e9b66dc481100f2276f410f0b6f803365fdd5a4f8904b66fa5a4f7801eeac3c2

Analysis

max time kernel
121s
max time network
135s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

af2b8934b7d579c4a31802d6f4ec71f6_JaffaCakes118.html
Size

4KB
MD5

af2b8934b7d579c4a31802d6f4ec71f6
SHA1

5d3c2e39abac3c70193218e6aae012e9c0abf599
SHA256

e9b66dc481100f2276f410f0b6f803365fdd5a4f8904b66fa5a4f7801eeac3c2
SHA512

ba8dff23b09e3519797c763520b84567925d4b11804bc810ff51b8f7a8a010f87955445855f488add903c5b52e41ce6ce231eef7494a7f56a86c7ddd3aef353e
SSDEEP

96:dRpRc1ohYAZw0Es7egnY8Rj7OalhcI8P8SG:dRpRWiYAu0b7VdfJ8P9G

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9B9CE6D1-5EED-11EF-BCF9-7EBFE1D0DDB4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000090fea0c5bcfd04e866fac965da0874b0354f109d9c16068c008a7792f31d8372000000000e800000000200002000000024172ff98cb82139d3d882f1b3afa986f555a887d13ddc01325f39bee7e651b020000000d0e9c21dce4559fb4ffb7482198f2af7ac407403df0af1cd5a541bae518e996f400000008ae6e0e625f6a2ad0271e3e86333f9be947efdd69bfa915a1eea0624e25662d1a387f63ed2b3fa5e9ae10234aab991e9195bd33a8bb7adf93845946b111f083d	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000559ecaccb5b67ac817d624b4effffff3891d1e010b647d3f5e33763f37c6e235000000000e8000000002000020000000380333768913f38c48943ea0ecf2c3660a6c5633d5b03242e668735e3beea320900000003b94fc82de7f9bb36928079d8a93f794dc9379a76fed80aa9c8b8e1f2d244adc62fb2c2cdd1206f2cf90f0249aaa8238a78a3ec34cc661fde59534b02b3aed5f85ce43c9146e92968a322f59a8bdbe91ac0e63564083e79c65b6f73867f5159f46bc8eca63accab936abe4ed70dd76f2a25871544a13c7ef18906be04927e7be35734e845ac4a4644029d6be2a70c92240000000a0e5ccda8094b682c09238be2251ce87aea0ab984e3239be5de3d2678fc7fe9e0d8cb0ac18ad47bc30c438ed050a7aceef18f3fbdea68f4fe44e180a638f5c98	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430317879"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50449089faf2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2668	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2668	iexplore.exe
2668	iexplore.exe
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2684	2668	iexplore.exe	31
PID 2668 wrote to memory of 2684	2668	iexplore.exe	31
PID 2668 wrote to memory of 2684	2668	iexplore.exe	31
PID 2668 wrote to memory of 2684	2668	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\af2b8934b7d579c4a31802d6f4ec71f6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2668 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1ae5f3c4ff381967852257241b23f39

SHA1
cecfc04b98125614c60bb46715a0dcf5041cdc91

SHA256
2ee7be44d3a4041cc3ab7ee6fa55f3e22409d86b17f7e44da0b1bf04f5b8c4b5

SHA512
4334d497d56938db2632126b9ef92254064bc80529648fc1064b49872e2e4d68ed294974622eb6687296a4cbc0a4b2eca96cb9e0302f9709a679cdeba9d12285

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94e0b11d18685961e9e5efe9a0a9057d

SHA1
4334a2d3a3991001eb6aad81008451627583dd91

SHA256
478014d52bf22be8df733c05bb02482ef05f9087a5dc5cd65d351a82a6043720

SHA512
c714af4ed35a51e7b9d0d3a3a7c11f31caf85ddd331fce8126eb0e3f1517ef40e2c4760d3020c55d80cb8e6ab67fb9b3fe36954e064fe305b6046d13f1bb7da7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c04708d16a75844dcf7f77077b14feee

SHA1
3147417a54f964cd59fb3222fae807ae3d0430e8

SHA256
0fa53ab5753c857ed6f4fad87a6e7c3e06633a2ced5cb49e1fc96788255376f5

SHA512
dae4c51f3576e78c92509d00a09f7c53ca5b273e22ff6f471f5fca7966fd5acf00ecba3a0e0e35dd999e9ac6db2262076e22777382198b8410e3fcd44a96a0fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5b4b9c37524a0a4bb528793c7db936c

SHA1
149710344b429d9aaaedb80ae664dff33fd8fdc2

SHA256
34b93160ee491ddf87759f6c3ed73f7ab752a6e2545c268e0d1aa85a59b625ba

SHA512
29c394e4641c5c4d4338887d138f31df4837cd9946acd5e139215fd066c6ab52773470658e30e415e3686fc7042a7325c548283668a7f36826e2a8de3d9d74cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd54d8bf85aadba75e02827c6876e36a

SHA1
5682dabaa8f3e6b5d8a0ccdb42393a82cae61cd4

SHA256
22c762aa8348167743b2d60e9830ff6208b767689ebab29d6acefc1f467e1921

SHA512
9bbaa62acb6e1d416a6851e982ff67149be690e9095a7fe7b7f9166fefb47ba854c3f676d4c459e9420ad8d43c386d892255b18897b89daa6e0c648a3de9e2b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03f950c2d28ef58b347f2be2a37a5125

SHA1
ca6e262032c2b4dfb748abd4ac7552182db7e6cc

SHA256
84078f42e077270fe8ad5f2e3127597c05f1e8d3a211782f72c09fe08d1a5d81

SHA512
c35b248c68e72735207c8634c8da0b4a67fa7165d1a6014d25a9df1880c91b0b6399a915e85c4124b93301ebbdc6d39d1ccf4d3c4746b344bc70cd9885dac524

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8dff65f79d6d60d039d191ee5af9ade9

SHA1
ccf906ec82dd07dbaedaafb7934a79aa4441ea3c

SHA256
6b65f63e1ae7419530e72d894c45c06d36fcef50d81da0a102bfe8bf801b1dd1

SHA512
b66b3771fb228e5fd7c1f7fd54fb468099a19b967a6cbafd4cf046590fd74f9845b7e499405a9b4ca92f97eaa89fe6cc2b85f6db52dd1ed36f0c57c955a13c2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9fceff568999c4965a242e2cf1b40977

SHA1
9533189e47a3abe0f0b53c4861eb6de15920dcbe

SHA256
711f3dc20090e185e005069d772e231f28409600b09900935edb71885fb7718f

SHA512
47a55a54712d62fd6537b14fd8d2f04d2e987dab43e68bfabb155dc1c7eb286a2f383f2023b092cbc5c89fbf4083e7a10970608611b731e7dcb1607f7d36e9ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e809b4265adeab55cb925227fa010a24

SHA1
ca4050356bcc9918cb06a12f18a9a3e76b5c7d56

SHA256
c86608069f78ad124b93bb5695e4d2659d480dfa4a4285445f620af76c38bfb8

SHA512
47e09411043f14b1ff926f737baf72a51b319a584fe3df168c4d83be5f616e2055ecf3afb4cb4648bafa9ff41ec4e81141c0223a0d44ad8a7d3e1cbac80864d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8bb3ea0ef8898443823cf4445d27a8b

SHA1
c55d5a747689b188152d78d38c342221a7cf1c37

SHA256
05a7ece1b53a35a47939eaadd25cab27bdafb83e119f1ebe10a61b3e4b588775

SHA512
bfa9af714105e65e2ad761b38fbcf983fba5d44894c6f663ee78026ba00737ec68d635679891eb1116e6fa8e48edb5988fc6f85b678fb7bc0ee097df46ab4c65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6e0ba1461e1b8b414fb40f918577da6

SHA1
760630ac9d8164e7b7da91f37d0109fcb9c5809d

SHA256
93097f79246fadb75e07427ba7499e028bb9f23768e764ae5e5611df96ff5cd6

SHA512
4433340be4bdf13fbbf635e64b3cb420cc493d4cf916d5df41be5be597e1a934ecb17fa477f8c3c9e060900847847764c4aada4b387712d8a80331ca46dc2ed1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
367515079f406ea749bf473c9cf85f03

SHA1
d0a38e95ce5a102007c0561b2aa79efe498d288e

SHA256
dfae2c12e86a36537e35100c129bbe6b2c1565638ea11e69eb4af224b1d91497

SHA512
42b544f288bb1aaf2480e672b5da57a5d7bd08a3c11c8624b9383d87d7208286da2d2bc48ae202830b51c3f0fe25bfcaa1c647f7517f5171e46cb4cc028b09a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c0c1e30b42bb831231ea8f72d4420cc

SHA1
0efbf25f24964a2f44dc6e4c3fa310433d38f954

SHA256
32c775b551f957def2a8009b47ee0432ca49674ab012a6f10fd9b9ac37bb1b95

SHA512
d56d83af3675cb07e0aeccb0619081bd701af6585b5c7f2d0dc7cf4d53c928ae9499383da8e45355f4be57b2411b6b1cc5eb7129b763fe47deef920bb1c1244a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05589bec815e50e53e065a8820e9d4d6

SHA1
570319b6709b9eb6682277a97f558adb7532bd44

SHA256
d49cd30d2ed87e935bb7ac47b7082af11196272cb8bafad194e507345db2d099

SHA512
8769e8d0a1bfc427e94af2842648cffe63b0ee51e8220c17e765ce5beb4df63143fa207a2e34f1850378bd6b6ded98f9de1a7c2c00d5a7cf97c714563d407378

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4668b78752ea9e90fe10c97f4023e875

SHA1
82871ce71a4ebdfc2133ad79f05ea2bef5ccf0c2

SHA256
52a1207c9bd62dd855cc687c11eeb57bd060742cc05454a9d079145be44f7f2f

SHA512
d414fe81874860084d6c3c827cefa10525fc2aeaf477e138656e360d5721bb6946f031f08c238dd94712e08ccaa86a74af8d8c32c3515b13165f8545a9c03c31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61f806a0562805581f8dbdeae52b0d47

SHA1
16fc5a9203f90a69ffda7e3831f63c0e2dffa73e

SHA256
7c3e7a1240757f688c218d9e7a99ce955d68f9888c9bb9a5ff41739eed60327d

SHA512
e863bbfd45120c0d07c2d2c46922a56128041e3fa013a8effa4bcd8445ce13afde17dd1f95a5da9af7d2e253b0ecf3c4f03b910931b0899466a8653b41c435df

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB4E0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB58F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit