24c1db10ed8e9949d5fb98853701caa190698575c900d0d6ea5fa85dc8490224

Analysis

max time kernel
143s
max time network
143s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
20-08-2024 16:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aff9fce037a41e6038efa592cf3071bb_JaffaCakes118.html
Size

16KB
MD5

aff9fce037a41e6038efa592cf3071bb
SHA1

09be806c83d3c4d11f53afd911d196805ffa9ec8
SHA256

24c1db10ed8e9949d5fb98853701caa190698575c900d0d6ea5fa85dc8490224
SHA512

6354eb83055e408e4637d15ea0c39c91b7103a34da47873b4a3511cf9b0a441a3216e8df42342dd9e24c6a044b6869f1ccd5e5c105b2b77ae8dc9b0b362279fd
SSDEEP

192:FB5aMD6oOWsxcbGDZQgXnMaaC0cMwBIc/vyVIvuaoUd/3DoIvEpdKSviQ+E9zHK7:/QOqFnHz0+vo3xaIJENVx5c4SK97Rn

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000e87fccc74c9e8ce3c4ddd1bb99fe1fbef407a4f28187d59dc4e96ee585d56865000000000e8000000002000020000000e110bc48ee5bab73e671a9d6ef922208e13296bcafc87928fda774f4d91a32f320000000427ab23cefcc1c2ebc33a0ed56640b8a53213264b407726d2acdb4303a3b266840000000a445fc2ed7dfe8a6db0d50ae516857e448911445cac690da36da4f2dda9e96aa84a68a2f4ab9adc9358e34e6b8a40c2b429cc18fa7f3b5ed7ece5971545fe01f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AF5896A1-5F11-11EF-A4C8-72E661693B4A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430333370"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0fcfe851ef3da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb90000000002000000000010660000000100002000000059fa921fe3d83955fcefd97feba9675f39a642f56b8b0f554bb852a3eaa0c0a5000000000e8000000002000020000000d1ef04e67ff76c022de56c77ff1be90a5e28ef8a1346078e2c0a50559841541690000000f0c48217c3b3bb36d9dd8a0edec247e9a1c2f8359c2cc0135f273e7ee1ff076b8b96c2748a244637f720d946fec06e39ce6d36958667fecffdf35b6ccaf37ecb24fb2382bd4f34b8f62846092340190eea8220660c6cfb527fd6c11f2fe23f02ce4e6721fb5bc9539d245cfd88076fed161801792d91e223b75683e8d3ea5f99c00c2e9591aae5a3c7e2a36479f9dcb040000000f6f421727cf0e70c49fb820c676f77f797a742439175e86c01526e67a1d96b2f5daa4c37a554567dd556c383517d096f363f53ea31cd2ecbbb733541ce194d82	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2584	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2584	iexplore.exe
2584	iexplore.exe
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE
2416	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 2416	2584	iexplore.exe	30
PID 2584 wrote to memory of 2416	2584	iexplore.exe	30
PID 2584 wrote to memory of 2416	2584	iexplore.exe	30
PID 2584 wrote to memory of 2416	2584	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aff9fce037a41e6038efa592cf3071bb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2584 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79230bebf14b603d54d714289bcfff8d

SHA1
eb808255e2d87e7dadd38c8479ca6d62850604e0

SHA256
f99ee262032e89e386a687d06334bfddd11f6a2a38c1b32de872e99b452b55f8

SHA512
2af6ffec33411d9dd055495645f73f903b4e871527412c695afea6761cc666195b0237bfc5a156585efddbe5e1b87299d3b2792c7a59827803982c31b9ce8cf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bcb8c5e67ce42bbb4b0cf705553dbe09

SHA1
a97f1ee0e9f1530fa1a89f5263a46f040f582ba1

SHA256
46fada5c8ca272e707fd1894bf5f6457681ca2e32b3005f3bfc8dabfe566693a

SHA512
de0d78abc13ede9dba4d82d54c33588795b3c72507df369b632bcb37fa7ded9c38fa8267b0820186456c9ab247a8e18aad5796a15520ada44574042fd3d8c12d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b67778b52c721df813cbeb78097f418

SHA1
dd024fe75f86acaf70cc2c38aedd665a52ac17aa

SHA256
f6a533991ee7c332edb7c95a6d8c3a45d1caf9dd3caee547fcdb55e0f8c4bfa9

SHA512
3a7904502c5e00d51aaf2e744ab97b02191bef69f923f6dded15d4ec55c3d9f37271dd0c88d401adf18fe5facadd36ea0f2aa6da10bb0e8b8fcf16ce6db2404b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddcadc0b80662ca33d1fc83870fa3966

SHA1
bae16ceaf6594cac9e944f6af4d1097ee7c856d5

SHA256
5151ec2f7faa7673b4b1ae16e141bc77ae486709195fd893143e0bf575599b05

SHA512
441b34865945b589256cd5bd7e9a4708895eb57ad40318226e515f1a9ca222e3aa78265fd4c5b7b5d1356b57197c5f4ee601b2c9c66176f1a3ed317dc9437757

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
141c4dcde41aab7632ff4e44a18892d5

SHA1
5b9fdc7ed87bc6cb543fe081731d4294c06ab809

SHA256
d161c7d5ddac049c1dfebd5d33bbd1f7f773abb55021ab144478cfc07bd4b260

SHA512
bb683c7c88f301dcb89b8f30f65a446d9908e2920f6d98aa07ba0f1947fd6ba839568cfc82cbf344099d04c7f4d39c969d988070848661044912727a8c157e0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be953bf7e7f2cc81dd99e0321cc7ebea

SHA1
ae1d9da94a6e6f6a4dd9a0c487a68b9432821456

SHA256
1ae82d3ceb88b0a78af63cee70533a2963328849bd01815c8161fed0aace5d79

SHA512
b7542fcfbc4af066d1a493b058f432bb88ef7a10a0eb58d6a7ac89f47318c6c86ad3d4b74b28fbd329807c0d3b786780d1cf12ab3022dc9ea02b2b4579353ce0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
270f29e85a3d2a0dd99f18ef189c0b9e

SHA1
2e138439e437e7955a13a1d3a99737b93d4c5bdd

SHA256
6a6da579bc185b2183aee786ba7ba52093abd35774b2c535086011c029b02c1e

SHA512
ab885b72bacd623ca46422a20a4d31b57a456b5875804f822d3b99943b854a40c90fce236a10e2eab3aeb5b892ccd6b49b751e0619d0071cb2eb27e2ea485aa2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e8336b582ccd48d8a4635d0810ea2ee

SHA1
78969a3251a3f1f91406a3230b1edb53a23ec3da

SHA256
667032702bbe8072b5b2b9afed4f83be69360e9bd2625d2667653f40609a569c

SHA512
15c26ba92f114a3d3d964d61620f09ab739fc76e4707525eabf7c3ae63d3dbb8812e9814a40e1cb20d41df4f2b06bab8823ddfefa05c438e52ab49eab4da9515

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa08f50fe31ebb2901f5d4e143fbe19a

SHA1
c21ce3c1992bdfc4d52d73fad82806b096a62353

SHA256
a0611314ac4f3f27c8f408033e86c25175b016104897c739708543a16de15446

SHA512
156ec8565ba667c46c8c3073c2633e838af144fa043b5eb05e2a850eec414820e6f644fd01025d4668503868495641569cea3b19b0877fa4530feab3adea0d1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f93cc1734cf3e04e777937d3c7d40a3d

SHA1
d77b9cc47ab55c2d8b9bce0dc195123ea67e7968

SHA256
8393a30d1921fa3afbaacd0e5a272c765ddf06734b6ce484157a9a5276531cb5

SHA512
48d999e96fc48e86f8151241ca32335cca022baad3266644541b5ffc6fea7781d27371c96dd41d8120ed66ca069a2cf415fab698ab6386c43323ba157a9a7ea1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
316ba031b330139be0f94bbff99b16de

SHA1
e4b910c322914592f3a8d8228c1d87d43e6defa2

SHA256
c2f0dbc398054d7a44ac41a41976840b057f374c6d01865d7cad13ae6db8f7e4

SHA512
545f409b25882dd9a8892f9c125a8df39b3e679f0355f156b597a1ae78827bb9c0df9af2a926a70c4167b4891921897962263fb3fdf92b8998afb2aad558ae1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55609a84553935433a524603be8886d8

SHA1
8cb8e815eadc5081254e36e66915e84167ca6e5b

SHA256
8d31adc4694d6fa1e3fabf956d91115962e494f5d1418e6a3d6859c21a47ac5c

SHA512
4280f0d81f8cf3625eb0de5bce738283f4a5f9587667e09658f35f60e1fb33a9c6eb22094ab89dab738d2f5533b33c2fbcacd258cd6a3a01c5d628aff9d57610

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD694.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD704.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit