03ec0e04cd5d27fe833f0319c8f543ead6bed1b8cac6563d713ae6943816cf97

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
20-08-2024 11:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af180b2f3ff59be4990d34e408cfc49a_JaffaCakes118.html
Size

18KB
MD5

af180b2f3ff59be4990d34e408cfc49a
SHA1

2082069d59b05707a70c3dde2726dc5622faceb2
SHA256

03ec0e04cd5d27fe833f0319c8f543ead6bed1b8cac6563d713ae6943816cf97
SHA512

4aa0b19cceea11724425bba9a8e2e64a4f4580e54fcd15e02db877a306663b9197758e4b4b0119c37dd8ac68ed0c47bfe7ca1a040b951404d3eec2c60464e8cc
SSDEEP

384:iwM1LHMisFmuHNIpshuC/lD2fdnhvuFZ27rtfEtieDqCVJezz7:iwM1dsZHNIpwrD27uFa0ieDqCiz7

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EAE21A21-5EE9-11EF-AB1A-5A9C960EEF88} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000009eec2b6932b5e87ab3e2ad99832309672f0528321c412e4061476dfef1e166ae000000000e80000000020000200000009fce00f9bf5a395fb5e49a604d4c0876169ac8f87291bb712da7cdaf9da3ba2020000000e2b396663b442c1df5c673849934d56c28c90cff69d1c8455666423a1fb20b6740000000fc65abe3c4c6595849de405c3350e6677ef990fc420fc7e82dc8c708c45c406e38b2e8395f8231ffbfb674f146875c1e22971ecb99de70cd1e09c133794c3e95	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10e78cbff6f2da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430316292"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000b4be75c5076bf5f738b82e47c1073011e990229a9b63dec923178e3b87f0686d000000000e80000000020000200000001d9e31eb645c93a35bfdb0d78ab0077a5a8d97822697e44ef59891e6729cdb1b90000000fe0cbc748cc411f5037aed9103b2c879dc1b66cd84eceb883fb6ad3e9efcb1480b88f8c5c6019eae344e961ccc701e3d0060692cce7d543430cbd1e14252873d377b099c4af65ca60775ae6a6aed6a256715b063151f831967e228ac54501d809108a09c20f0b8b0a6e303df0d18fff8d2293609c674acf0312f0e2b58e5d8001b11daaa70516ee41c7334ad00eee55240000000ab42b37634102a845ffcb1164a41bacb86bdaee162d8416a944f4eb721a18d877ce9b2bffb9c18ac4d51ddab3b1dcbef174fcf7637248025f83c0be8e9d3aa19	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2932	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2932	iexplore.exe
2932	iexplore.exe
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2652	2932	iexplore.exe	32
PID 2932 wrote to memory of 2652	2932	iexplore.exe	32
PID 2932 wrote to memory of 2652	2932	iexplore.exe	32
PID 2932 wrote to memory of 2652	2932	iexplore.exe	32

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\af180b2f3ff59be4990d34e408cfc49a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6dd04284148579446340f2a573bf6603

SHA1
f37d07e0abf52c81f948f888dec41ee53614b112

SHA256
497d0e91c01cf9c5ab5cd8f6713677b4774af91fbc455ca65dd84fdb01c1435c

SHA512
eb492bd4102902dbd4db26299e96f757d808172d36801a5703cf8e817894de84d9ae44defc294203f964d3cfeb755b1c3a6461ea1cffb68a1703add090e5cf2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37b272c9c627c1c9f7207b0124eb604b

SHA1
5d65801303028cab3489ba41dd6bafd3e88746ce

SHA256
317945e6156cc1191bb750915893ee473812809d1328ab9e8b0732e76c35c288

SHA512
b1e7c2aad946b6f6575212a2aee3d1a70ea3a4596e7cf29110002afe15582547237a9d906a390eb32693c461771c32aee686d7fc53bc3fbd89a067069d02278f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
124873155977f61ae7300ab68ea1e6f1

SHA1
33ca049c191c2f3d05739327f6ff2b784aa8897d

SHA256
0c3130a20b58762985cfa031da11bf9d6ff1c9649426db2db14d8383bffaa219

SHA512
36fefb7a2442b7d1e293c95d6a5099bb544c6158d1c25eab4e4883902698e3ee76e492ff5fdeea5ad96ec7250b2313e6f47d64eb37b465bf65c5b9c4008bab69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff47ae002d42d1046da785b9a59b5b2e

SHA1
d27858bc909cb26629f80fc4c7ec90ea07228ffc

SHA256
bf35c8d520643613920ceb75279a31d5a53095eb150aae6d489786d5239ce665

SHA512
8ec8a34982f2e747da8db523bc57b3233e490c7e3d4dad344a3fa69676a3f73d15843aa5c0de34aedb778b76b6048a13e48a23feee71f6bb717b43a8b1dce9a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a37dec95e124ae0766fb448ed9a4add

SHA1
d118453187a18169d3afff08164d669b139c1d68

SHA256
d5963795b82376094cec84c13a556ce2f3950bc021947cb1e6b7357833931d80

SHA512
3a327a7ceab465ee6caa356b0db55aa52cbea132e62364892267a2416222b89830306d327d36332ca431f4166661b6ad02fecb679b9321a100c6d303fcefc123

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7fdf48a80c30971e1c890f7dfd998162

SHA1
f42a0216d4d35c2f84c3fabb117089caf8a0958f

SHA256
9ca63c8d4169ec522f2ab4d598b88c0f0663d69821d3a3d49f9ab40e85c9efa4

SHA512
ca062ccfcd45870b15b7475a7ecd164bfe18db1871e293c94311b69d2b9b53cc202ea07eaad0f639499936528cc6a507a28042cdb420a004e1ed0122b6edb6c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2befcf6b9628cb65257df3419dfaaad7

SHA1
36ec14a27c37b9466b3b12a1c835bfc250f7faec

SHA256
bc694ced709bdc91f6d35bef519c6c703c49c578c49c4c9bc35f67982574b28a

SHA512
3d00567fc037464d442aabb019e0f0eb2dfb16776d29eac623d3fd7e7c2517c7a8f065d257351c2e95e9a6adbd0794940e900624b1cb8dfd0ce8788cb423c0b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb7dac99c924726fea3059aa64b96fba

SHA1
600df521c6fba800a461dea26bd56646d3d014c8

SHA256
d7248c997204ec576c3f873d6735ac9a8b6e7abd6dbd7e63fd6e4879bf9daeaa

SHA512
a41b2014b47476005a7017d35bdc48e51cecc818b7e05377b67488e81cbdef5b4263b9ff3f8126a5003480243211dd5497b43d7b94f496838cc5fb562c34a586

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31d3a073bac4154ee276636ca2c22eda

SHA1
02d54c44ad417abcd9de54d54898f2cc530d24ca

SHA256
e6bc5154ff53dc6085c1ec0f0adf866d076b7c3293c5fdd71884974f7d053573

SHA512
b9f6508f2d5feda7540adc9dd4f99bd4af199cb2a3d7d7469ed928f0a85b68580988ec282be1e64070493cdb727d585e21f665e89bc77fe80e0e9fefe1a247f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1fcfab9a7e622980a2c5ef724600322b

SHA1
c6bee777a48003c63bd3bd2cad8141228877a640

SHA256
d42cb81d465b0e8a1d0381bd5a22582b5c1a275e6ea8a02cd08e141816c0ae85

SHA512
d531b2d5d7bc3c4544439277664b751b75704a4d4e12ca7d32b2e7aff57041431be164344ef65adbba889e9abb9297e9877491996d742730dedc8cf10dfcaa38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31c42fc291dec9344a4e01de4da31ef7

SHA1
7a594a64d6aca36296a96f9583a4c545fe317afa

SHA256
8d81a1a53d93ece9c714c0c9d42b6ff230b8e85039a0e05274bbfaf40b1f0c4c

SHA512
9447291671f4e9550d7c883ce347bfcb15e5d4cb80008fa886dc12b23bcec811ab08286cd13a0f22e3b9646ec56b12179649e6b8857d95873be1fb9bc319f91a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f1c9691389b1126ac52eaa4dc287ac0

SHA1
845c052880ff35b48a768b50061b5222090d2a5c

SHA256
4b280a8bf23621311db269f06a495537c69c0ce97fcb429ec4b4d916bbbb08db

SHA512
b7ee9a9a87624a78f15bd9b72733a4273b156926dfc6399f5f4c123abbe60bcb0547a50cd1d39256f01791945a15012fd6135146186771fe1b0e1f81b9cbf27c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cdafcc99ab4a435a8060d96a3690e254

SHA1
b8fdc9902312b381d7ee40068ca7ff909f3417ae

SHA256
e2e6484b6f064bc51a1a7546784af1588a5da72af8a29fb284d6b56734b62aeb

SHA512
3e79197c2ec28c7e9c927a421a9386cc8c45d1614f994f8f7f3df404058e1911fd0ce884ec75f1e8edb512cdcce971a87aae5479df45fc7273dd1683eeb0e408

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c10dd313397d5df8caebf9e9e8dd9e09

SHA1
453460299cec3b2500b13fdca8849985c438ae8d

SHA256
5906be4b6ac7d1040f8e571a9d694c2f8ff2323f1f940ff64889cd507ccf2b93

SHA512
68ae1d35d62e95416c0580f5cb8aac0ada9664c475faa9c4e663916401e3223b94c594d00ae6eaf1bb342e25c2fb42202e8f193d3760bb76df63df8954a2152f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d268c145234f98eff1e4ed824800ee7

SHA1
e7462ce9730f17b2561711e9528e6690fce0ddb5

SHA256
7e3100424f9d17e708dedaf172027f4bc7839166e09aa3503d10c7c7f6b60fcb

SHA512
65d438c93870d5b447f95502bf7164f2b24a194a9cb0362af80b9dd701185f62ba804931060b6ce2b4d1f8efeef431d091e7a573531be027ff3b62aed5dfcd31

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab300.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar370.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit