7d2013aa575e2a8493e059297ef8f61de12bab5c5633819b3162bdaa352ad31c

Analysis

max time kernel
149s
max time network
143s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac008b28229e984df977df6a977ad8de_JaffaCakes118.html
Size

46KB
MD5

ac008b28229e984df977df6a977ad8de
SHA1

c48e51e90cb5a8dadf6024c88c1fa05a233dec8d
SHA256

7d2013aa575e2a8493e059297ef8f61de12bab5c5633819b3162bdaa352ad31c
SHA512

e9949f587240928aab7718ebfdb52b2b8f14b96acde1d4da894ac7e3dce7e09c3f92bb44f36113ef55685ad7a696c1b6d7ead3b0bee4f9de0268d41a9b1a4883
SSDEEP

768:rF2okxc0BYUHzXw0zFyevVDN7eHlGzwP2vtkrP4QAoWQqFbXr32G0:rF2Txc0BYUHzXrFyevVdeHl4wP2vtkrf

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4F4E3521-5E54-11EF-A4F8-F6F033B50202} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000006f2743f7e9954f78e9942cd7aa7b9cd26246028e03874ae0e738e96f532284ef000000000e80000000020000200000000ca2f6fcbadec64946a91d83c587f72c7087f08066144cc0516cdb12264de353900000006b54b285ee53600b647374e41d693f772e3fd10257415a20c95597e590a5787f1afbde85b6189f6f4ef406f772143402cddd3e29f40c6704e87ee6f093c950b23b8855c818884f2741e123c8fe692c25b29713def44c9edaa6d16659a10b5dea834d5d334b30144bf1e18226353967e5b84c7b8d02cd6eedd92026ffa8ac3fc7dba57e2f944dc70166af2beb99b3e67240000000d88e2f78c2d3af578614f0dfec3d90d89f06dcab5a4b42223c6c40994d493ce870fc7a5bca65b1a00c3b3fd455a01d01dab61fe789b08df12a2b3c37ced6d73b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000975fd53f706c060641fd5ddc7d1409fac437e70f6212e798c4e361829868181d000000000e80000000020000200000007751d0f2b62b97d7ec5e04add8862ad26ed9d000fb6d3ef0731073892d901a78200000007ee75de6a3b157d2cb6e1bb652a2bf6a367661133be5b33229ac73dfb1e360be400000003ee2042c36d7ea036efd9a23dae13190ed6e6977f4dbfe429a7f5818dea0df8d2699d0cc8b39a406095a711c4eac4fbb17dbe97e28e1c175a5dda80c05232c49	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430252034"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60ed085161f2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1488	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1488	iexplore.exe
1488	iexplore.exe
572	IEXPLORE.EXE
572	IEXPLORE.EXE
572	IEXPLORE.EXE
572	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 572	1488	iexplore.exe	29
PID 1488 wrote to memory of 572	1488	iexplore.exe	29
PID 1488 wrote to memory of 572	1488	iexplore.exe	29
PID 1488 wrote to memory of 572	1488	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ac008b28229e984df977df6a977ad8de_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1488 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc2cfcd639e814dc93f56a1ae3bcf1b0

SHA1
dfcfdc99edfb9dde92958781ee8d8fcc484e4e34

SHA256
452ee3dafed430d05986d4e783a8c2743e4d41c0053db8697c7e5e61ba56ad5a

SHA512
c610069e950cc77f664154f7c5d2bcc172518c6757e2a11b9d091eb98d9a547acacbb5b4160d98acac8b87ddb2f914ff40aea3a27a4e99340395e6e3b301c717

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a70b662390ebce2fc1bc4a732453876

SHA1
364769d9a1757da6a9760dc1e6b3aef28bc5d045

SHA256
27769f9c20a7af36203d1eb3b10bda03d01f5b1a0c5868a4bba0571cff4e2c47

SHA512
3196d7532c311efa163709eaa7bafab061e2046910f1a772a8463b12155de50a093cd8759c3455c82e829f11a67194a88a8708a9b09bd8cc96a35c679382955e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b303045b8117a6f242e5df86414c65fc

SHA1
4f269eb9cbac6e3efad7f9c5668559bf993cbd70

SHA256
70eb746d051de6233c4eae7d94f88e5576a8bae7984cb5755f2019318814a357

SHA512
393d2205fdebe78a9b4b1c9fe6a9e5d3bdcd22a507efa82e373542076829a1f114fe5ab146033181bc38f4f377c17ea82392831636bbd7cf9970da9bd88fd8e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b9c8b447f0920025d2731ddf5d07bd6

SHA1
11144db07160c2038a7fe3b107f231afe21c2979

SHA256
46a394b5c7445302601a13762fc8b71a0174c269eeaf12e0eff17205071a9a6d

SHA512
1ffd415a45301c58bb1c806f5b296d1052148cccc0461a244f2217b45d8b27e59c5f723fb62d6e11d6dcc0dfebc5a9c56b83badb4ded2166648345cb1c749753

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49f260c651cbe855869a4fbfbb937797

SHA1
d7caba668ea3a20e391f4b5af0dd17ff37e76027

SHA256
03d6780fd567aa8b8a8e300c059b769cb80be0cc37dfdfdecb4d466fab2bd18a

SHA512
9a17b1e5063b9a7a891df3ed053c215307ffb732eea0a230ed5e67a05fdcee490dab8393daccb2da9f9c0946744294508527fa3d584f6f8ac3b5935bbc432815

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0fb0de68d11afc4296689264b0230d7

SHA1
db9a94fd6740f43b50068af93baba0405a3a97b0

SHA256
6987fd8547d2ac844b336b8a889d085a2cbcc48f2be6788b70ac92c7e5563129

SHA512
d82e26df1c7da0c0d86485458a91181783dad9cb3dd158cc5f18cf12823f594cabde2fd1015e21d85742cd0d417b24840736678d092231c674aebadf75972a8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a39dde9db14f2489ea20e95eb90bac4

SHA1
df0e387d85a38f16a65cbc0560b14d1bdc074f94

SHA256
f744d72034a51a7dc9c8f058d52fc879b950c5368045ab143486fb57195a22f6

SHA512
9ebf92b3786f9cd64f02eda68abd7927081bcf24a33a2bca7ea38413ec084b308996ef685d03bd23a49aa324c3b8412b673eaccd488160561b767d01d7faa404

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13a8dfffcdbdee23abdb1c9891a1037a

SHA1
a0e06719f3c9c06cf7de6c4011d286abea8730dc

SHA256
b74847d4b9936e286c9fbf959315f0d69a90d65fa483411f5a4b906d8a6056cf

SHA512
a1926fdc4123dfefb044d215a6ebf27354611ca0a9adb7bbe39daee8da9463d18cb34a0b86b42f3026ab479a9a4f78631dd747bc39ad533cdd6ed1999b679918

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34ff265b786eb8b85217ced452f594df

SHA1
3bfb964aa31f6060740375838e409d3b69b31a01

SHA256
d213b4fac6d0325f6e2bbfe90177236fd6848b09a7f4f7ed5ddeeabb173c2b8e

SHA512
f3437e40c1ff6f9e29c45d89c556ec15ece8e23a4b82befcd2dcc95ef87c2e6f67802eb77a785455a4dd7c9735b733406a43ec54c9be30de4c2aef17cb48ae2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06245302335037b796ba78ec8d646eca

SHA1
3287ecec92cdf52aa5f43c317e8bcf7fdf4d12af

SHA256
f196a19ef6135e43358f85f5316fd8204d8e75cd4be5c20e32cc25429c81c701

SHA512
ba6e499f277bf599f27c85aae25e9576ab755450dfe85216f8e3a56e974d2ef1e0b59c11e92986aa3f777858585392a2e4e10f97c52382e11530e855fe6b139d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85005b8c9aadd5340c69787d60d9c5eb

SHA1
5679d530149037bc0c1fde6539072ed64a3ebbe3

SHA256
3201c69ef8227d916d5f3419eaa39011b08e979321c2f195430219554fde257d

SHA512
e5cfa7531793ca14617528bf30ea6f646d987d71d9852b9a54c5c52f448feb134d526dacb18aa429e3e56fdc2c366c42d9dc997c57f99303294d70ca50c4e50c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e582a12d65d8b3273cf74e62504d89ba

SHA1
f7e0cbb17c328404c643d574f3014035faaf105a

SHA256
a54746609d06e35021e6e9cfe4f4d636b2242b3176a9bd7e3601e0ff180c6358

SHA512
2a5dd418f14101a9d8f221c30197d95bae2c57f71e69291a25deffbc4cb0e25b461f01d56e3e28b2903e189ee6d2701cae010ba9cd36632ec1ee305b171ce60d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46fdc6a7b5957fe0268f5a6de68c0e6d

SHA1
5e8e2a664ef66c912e2610a03e5480e349b69c8a

SHA256
b5c9fc5e570171f12adc5ac5ea32495613443dc2bf4b84e6ac1554861e741710

SHA512
f2d93eb2e8f9fbfe8df949ae43dcfcc89c19b6c8f951509bb420c631ad38e542e830e50d7c09deef964970fa963aa44a88aa567043c25bd9fb9a95d501b0d1b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
681b33ddde0d5870a4c9605bf55587b0

SHA1
2394dc5c03be6622d3c27a3a279499906cd2ba40

SHA256
4ba0acad836c576af9bea05a76088e334d811ca28a0b3f272f87a8538b3027ff

SHA512
05d13f25375782ad31a0f97be19b99c94fa10112d636b860784a3d20da3f4467b3a791785c8890699b890fa47b55a24dd5711b0d0405ab0e62ab45ea15681d3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c5f3d31754d54af8bab5401e5c40f47

SHA1
e05204ed2b7d57a73d3b70505e0a0e43566d0b6c

SHA256
d04f0a604f6032b2855d697b16dc1c8636338ee236093624ad80fabf2478094d

SHA512
9bf5f25f66c34b79bd8d55a1f6dcd5108d1842fdc1e884be6919efafeeb523aa6590355c377904f0046d608a4274b46d2df01e620c2b5d6363f5f45787f0a286

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\40WV1DY9\wp[1].htm

Filesize
114B

MD5
e89f75f918dbdcee28604d4e09dd71d7

SHA1
f9d9055e9878723a12063b47d4a1a5f58c3eb1e9

SHA256
6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023

SHA512
8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE072.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE101.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit