234fd2c59e22fb104f7b4635b9f246e4d281135f46cb9d181bf06be591c882b8

Analysis

max time kernel
117s
max time network
146s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac401954b77b2f1c1045fe812ee96462_JaffaCakes118.html
Size

1KB
MD5

ac401954b77b2f1c1045fe812ee96462
SHA1

af702b570f313e0e7bfbbb1f9704888cf07b2ea6
SHA256

234fd2c59e22fb104f7b4635b9f246e4d281135f46cb9d181bf06be591c882b8
SHA512

581899e3b413b8de4db201ae76148d010dc6dcad7fb283241d3b0a5680f76e913351b8c313d7fff62e9c20acb6f0b3dc0b1847194e79c7553cb8d32471aee3f3

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c920000000002000000000010660000000100002000000069f0b49c47d80af56e56d9309e7a7d811fa586f208c55418fbc62c7cc35c1caa000000000e8000000002000020000000ecbd9b2705b85c9dd66b4872f099954f77d2830ae06ec032e2c3ebbbfc20523f900000007f71e8cd804db73598cd507d6933d46abf4a2085099dc01c81784818677d9e7b30d5ca0009c61bf3a4787deacbfa5e22b70a9425495d314bfaf6a1a96c8e95d219df74f1bd02ca35091cd6d918d25905b456b06bdf21aea1d1bbcd80e85506f056dfe0d02e2fddb156c595832e453babe47e713360764d3a8af48524ed9e506613caf96b68c8b0d4a96d9a0271755961400000006e21f570137694b0185a17f2650b4965ada3a4cde5a1333ba64c3c336c31dae8e4163cd3e9ea670134fddf4a188e31f11981302ad12cc657d8dfa51cceca1719	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c92000000000200000000001066000000010000200000004dd2b1d1180124e61f608d364a94fd8f70029938b4790060221bd0f31d69477f000000000e8000000002000020000000fcb3ae6fa33520f1e2ad0d8a572a1d5b293d146e360c2fb266f350182c1d0863200000001809b2eef85e8dcce193269b213e90cd82f8acaeb0c73f9e988a797c450d1ad7400000009e4938d08293554d1e6024e81ad173bf3cae2626a830141112c30e62f9dbc4ed74265e1274fdc33d6b0edab8d0ead400e5f49f15e9a91b4fd32e8719dcd6b3d9	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430257179"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3FE14D01-5E60-11EF-888D-D67B43388B6B} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d05a00166df2da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2508	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2508	iexplore.exe
2508	iexplore.exe
1648	IEXPLORE.EXE
1648	IEXPLORE.EXE
1648	IEXPLORE.EXE
1648	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 1648	2508	iexplore.exe	31
PID 2508 wrote to memory of 1648	2508	iexplore.exe	31
PID 2508 wrote to memory of 1648	2508	iexplore.exe	31
PID 2508 wrote to memory of 1648	2508	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ac401954b77b2f1c1045fe812ee96462_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2508 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd7817bc0086f85ebf8fa3d0c73f5e4f

SHA1
65fdafd04f28001160517b3a73ac061219879372

SHA256
149cc326c16f350f0f2feca1783f2ac7351371fb4cdcded93d44fc1fa645dbd5

SHA512
5987d0dd71758dc4eb9364de91c57329d3b5100b7557a69d8e907cc2217539469e09c92e5f50ac255023e41f6d2d521abe8b8150a3ec55c688c431208175f1b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93691bbb4de69428ad2cf3d3d7c23b59

SHA1
5635d3359d6c1b976a08d4b0a5dc189d72c63a6c

SHA256
6d702d6f18cccfe8e1003b81d576bce7a6ba28c3bc6895d1b0f31c7f94be3427

SHA512
c58ef99c9f407665869aac288764baaa14e668ecf4c6f5af872a6914333b9c3ad61bd54cefa0b49194edc2d99dc8b0194045d3294e3e337738580e8eae3d5f1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b7c369748af4d515b9ef8c4a42c6153

SHA1
1c57a8066e392b95bf6470963d837c07f21e2ed7

SHA256
367b82cb03f77fd7cf1b3adc69c8b7eca212571cfaef99d6a45616fff6d4d475

SHA512
dcdd306e7b04f8ecbe5c32402f40ff086695d7e09294aba7d926fdb8415ccce0ee286a72f1ec8635135acee2308680d87cb3f63b874ae17003219a0e8307a01b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d7062f8f38c8339bc5505c387c7db92

SHA1
f9625f1844c627cab9fe67c2f180a440c20607f6

SHA256
cf548b5782cde10a85bc7179a7f115ec55300bcdd252ee78925bc63a6943e8f9

SHA512
b09fb0f0040efe61acf8ff3d477316091addc0d4226d5eab80ebbd94de7c5717b7ae8f5ee16201b44037504ef2b1a54554b9f2b7fb1e54fb064e38b66cb4f624

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9617f1fccf8e675eda9da27ff47301f1

SHA1
c3327120fcc878d8afd000ee64fb6da9dfb8ecbe

SHA256
41084f931400624277099078bac4d2e9d9871eb716e9411524cb283a897f8abd

SHA512
5eeb0a8e3c7f97806352eddee24888bf2cc4ace204717e83567bd5095fc10078857eec2d1658dc8e5ec8df81469c015a306a3bb6eecda379c563adb035120fe1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d5fc7f24bdc280e896a13f599063f7d

SHA1
eb2a81256874341e721b644a72ce83cd03ca0eb4

SHA256
c2563c6e55799c7fed5f24fdd9d23c289265ba42d00a05ead0aa00bc53efc69d

SHA512
f99f824dfc2bdf8f9be156b21db9af1bed00d3229d83ddcc2e7631e79bd1961fcfcc8eb8fa60457f3c4ebff8d3cb8cf67f33e8572c413dba8ed85e970a29ea56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40abcd3d0dca8c1a6440bba58cd29523

SHA1
0b6afe28335c4b0428c592606e0cae814a6c4691

SHA256
d2f0a9d0b309389d028904f450ea679ae86be0aeb1132fc0f03aefe8f1febea2

SHA512
032d5c22147a3b5bcaac8b80ef02a779461c8801ed7d6de2cdc98e211caa7ddc937556785788d528d3536466d986f676872623d093912a5a235f2d7271a6b17a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46dc9a3ec75dd23b6dfb2fa06f8c9c6b

SHA1
98e06814064beb14440e2ff4967e9013c8040f80

SHA256
a98770015b567048bec389d382957af0dea76d2fdb3df88dc7f939d4458222e5

SHA512
9b756e6de6b117547cb38408f5a1e6d9c10c2a2c5dfe6fecce5acdc480e6ca77ff735bbb886e3999048b8a8c39f3dd0fe09451aca0f74376fbe1d0d34d3e25bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd497f5171410589fe82550a3383a0fa

SHA1
10d3a406390e3f4dafb0d5b848547a90f804c38a

SHA256
b901560b384fbbff350067f780f3772f54ca836049bf622f56212082354bc42a

SHA512
510531779daf94b1d4df74da8ebd3961fb89756f8244e0b6fd4a2585e7075ed77f2b7c5ef27ba729a812fc9c1f290f0953604743930b4dac998231e70f8e3e6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab147B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar14FD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit