433af11231a67ae4751b004557c69fa985170e91deb84dce0be9e06a1845fc0f

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 21:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ac9aae8da94bee09779888986fc3729c_JaffaCakes118.html
Size

572B
MD5

ac9aae8da94bee09779888986fc3729c
SHA1

785c036f4a257637d5c5296397f4558c5e4b6e60
SHA256

433af11231a67ae4751b004557c69fa985170e91deb84dce0be9e06a1845fc0f
SHA512

49fb4a7823372322c6a6fe00ed6fa3b75fc41bae3b80531f738ac69980c91e5a486a32003437e5fd6ccb64ffe7afa7b6e676a1f821e815a339f40569eb7bb8b9

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf710000000002000000000010660000000100002000000069e184a52802483b8e0e38233740563557a67a99e0a406f5eb42d57a2d99a86a000000000e80000000020000200000008489bfeda7bfd671f71d6a18d53b96e1b9822bfd8aec07f5da0fb5ad4ae8bf9020000000232f658037ff8ce9d8a4d806e194939d631577f8c1ba546b84aa76aabe8b7e4d40000000bce2585f55297ef5c7e03c84d001c4450b16b47c512320611e8c933fd49e7f9d599d28f649cc6666d6dfea8de519121e73328c64ab7329549437e65ee6fe3ea7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0e24fc37cf2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf710000000002000000000010660000000100002000000066e0c85eb984cb6d5e9281931d9780d7a8f98e323495c535ea7da21f725ec3dc000000000e8000000002000020000000bb90ad6497b28a5fe0e72b15e0c8a5880936b52b5f9d6ec72f359aac780af5fa90000000a4231f83d1c56ffb8d7df82aa058c8245dd13ea95ac3944ccd32d08127aa479ff73c1ab0b667df9efeed6ed02f33f37b896d9ccb20dc29575e8f25bfe3f8c8ff9b6f19b60409df4ae818c8587843916f83946b796d9d05cc2d55640b850603943a315d06dfbd584e9966eb364b60b241be3e0b2ae72d67bb603bfc4303229274212554ba611f0d53ddcafd65f45908354000000039c777de820b8e97d7fd34e0480ccdad3ea3c2b07b5fd1f061687513f8ccd00850a418bb0b9eb2951920d1b57b4e26796d1543eb73cab90a893426ef2f032049	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EED60171-5E6F-11EF-ADD5-E21FB89EE600} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430263899"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2140	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2140	iexplore.exe
2140	iexplore.exe
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE
2820	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2820	2140	iexplore.exe	30
PID 2140 wrote to memory of 2820	2140	iexplore.exe	30
PID 2140 wrote to memory of 2820	2140	iexplore.exe	30
PID 2140 wrote to memory of 2820	2140	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ac9aae8da94bee09779888986fc3729c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2140 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13233a69a8929b82652893fca5e33994

SHA1
f63ca176baff18eb644640d44e997a957565a81f

SHA256
22138632f1a2603e06c63d7a2b85b0a610e227e0a80646023f86e7fd205009a0

SHA512
96b3f977cf996e6ab59c1b94549bfed158564c7dc540484a7e46992599d18c1ad7468cdd69191c1481c9131f10c83d8274ae09dd9e530e09a48a85c463101009

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51c51a7d831e27526c0faf341a12f003

SHA1
136e0fc6b2a374e6188f9b7791ebc0a1a97a7465

SHA256
077464d486405dda1e1ea8130519cf866c5a588e48360e8ea9a24667ae3ff81f

SHA512
897061eb434737336d578cc975a9cfb6f4676e0031958023b35a650ba5256ee0f05dcb4a6e8307a3d9f67c396cfec9ccc2712efdbc2f349548dbb4df6e15ff6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9d3b4abee3a9de8afebbb565092fc7a

SHA1
e4f97931d9af71f643265bcf20384f9c1c344df0

SHA256
03e77e63a40a0a5d3c912553a95714e63f6dbb2c2a78ff7b635c7dc80c7f077a

SHA512
80f52f2a0cdad45a9e2967f47ae6594f2964b9d33c4e8224c3f1eae4a4341d2c041e06014307d3382d8155f721cf41dbdfd3d832c5f915349371db3225abb0b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
adb4d915a3aedaed9aa1b89517dd7e75

SHA1
c8f83fa87c06ee9137cddb691dd18119d390aac5

SHA256
28cbdc456722738f041d6eaae5291f3880023cf6048afe3951a74fa923e1dfd7

SHA512
f49f4c06d52ee3517137a0631373fd7225ea81ca7fae29d680e64b773ae6dc7b4877b97061b385b41f39cc68ac8ada158cd3a944680de174f676095b960d61ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56fb1933201f63452085947cf7cb88eb

SHA1
d2ccb455385e2ad1e8f9a44ca7dfa5be5e14770c

SHA256
3420236ce5c43771f1d80b90679398e79f10dbb9fa14eecdcf0fa7f3f89f9a00

SHA512
4ad004bc786a63a5a9223e6d5ea821fcd99b161bcebcaf5d31e3b8821f01baffe73a1225121a19e2e0384782fc0f4c35122e0db0b563701a734c06b0177f3ab3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69f38fd3094a8a8c8eaed80c6dc0a7b8

SHA1
e19cf0cf311be49f5cb6a99f8ef678cb81d37b8c

SHA256
cb4aeae4a8297dea726dd779aeb7353a6405d20690d8d4a3a8353d4c06d652bd

SHA512
11b04a3bf2d8bfb333bc52ee24458964505d2bf2173a631deb58236a13100f38387c5141b0115ad8951e0f7f1bca8d1c6bd2c0d46f5cc01835a3713119436357

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97d0acd76be5e2bccadb53500d2dc8e6

SHA1
91249b94260d5bf3a84c26bbee43ee2ad01b9d5d

SHA256
7374d7c14a9f9006ced876cdaae6cff83f91a7e815e67a99a64c9247635405c3

SHA512
789d5621730b137006248942acc7347f6094a9f86729cacab91b57f3353fd75bb4b5afc6c3ce4b7b68c0d0042a35e50245802d49d6be1769218108127df99b0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be0e7a3a009752ee6ba84c4d7aa6b2bc

SHA1
11dd31818e303ca781e05fef628c5c3f1b1ed302

SHA256
16cd5040c1a521835b442480867f5be43766c46b2c8b1f27bb3d81a55c8f5cec

SHA512
11ed132f547626d45da6eca02c46612e4009059a7a4936f189116de23d5d86e54680b0e48b1f717a5aaadcefe3fb2b5399de115a7eb72bb5305fb125e1365754

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c88a1223fdf4ae8ce980f9fd70f434da

SHA1
bed4c19caf7d4ec2509be26c4e685135184af940

SHA256
54b1640a886f7807fde500451a1259bf8f4de00295fbc93a281894d656665588

SHA512
5ced3c5df09bdf64cbbb59702a1db8d85f4aa8fb804af45ddd8f9504314788b4cd7f1a8a29d17cafc856d193f5362caa25a0c77da988e690418053776587e498

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85b7b399eb34b1adf0ce680b139344aa

SHA1
92b2f4fa37c862c725896070c80c6cb76a0d3d7a

SHA256
f0733b82a9bcd53bb2ce9a067b1c82b3cdd5157f0442d2ef81fbcb570738d45f

SHA512
78ee08f5f41a38d4473c6f369e34537e196cdb668ab25d64db7b7f8b30e67790947d5a37b2f73edbe0010b17d0a406f4c94a3b1e1cc2d4d3d5d3e52553c01a24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2a5d1180e70e1a7be06f7a427573b5e

SHA1
ba93305b74645bea9d2c552aeb5c577ab20316d4

SHA256
10e90df0acad53146080c493050396c01fed349faf5a87f391cad6a3d6c7e77f

SHA512
33ec6d7f17a0b70bca63afa40c24a6c9f4a04fa4cbd80924f845d33c5849aaad7aae937c7a45ebf6dface9c2ffb6b8674c9e2bafceb72ffd57d073756c8ef81c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3632118a9a0e789f901f85b91f554655

SHA1
58a831cee129aae3487a64a4d8ba86b3bddfece8

SHA256
b9964b5b18c297ca73d81f9410ae5b82e4422ca6ac76159ad5552eccf715e3d0

SHA512
dc3fbf754a146190322c6305f9d3498ff86eb79f0f25df8e7c3e27df3802404a412631df877db1f163c52200e13eee3c5380882cbd44acebcbfafba9d157e847

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
554f3eb6763ea55a6a54a4745da0f228

SHA1
8e64fea29130eb5661c231d31c7344bb0c6bc929

SHA256
352e5f6f6426c614f62cd11427cca2bfc12d18d89df7858224c17d2206ee5ed7

SHA512
0a39d45a07fe7ee2c6725666956505fdca7d1bb92ec325f4b4de3afb95885207b7f6724a6a5b192149566e57b0643aa159c70a2b457c5693f2ea47cc27e11ca6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f85432f0f868afbcf73653482ead968b

SHA1
3cac2362ae19bd3f8cd3e382e48b3ebb912b91dc

SHA256
e7de78f36eae8985c6947fe15278893a66377f1e43f772fa6bfb41cc6bf577a0

SHA512
c7b456d5822d9e46fe2fe3df902f1662f72265c9f6184e8d00ffbec21de40bdb0fc2df596c41e4778a0a01af50768b7dbc78a868da1ceb8af84926a4e1e8d7d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4fb5f7ff9e5495bde4478771dfb611d

SHA1
92b5c3ee0191a005bf744805416079f5ba0de7d5

SHA256
5248498f0ccf4a366cf97b817ab1351799b39a686d0f7fa69ef5e155fa3d5c79

SHA512
6434c0e62313f12f3acd166769f6aa91efcfe135eaabedcaec6ed1cd56ff10dc02730cb5a2a1b0874fa5b990dde73697b8f2b7072593376b30c3ad89241a7ca5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab42AE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar434D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit