bb6c4d40acd835ef81553beff87707f7486b58e91e7b3a623d5dc25cf4d7cd34

Analysis

max time kernel
139s
max time network
135s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20-08-2024 11:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af1cc5a23ec33ebe8b4ee30f06e6dbf1_JaffaCakes118.html
Size

10KB
MD5

af1cc5a23ec33ebe8b4ee30f06e6dbf1
SHA1

4f8caddef172ba38bf426409bb19e36a34ed0a4d
SHA256

bb6c4d40acd835ef81553beff87707f7486b58e91e7b3a623d5dc25cf4d7cd34
SHA512

228eeb392669cda459ddcb1fdeb5e6240334313af1bcb1532d40ba6474e0ddababedefe62cc0dc6fee38f0e0e616f1a937448c149ec2e9d3174e553131af8ac1
SSDEEP

192:IhJu4M2XMnnHKmg3g5vGd2R5ZXhPD5P14C:znHTGd2R5ZV9KC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DB1B62D1-5EEA-11EF-BCF9-7EBFE1D0DDB4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40f437d1f7f2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430316699"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000006faf86909ef1784a8ba46489dc2ef1030638872b33d67a56d48411b7605e07f2000000000e80000000020000200000007694d050811b771615fd384bb96b00f4781357ec5f8be05a0eac50d8fa0255832000000083dc56c2c7bda68759592df39c54a50100064172f14717c8e790dcaf74da708c400000006d0a59d8b3c73f589f8cf7c05bbbb763218e8bf9a3784f4616cd767a1301ecaa2e0b0286e8552743adfee7a519f5a2dc928d0f4ca31feef9abcb06ddd06cfe5b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000005cc3a4444c7132215dd1a235217fd16b3901e38961ba547b5d244c62473de2db000000000e800000000200002000000066ca681c2f28130b6553fa1216408bd36b3cdc9248332a674df48e9faa5d3b7f9000000090a1e44a7134e550c5df7e359a34b02b687a12ebe07cc99c2453fbc53589763dae293587787baaf3f13386790ca16791d7161bc2d98b3935718f80f0e9bcf828a6c2d09a41827440617048a569346af5e571ee55a71e2bb9b6f6d80fd2cc2c887f0ca3ca776640738bec331b2d6d407001ffc317b7361800b9942830441093290ee111729ea7cc7795986d37f8ebe25e40000000167962cfb57b22dc8947961c34324aedc75fa845c4e02eede26165131314ea8ca7fe3881e9eb8a1b9c55f636384be21100f994b5aabc3b38ac8ed24edf84e555	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2372	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2372	iexplore.exe
2372	iexplore.exe
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2680	2372	iexplore.exe	31
PID 2372 wrote to memory of 2680	2372	iexplore.exe	31
PID 2372 wrote to memory of 2680	2372	iexplore.exe	31
PID 2372 wrote to memory of 2680	2372	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\af1cc5a23ec33ebe8b4ee30f06e6dbf1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2372 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1e0e62287feac3e8500107c3fc24782

SHA1
67cc963ba30d4fcd308c96c07bb0469b2e44f472

SHA256
92e31d60459c2cc478083ffe39944df6e73d695b475ca3ae761e2273b1420ca1

SHA512
2255b07d67350461442ad43534b65894f9b4992374d346fedd2c8d43e413608c734eb33ef569eb068334368b5655ce9d6871a0dc928131406ad243b01c1080e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe34ef5d94b039ccc2f37c747844e338

SHA1
6715c9f4ef5f0fadcfda85adacdb0ee94c73be5f

SHA256
7f90535b710cf87284b42296c35b1e97c1923a896da66fb43c0211cf493c13c3

SHA512
5cabc8a2f14336789597f454ad56f99bd40ae7db6b0b85e22d948bfcd457864f7fa97033856ee9f2f83497d66f4849ef8b65b6f014c9eda253c5eb31967a5839

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d429d4876bcbf3b89d9e849dc2b6462b

SHA1
4e0fb3dc19170dee2895d1c413c979480b18cec8

SHA256
0d33a2f17232f74e0a507992ba361e176fd6d74e0981afe521591bd09e72af63

SHA512
463dc1fa8d18c54c8aeb6abd37871960b2f51ccd7892b7be41ea107ff13924ea415693e98a844c5955d028d021b82fa82f19aca66498a8cd3d6b5774e08a270d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7665463d6ed74f6cebda2562e45bda56

SHA1
97ab07a0bdf40de5b6577c698e28845dc41c80de

SHA256
07d2c5b317627b507bb683126470dfad46a197468380a7ae5288464622b304e7

SHA512
6a2f609d8f1cde731e25ccac70f2dfc539180123719ed2c058ca31a930be5e19caea02a1138e3841cf1970bfcb13d247f3abcced82467ef19390bffb0cb28a66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67a09a767a18e47e040ca25e897f3b06

SHA1
5418b8943de28aa0f7aba997b1e42bbc1a6eb6cd

SHA256
25c8532876d3ba6a6e7d8f359e94fdb47368982f917d2b15e67b717e1e0a51a1

SHA512
3718be59d5cd4ba1edbbddc2dc7531747084b8ce547e19c5bc7594ba7d84344190d1d99d4ba954f89b273606bb67169ab8f3b62008180df83e0a2c5529668f07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9307e32b8014b54ff3301fd3ece2452c

SHA1
eb81a90ddb96a024816b4a1e12e97d9b62039cb0

SHA256
fc034346bba62736d19b7660792793d3150807b7a1ea895c9694725ddaae4add

SHA512
4220e813b6ac0359a6a6a53def459ed495a3f4370a1d13d289ebb8b18afef9bc041489d9924d14d2e1d897f4237cd4211e6b83b8e573281940d67b3fe58b1b1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
403a81c77b5730a81cb6dd2d2ca4b14f

SHA1
9bd4b9286626764b848be4f23d4c0e77c1df93a2

SHA256
1e8c3a28977b383cdd6c56887a792a58528c7fe2cea260088bc7338b32d9b28b

SHA512
285b2d8b9450b35780a9c7203d5bd4e1b5e8238af4d5b26518a61bda9be68a79496185d69261f57ad47a81b926f53217977f99d42d0150912545e2c56d11e19a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6f394998e55f65e658e3cfc34b12421

SHA1
12133eddd8746ce5c11859cca447d34c31a2954d

SHA256
a1980466d358d3c35742464f34ec33a6d01ef3abb457cb3f96ccb6bd109bc491

SHA512
b6d4363323e6f67f59a1b42f6ee46fce9ccbbb076173569749d2166b9caf671a2a940c615c95120b5820900e36b3b1f950871b681067b7a7a8824ac5c755a07d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be083f8b6a32248e2d0c9e3880b9fc8d

SHA1
808045d69a77a068dc1cc1c0c4b251efa3d1906d

SHA256
5a6c5a8bffba4ed807d83d65ae35cdad20347b77da4074cba209b5bc2cd3a787

SHA512
9d98b4de6d481c686fc3b51e04a17686289c96d1d5ee530040fa8a5d1b96884901e234dd6fcfc73e26ed7c18b5e3771585ea9bde960a92eee7632f9bdbd15b6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24ac9878387c6aac1406e5fe5f15af99

SHA1
03d29c703638bb67d6d03982a7ae5bc3086e7c7d

SHA256
7562a52db4d0926390ae770d433fcefe0dbd473ba2c44213a4f5ec973d1052eb

SHA512
e8eb33d0b401b2cd04f10ce2f3f003144dd9251e3bb9176b9964457a52a776e07ecb97e5c22cb13a124c54cc53359b7bd777b39a6b0ecf945974399238827878

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d719759fceefc641176144f6fe1625ae

SHA1
469a99dffbcfc9784142c0ff1bb002a0118e84b3

SHA256
86246866d4c5a661f27dc417afb5351f58f47a2fea14bea4e5b009d20c3bf23e

SHA512
d3761122f0ea802a1b91b4d9745ff4df7f5ae7253a3cd7d8071a66becb775c3c33644cd1a6b83123d8cdd7f8100f91e36026b8fedfec1c2f0c9296bf607af75f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9cfab3b11c53d94dcb63cb093465eb13

SHA1
2a6648fa1a35cad93b15ff902783db23c41fb402

SHA256
992c188c8f89cebdfe3144581db8b2944c98f7c3336983f01341332f90c7d3c0

SHA512
6b3040a3f916c9c548f9789731d5c2baf981b4b5cc27433f48449dd1c26335fa75244d0ebf4f9548ebed46ee9e3ba2b410265e3b4990462d077773ab2956f651

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE478.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE91D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit