a08cf65235f0c3f173b73c2a61d9bc5af172391201b97bb1606146190bbfa497

Analysis

max time kernel
140s
max time network
141s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-10-2024 03:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a72752955ee3bac49b00cb5f1dd4a46_JaffaCakes118.html
Size

7KB
MD5

2a72752955ee3bac49b00cb5f1dd4a46
SHA1

5f829e2cf2ea05d9590a3bd4a43a78eb223a9808
SHA256

a08cf65235f0c3f173b73c2a61d9bc5af172391201b97bb1606146190bbfa497
SHA512

f5b80183e4b1e1af9edeb22375139f01621402f5121eaf70ee99c437225553c58f3ad2df2b8d07f09dcc8605bc8799faa3e2742d6c62c713f861ddc0a1da994b
SSDEEP

96:SI3i2mdiGyT6Lc2bFxXx888IM5XKjl63GL4X9+yGj2wve9+K:SI3iGDixXmdR6olPaPveAK

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A30A0D31-863E-11EF-8F55-D60C98DC526F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000bf146454cf2358723c0ea083ee565a52072c00f55ff871e83750f17d5c7501a2000000000e80000000020000200000002bf74417c70be38ee0e2f9dc1ba85bb93c93e46f1e101c65c670cfa77df891fe200000008cd116ceb0be989cd6048f787b35fe0f828bbc68f36b354cd5cab586bf4511f540000000066f2cd0334f2e86892db1fa5456b6a0a1e60c6298106d890c6c1f36dde549000a401161aa8481a0c60d3888da35cb827a2b4680b401377b46a3d89347b7f775	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434640772"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000cdc8af41d9186cca1cbf8b5b3bf83518405816e44ff9ccdf0f6321e7685cf612000000000e800000000200002000000005fb4b7c6f207ee35c07a1504e6be96af4e8eb4abdf46e654417898dc306fdee900000009fa1ab5303315955ec530e24ae8d10288d2c5b11884b40dfb00f891639edf8d21e764a68f778a4b737b509eb9c540d84144a9c79efa5c33d83ac2d262aa976ff387b4802318497a010b6003a02d1bc6e062b4cb270e11e0e995fc5f226683526cdb6df93d861a84579f68108fa97c5925b5c531cae986a940c3b5a8d1f2820032d739e531c77ddde3e389521d6e1abeb400000000649c73130fcc794948b53a114c57b9e9b783fce94a039ce61fb04cd44a5fcf659eb93b3606a53ac0a8ea75a93b8f64af0631a5d34c9084903d7cdbd9438626d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4037d8904b1adb01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2636	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2636	iexplore.exe
2636	iexplore.exe
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 2808	2636	iexplore.exe	31
PID 2636 wrote to memory of 2808	2636	iexplore.exe	31
PID 2636 wrote to memory of 2808	2636	iexplore.exe	31
PID 2636 wrote to memory of 2808	2636	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2a72752955ee3bac49b00cb5f1dd4a46_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2636 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb61a66707c9774b5355c7eaa6d10641

SHA1
e67b212c86e9b1c97dd98f85d80756f5b29ec4f8

SHA256
6b01b9d3db802dc3e213c7802f052c6057f647efd012098fcf90fee45446e3b0

SHA512
2fef1f5b4e09daf65a7aacfd33c31308a78178730f93f0969e8fabfedac7e39dfaf4e57a63db399d983004e9bc1c177e263bfc49e6bcdc7d25bf099ab080d97f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bdee7c28edeb225ac358952f2c5c3fef

SHA1
db2ffb6884fadfc32a97ec174cfa3248a2a559c0

SHA256
18dec5dee6b4e5360c6a6e6d7bb8dac8c39a9f8a9cf99a21852fde2c79790358

SHA512
fbac6f500a3db887949398b6a232f7b806ca4c72936dbcea54dca85695e5923c9b5cbaf78d4d7e1a18e3440707683c631f74f4742585492437bcde929a4717ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
392d52cee63d168e57672b1bc9322d20

SHA1
4f7271f99248e2443b09e9bb6979e54b4c9155f5

SHA256
30885c2e159e7a5582b505f4309e9d3eb85256926cc9a76a4705a72a8f300a37

SHA512
367d37a05fc0b3a76781cf2fb299ef1d37334e37c9caa411c5a72226f3f67e2df5252c74a9a5f3d640dcac8a041c22a6292ab2e4fd08327a7cdc38a11d11e55e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8034a499b16374f6f3a305be6e70d9d4

SHA1
d8471dc78739761d237571d7604b47004f77da86

SHA256
02a7671ed339bd1d7f8d951be36b372ebbdc8e73587451ab81da94236d9b8c06

SHA512
b775164980be3268e264399a1b7930c2acb1c53bbbbcd80eff1a4828c26b427d689484316518cac7be47794b998369cd5a08c6eda00bd199be17963b35dbc768

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b235f7d64d1a63ad17534b405dabe5b5

SHA1
4c8ed24aaf3486223461d7572aaf2319a8416f3b

SHA256
246ac192e9a52422216bb1a946cf5aa5a58d04a656ce79654cbd9f2bc552108f

SHA512
7ad57e46fcda29dc5408684a5330291d743c9d66eabd1664817b810ca72411009768285c212117b52ea14f7f92dfa7313a66d128bd23093c39fecad3cdf37d82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c7e405e01e6b9c677a60faac2f66585

SHA1
38f17f8cd9edc74e7e7e3ffbe3a4700b9c6c0e74

SHA256
feb8ec29239e566545cf54072dca74d8c4588f58ee21e3a53b1bda92de1f58af

SHA512
df3772d78cb74cc905a54e632eb4e8e042dc513b7d668aaa7f5b116f70bea1cdd47ac3c34fb4a8e057ec0c69dbf113f6895c65d4e15e349cee4c5432b2dcdb07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f89f5aa1d960fad22d51f860c6f3479

SHA1
e6cb53e2f58032dd00967f2a214d58377ed24264

SHA256
74e581a97992b2760f1f6044a6e21d1c17d219c5364fa854782d7c358a5cb949

SHA512
1db84e36f14d0fa3bfa337d6d49988a62f90f63896fa00793f27a07dfc1093e7077f146d3f1687296709cea3274bc1b056f7392867a15e31baf619497fe90585

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe9f69d4db23d43d206422a39b273d13

SHA1
b887554ad978e882cf1cdb1613e66c8c70071d9e

SHA256
72775111b0a24d71bb6b78aa1dc6a48f5329e5795e522d42fb6ae079ca3c07f7

SHA512
51c267eb6a3412e956a1e158eb6773a6957cc7ab5526aa54116e7bf41fa37fcdf1dfcad7ea9004efd83a86d32c1f606c01ebc8e30a7f4ddefe41895944986898

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f3cf820bcf38fadbfc7917268014245

SHA1
bfe347971db8040531d23441e3d1a52a858f4e23

SHA256
e80d5f252ce47008aba3c61329b09d634f7047cbc806273261a9a9fad2ab5c15

SHA512
b9a4780a9ffc1bf7a98ccefc0a1cebc22744ecbfcb4b27aa48d104aaaba2adc307ae93f015a6b1a54a128d35485ae619d3e94752212bd21a696f64faecea919f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ab9b29af219225543d59d5c8fc9ac2e

SHA1
123e627ecfc1adf5abbc61d8089e3f83bf89346c

SHA256
9890e4be236517fce6a35124c8a8a141bece8c342e76ca5508ddd8d2bfdf69b6

SHA512
5b7297e2a1db2afa1c6da8a47d86ee3904900f630cb5e5350fedb8df02777bb701c490e0bc54839403d7ac2ac1a392cec3c315864e02d783cee206a30784e1d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
946eb183d7780b52737bd58169bce177

SHA1
3729681512324e0c8ddd35cb02b27f22d4602ddb

SHA256
1225eb0d2f275ce578a612497d04b8b2e0e646e5ef83d444aee251c578bacfbe

SHA512
66f97db4478f272820cacf7232ddee163f796e9cbd997d5194a2fe786f8879f597813b3aea6aa8c7499d05748533e5eba286df4be085a1bef53d0be647cf94dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c70098b2376d2ec7681906286bfb7cd

SHA1
96186b557f30613f942de0894e1b65da15f4700c

SHA256
5d3d5b10b02df50971741be1b401cde72af82aaff5a58d6ce5f677b666724d7a

SHA512
dd46cc335ce4e403210f41852d19eedd7ef4c0874ef7a6e076a0cb85b6a9ffccd7bbc5206d97c4eb56d6432d1ee8c73508924909aac2458f27adbd85c41c0bee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d73f2907da6ad468cda616ebbb52d90

SHA1
195a582b9212d5952830033da795bb5fcd004237

SHA256
4fbfee0d3329f1e732f024eca19082280e11e4c5053686bfd380f73beed8fa89

SHA512
ad0999c5ef225a1b61b06eaa54b81bec283929ec457084a84deaa3457d2a4cbb63be66d6bafdf6a3cb36c92376b4c9d922d0dedafa549eb9191b3e7a0987113d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84c5c3f4cd10a243e00faa3563bd85fd

SHA1
d309231e1831929ecf68db4acb0831ae4ddd477c

SHA256
b67e0fdb6d0d04ba2269b3a515d3a90b12ad79a78fe40ad473f470b1c71404c1

SHA512
8d96089f7dd908fc0bb1f63d477e84d614659a13c8640288b1f8fc40095f149f51721111c9a943eb6a940801862277bb95d593fabee0f48d1e95963a5de3f799

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA3BF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA422.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit