af6ab9979e15ed8a7db79e17af5d16d160c251c0d25263edb5e17b4a35a49e8b

Analysis

max time kernel
134s
max time network
127s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 10:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be61dd7ae9d53d41269f275475ddc274_JaffaCakes118.html
Size

2KB
MD5

be61dd7ae9d53d41269f275475ddc274
SHA1

a423fed7e6cc95cc9b8bad54c7164d02a731d2f9
SHA256

af6ab9979e15ed8a7db79e17af5d16d160c251c0d25263edb5e17b4a35a49e8b
SHA512

a14290935a1221b818f795bcc53ec23b04bf6f5b7212213279554894443a86f7f3c9de2b4b94206ac24a8ab984f26629501640b34b94722d85c358387d14a71a

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf710000000002000000000010660000000100002000000023b8890ae3e0338edd8574004ad9afff59a26098632dca60b2c7ee62f1803376000000000e80000000020000200000007d07d9006ec495b858f05e3e220d74f5ace82877f2d82b0b9b65492209ae7509200000009d010ea6085205b9083fe54fbb5e86add92712e330bb5756f3e8eb0a01a0f24940000000be572e594e787cb0a5bf9f7bc56a460041a705684a0c19b04b3a4c4d5c3c4c77704452395b5b559266f5595f9fbd916fb902e48350d30bfbfcd9a089fc18a6da	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a038a2c10ef6da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000c3687dfbecd21f155c7b27946e21e1da427125b9953b12a82601115febf63557000000000e8000000002000020000000934f1435440b97a58471491b4bc79e260dfeff15098fbe915877903b0d7e4e9090000000113466922d0d8395fc724174d1170240dac92c6a1677b050dda361d8d0f40914c4281418a1bc962bf85eadafa86e87b174e391f4f94ba47432e4d7fa6b1332cc18de1bb398684237e66be89d31ede69d34a4f23e0ce5c621fd79b9737e9cecb57e37bd0d96dfea94410e45a5bcbd81a7dbf7fe968231a40a9dc981ce84a595e7ca12550828385d94d3e7693f4b882b9240000000c7c856d513bfe3d02cf98235db413ad0c2ad8f80b66695ca61a0dc7bbfd6bc79bad9d65eabc78fb23d48a4c82c9eec4033615f92bf3644a26c7175825df3401b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430656456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ED0A20C1-6201-11EF-8ED3-72D3501DAA0F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2164	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2164	iexplore.exe
2164	iexplore.exe
1860	IEXPLORE.EXE
1860	IEXPLORE.EXE
1860	IEXPLORE.EXE
1860	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 1860	2164	iexplore.exe	31
PID 2164 wrote to memory of 1860	2164	iexplore.exe	31
PID 2164 wrote to memory of 1860	2164	iexplore.exe	31
PID 2164 wrote to memory of 1860	2164	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\be61dd7ae9d53d41269f275475ddc274_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
385d2fe8c7d8e0fec4d38c8b9bd854e6

SHA1
3341c3214b01fb31a635ae331d83919e8fd0ce02

SHA256
58db50c4520683a40c3185e375feba92d42311e07d43e2c566efdfb53b520b33

SHA512
9d1d6b3dd8e5e14d8566c785f1518403d3234d911d4a658a3bdc7a34c3cba983b9d3edd02a24e3857fef174b4a88cdd12d57902849257b42cc0df97f7c0812e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3eaa4447e8f2816f7e4f0ca3c2b3f69e

SHA1
99b5d09ddd6eb618525ce77462e2eb858fa53367

SHA256
edc782171c53c05bfe42732d34bdb816ac38160514ee0c0665a539f43c8bc3a9

SHA512
eb07aefd3c20752bd3948d439a83159489f5a1ec2abb8fcc2b74fcd0caad2c25a81ed86130470f5dbfd487d7bdb27ac2894d974b54eb917c873be597aaed9333

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a2c03df166821567a4ee34ae5aa9612

SHA1
00bfe6a81b456bf740dbaa93bbaa5fbbe0ecffa2

SHA256
47d946781616e94843a6a219e9e111a243a195b30ac20aa107800be1acb59d03

SHA512
ac7e7c15935ec70a71cee3d2fb40e1739024a00ece106811dc153d9ac7bf20f8210ba3c12fda1e6a7f895c455f138348928410bf67d4f1d2e2440e62b9ccc993

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
675352eafd0414e58b04e79330fbe535

SHA1
a2f149328dd5c85f5c16f8c1bf4a280c445bb779

SHA256
0e11908aa236c7ce524b664b06436e1dd45909207afab905827321eab5fa2153

SHA512
6a8fd232752db52e96db8bdda7c694f6d6abd5176b4cb9366028b5558c32d315a7a0d8d103e227acd27527c9ce4f8d5126da75d192ce31331a200ebdd439cb10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8fa1a44f33c5743f023bc93469cc887

SHA1
f6c1a43f532a734a69cb41b4ee01ed770dbf2018

SHA256
85a5cdb5d9b080afb50b4001731337e364555480f21b94b358901d637b43be51

SHA512
4e1be46eb982cc4560f297251db16be1e636a9086943eaed408336cd0a2e8f0eeab32cd10fd0f99abb48ea85dc97a8a76e66ec42544120626e292be986cba3e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ccba6d6f7febe0816ba149c83d96c9e1

SHA1
692e188c1381cbf4fb6503bbc5a03fea8c21b529

SHA256
f6ed1f6bdbe367adbe556c2cf8f85deb719b04951429e21100c9e6ab7c357a1a

SHA512
4936adca06206db9097c162019baa55a8e1e5ca4b43d63a41caf0f645c56409ae57ec076a55f0f84f8942f29bccd705016fa771f1d66783ef24d1dd3ed4ae49d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4c10ca498ae18675f9299ca63d47b35

SHA1
c7410ff34184eb6596ff7c2232410502a6abac84

SHA256
a9776c08a1e1fb0fefd1734bb327b24e4c404c00085e3fbe10bc27ba0caacec1

SHA512
d65df61a5bb39df9f2004ae5d192acface2c67e46c9814a78d92853373249d750763560fc957f8aa0dc1db4a2b21b8d450a47744a55898afb8f4812d3729d260

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8246dddd1771a0a0e5a1580d04642d6

SHA1
c48137af930080e1b05a2c472d91a5482c1a36ff

SHA256
edbf08422b2c318454f4ad5ff37396cc4dcafca63852c09411406216025b8e5e

SHA512
c1f1c5e30441cb51abf1c7ba9fdc14ada31d942013eaacdbb4a9df7d61358a729137d03da79188a26e9729255af7ff05248d4ae723ab06a8cd57e2fe468dad3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ffe57c00a1f3d402526a25dd98252f8

SHA1
b709c66e4dac74064ba5aee0f0289decdad00e5c

SHA256
03612461bcb0b933978da02853f47ee8fbb8d9d3e7080f009e248f5871f1f22a

SHA512
b879890af834d39ae344b8380b7fbc021d5ab9b6b46addccd80bada3074ee95b2b9262a70335fecfee4f7bb714f12120559b122fd46711c575b6915ba389ff71

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2EC1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2ED4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit