec4bc1d8eed9ab9

SHA512
5c3b796c49fa7e03ed3bd5c6e2866b160ed403846293bac95606bd4f45dd0626941086f972c1642d38968008e0d94161b65d53dda6b858878800f2608833832d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b37daee9b70a84b279214d187c6be9c

SHA1
f1840ddd850a1efd394a2ae62a60553d4bbd7ec4

SHA256
40e4750c4824bb1eefe3c04057cc6435a781522f99443f30437f4a456b139965

SHA512
e80ddaf939204648bd813c735c2a7f2688312b9d39832bae84a0c1e76eb376605b226c49e2d566a7fa4288735a8ac44206d63dc62f77a9876b12422fa99cd6a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e701f6e156c3df72976732577bcf17c

SHA1
d2390fbab8b84a0bc5b477b50e2b92b9ecc2b22e

SHA256
9ecd3d48d5f7290af320dd3391118b70a1c3bfe6f8bbb7dd7937f7261a602100

SHA512
68b42de9283c2dd598252dceca853616171011cb9bf14114686e0c9bcf798c8fc198133009395a2c1c1807f74b2d485093a713c6502f7fae3fc8535ff45d9372

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da61b4edce86f245725d98949f4cceda

SHA1
bad1481ddee5ba73eba0fd5b311718a0f08858fd

SHA256
f87b6249125a904eb2832a66ee01d298f3034cbc6be636dd645822824db19b38

SHA512
6b91bc641956c4108ecf77010a4d0da6285fc47435f37ace781d4e7f46a4873e842479c7fcfafd1f8c0f8899cb0f7c25191bc1a3636e472a75072b304bd3a0ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9311d1a8c9c708d4f62e919a3f1c6d07

SHA1
6060367ed881e88d45f97ea0cd1aa896a72f5559

SHA256
63e0f81bb82505c482fc72b0f5b4e0c4136c4d1832c8727a8f6aec797a4705cb

SHA512
8895f979da1c9ba310c9f68245803ac29e844a486e8c5f78f610c231161796de7cbc364f6553c7a1af0be8ac7332eff10c1c5ef166b735036fadde6bb5a1d919

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1db45040b617d7594714b9b58fb20d53

SHA1
93adef72350f79f4f8b8efeffb4f5bb63773dadd

SHA256
05094e4b43336ea6300b58a9106cb9929de1daba1ec4134a175363afd3cd5206

SHA512
dd19e8e1a8b9053a496ecc61603e1de0fd6d65b0b206a59af7c45e9ccf9fa33d0fc43aabf92d732e061e9faa6bfe55e205656658658ceaa8095f56cada495fbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46ba6df262a11d0b336b2bdd05918114

SHA1
056cdbb318f1ad33588e147aabd058293fc72e22

SHA256
68642b2ee052cf55442cfcff59fb8fe5c4e830d9e2be4e80fcd327955f209b1a

SHA512
aedb7ea9a359472c7dae164eebed68b5a4eed14f26b4d9d006f4ae5ba4ae0eeb067b5564cf16c999f9332bf939d470d89e5d1e148e6a06b5a2632c4132406494

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f46452b0719f9beb2c009bae12d736ba

SHA1
1a502ad0d7260343e01ed4a73f1b7a566c69f78a

SHA256
d5301f7fcfdfd83c7d14849dad95aec91fd342b1bd9a800884a2ba5fd6fb9610

SHA512
46dc33ba40c929434a3b7309fc08f4e2dab55200c8b26cada72a64830cf1157eab4bc6c9562523f2978c7531dda07a795bae2d4c1010aa1cb4cf13094e1ae354

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
583a4c5949238ee55bc563abc36dade0

SHA1
698fe3469619439d1a4b9ceb93ebcae970c6c2ee

SHA256
ba2b90b06408e4fc12f99b9824f0527178c5553453175720b858b28089aa54a8

SHA512
9f6557a3929f18969e2d9e101011877e6c7de4c47c37189ad6895e4f1bbdc5acf5ef9ed441d20cb481f3b07dee687340254ca9c000124228f6748ed258922ca4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b5cbeecc8a738ca5fee76725dc0f143

SHA1
6f4c6d8a1af27154ae70e5ebde846b83ac48e45f

SHA256
a661ecd59d2073367a68b28dd90121efb4f4b03e81e01e5204dbad879032d1ef

SHA512
966a7a4318d0a590bd2f2945f15ebe6d28b9e4b3406bda5cfbcf8606de13fa152289800fcfbbbe5539ba040ee2859f06fc0da5e9605008809e06f8c40d5a69c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09866d496c8ca4459c1054e6d2c9cac1

SHA1
2291bfde7aa4883f62292443448a6260ca3e849d

SHA256
af5881b823f76e13b67f812cb50a22abd910f0f1e358a886ec449b9aad2df972

SHA512
059ca49433bd9cb310f79e11fb7ff451bc1f40afdfc5684006797a3fe89eb90c85d3f0958f414a42fe7bb088fe0f186daaca4751c7a67bb75b729d667ea7d370

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0dd0b69dd36c007965ea263c350a0a12

SHA1
110c0a9d8a4179f628b2bdabd48a79fc2b1ee6ad

SHA256
7ccfc606511a7d6289c2b1c8ecaff2a0a788637245206c0a1c9b3ce661eb98d4

SHA512
621704977b8ce8d11cd3abe7a51d4e52dd161a7803d352411fb44ff8a1778abdf0b6110c08cb9c80bcd494b7b7b679fd903ea489db44ddf836610dd005e23189

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cff099f0c78b02655dc10bd5ead56feb

SHA1
a2eed546bfddcb9807de3cfd1c94d675b02a4b8b

SHA256
88591f13c6cd600574f215cf68d8f0aca1bd56929d579c01e1d528ea4373a99e

SHA512
adec3c9bd0d295e2c0edf68eb476851958ff62a66796eb940748af6e39e5ddadbf4a4d684fccd247eba167a60bd2ebc5e09db6ae8405d374389cba835982cd0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94662dfcf1a278fd2f05baf3edb1c402

SHA1
ca5d8ba39cc5315c27f2a61adccb93c8b931ab91

SHA256
0b78adfc666bbad6dacc822bea8b3961ae87bc66941a4fbd4a08c1ba30d138b2

SHA512
5cdb930bbbc64eb0f6dae442efe0816cf763aab1d788f92a2be0182362e8aeaf64c1f6665f847b1d0a683bef874b74924d13ded65beb9dd2deae76465ca88541

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60153ffb553d0b5dc8a9230ab37958ca

SHA1
6110cec1b92ac1e731933440917450fb47e0ec82

SHA256
58021ea9410f31e024cc2fd9fe2620200e77a82e213ef5092520666c19fe678e

SHA512
8ecc59e5bec59caeb000c1dab241b16dfca9d387e3ecbc9c3638f126a71220228c8549ae34ac87b32766ce75218000c1578978f7465a68610a690bd0e409cad7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8100582f1dab4f4521a0373dd0c248f5

SHA1
405e0cbce3191a0793d515ce876da967e2a0b847

SHA256
6619be2fcaf60b1ae3bb0e12977af135e4cb76bcb85a30dd16d793e687809742

SHA512
e4d12312e13d8c0ece9e7d3a045e629b1a49af44f196ffd51df6ba692c32292ced1fda0afd02acabbcd255cf5953ade0dd8b72e1c7a099398a54d237015eb143

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE66C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE6DC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit