a34d2ab10311cf3aaabdf3e6180ed70b1454f5ea62d6f83d040014ac0689879b

Analysis

max time kernel
72s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17/10/2024, 19:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5342089c6acd362ed403a9cc49a7d5a9_JaffaCakes118.html
Size

6KB
MD5

5342089c6acd362ed403a9cc49a7d5a9
SHA1

53419c929a818fe6053a9bd985b0d2f4e75fc94f
SHA256

a34d2ab10311cf3aaabdf3e6180ed70b1454f5ea62d6f83d040014ac0689879b
SHA512

6bb3b8038f7d0d29d576dd735f05b3e00deb42b8306583caa995844a23b555c212f57597113f67802ffb3ef48880db08f0ee5a6e0bd4268db773f181e8c92578
SSDEEP

96:uzVs+ux7hGLLY1k9o84d12ef7CSTUS5CY/6/NcEZ7ru7f:csz7hGAYS/RF4Nb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435354215"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a4304954743b1a47832af727da54cb8d00000000020000000000106600000001000020000000de9ab167428eba64eb65c69f1f6841a0384dbfac53bbb484c53c91339d37c960000000000e8000000002000020000000a5409b56a76ba18f72e6d9e4d38c8aa6281ca9949a99d474a741327b5aaddd7e20000000869ef2bf5a62d3314222f4494be800a976991ff008ee3d4e60b0940ff691bea94000000079b37371078b928e50d7012e46850c14f558d3cfc49b96e45a4b4aa8133808ab2d75007927c673433d5c030b4bea694937d58786b00f31cb2107b9b1476190c2	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8005c5adc820db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C0335001-8CBB-11EF-AD51-4E66A3E0FBF8} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a4304954743b1a47832af727da54cb8d0000000002000000000010660000000100002000000057057ab9314dd05274ec8ea13d8340ca4d35801b2cdac8f9709ccc09945019f0000000000e8000000002000020000000772575ab4707918124f73898313d0a9ffecdc26233d82c51393f74359f64843190000000b6e25a01956e284a6ed51bd2db54ff83fcedb6b244bd76a01aca24dec423f1f89cba34705ec36048a53e3f00ac3bc5a28c24cf2511df252a97438dd12016b7df57596a974734e626cc822bedaf944d2938ce5d074f014a011171780d3be11986732b808703d7206240dd502955cc7dfea79594180c2bf0062df8d19e15416edaa7f16093e9af3874812a910d0b0df38840000000b3e965fd53a4bbaf3d2c06d4dbd71719148120bd9d7df9cbb7da61df11a891d22d1cc7352151f90f4da73175ae36dd138e2495ecb3f90baad656de2a4e5997db	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2536	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2536	iexplore.exe
2536	iexplore.exe
1108	IEXPLORE.EXE
1108	IEXPLORE.EXE
1108	IEXPLORE.EXE
1108	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 1108	2536	iexplore.exe	29
PID 2536 wrote to memory of 1108	2536	iexplore.exe	29
PID 2536 wrote to memory of 1108	2536	iexplore.exe	29
PID 2536 wrote to memory of 1108	2536	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5342089c6acd362ed403a9cc49a7d5a9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2536 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48244954f6ad369b4ad263d00e1bd200

SHA1
80e62a205a52999ca244bdf802e6a53db8f9cdb7

SHA256
86d05997d85f5e3bf36a042c05de42f4e86e548082b4e7905a45415dbeebb794

SHA512
b917d4e82e87edc85da948026964c41f3e8bbe64f221a25444f7b23a1a6c7cc1917e407011a405c43fa391b0edc98fcb1022f042e724f56b2215a9cb556c4de6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88f7bbe3ba343e11b505d498c00a8516

SHA1
b25a0e342f88d8caf1b8eff1f07c9d0eb06e5954

SHA256
bfa2601a9f9ccbaef5f744e56f385ccac2ae0d5797fbd5b3acaec6d4f3ae4796

SHA512
35903e08ad0a70db98e0bf4230507a1f6d000c797dfd2cc640ae2d5c710f5067c6d3985dbf881fe36977cc2216d6ae88fd6ab964b1ea427491c79644e107c7f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
abd010976b22d679bafa3d0ce3940271

SHA1
7612c6d7b646dda48a8c40b19f612437e3420b58

SHA256
2b33f11416388cdf30c2dc8af07d945250b4d24144a28ab9421f2667ea83a50a

SHA512
e4ec047e886aa46c127c1b9cd132ac3633ee992eb2afea14713ac8bdf2dc305d32addb65b0d03891cc8dca9ba57f9e680860524e994a667a6f7a58b407553615

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dbb3c280ecc0c7543d9ae7a18b187d12

SHA1
a7700fea6d68529c5b938a2cc7c4fcbafd6db707

SHA256
c15efc20de6ac02706a60c187160f2e29a1e93e77a85258b4d2bdb2eaa18fa04

SHA512
17db63885451f3a5f8840895e41af8b84ce6708d482ef8e2543edcc5736f9fdade21ce9270d4c3c4a16fea8dcb6edde68671aa138ea457be1cae3cf3dd1dcac3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bd60eb7d34a615929fe13c6120b83f9

SHA1
f51792494ac2cbe97b7410218a69e877bcaf5e4c

SHA256
8a4e38b8a2fb0f75fd963c6d3979430345cd7c817c35d4dae22fdfab729b977d

SHA512
7755a34f9effd1f31452e498591dfc9c80e4fc798bad56eb794ec7912801cf027f7cade286cdd3581c884c20faa9dde20cdd555d909e5b51cedfc8e1b06ae0d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f4a471ff29bcdd721b0e0439e999d1e

SHA1
30c464e1892947952db3e287c27b4cdbd1adf830

SHA256
f976516868aea1cfe8b6490431235214418dc4aee8ab6fc9d387fd6536c918a5

SHA512
e721b2c6274c642f405b5e1ac9d21d14781269d1913ea21e500aca46b12e2e3b77f2530462211da819eb733bb2dceb25a0e59aae2321bf391797faa1c6401891

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37898f9ad86c14294da3f95b9c7a1b36

SHA1
71a6151abdf571029659e20ae0dad2529b3e271f

SHA256
8d339ec7403dd5f8afefefdbb30949c1789f34517c66640e7bf2da4f90fe4ba9

SHA512
29def55d3bf37afb773fc75e0a72bed86419fcd4442d45600c3b07c968830036067ef8417300f06e19bf3ebc12c24847ddf721abcd7971c5acf1558d2f4f764f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
564e44f5ccc202e3e006c480f14d8c0f

SHA1
82565ed0fbbd3ca1f6e9fe1c31355fd25aa164c3

SHA256
5eba3bf9bbc74bb7f5a2cae9e2c79258b800154b4ce37062f024cfd05bed477e

SHA512
f878b04eda68c661da048339c09ca9705a5f75af3fba1be7cf01271e9e9a92ca9eba1d58956b2806ba5e26cc55d48ba901edfb4762e27b19cfa945cd0ee76010

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
343b36e294313e549addd7023813f36b

SHA1
1c56dfd5c288362ba688bc83b7bf9f54c1452c07

SHA256
527920a2aa4bd9b6a97990fe54600cbeb38628bc7675bf7f3a6caf42f2b5e8c1

SHA512
a9b5f0e6a99c98c26457cf0e5d7d2b3c39443925c909d2e17390c098a725a451ea81cbebb6a6b4a4fd5d3081f02ee3a10fe7d93bce418eba128b2a39d671bc19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e122fd9f95f530a8742c6e10152db75a

SHA1
51c9c364db5804df56171e6c070ebd0c25593583

SHA256
0b67f6019c5b8ea7e31fcb42901bbbba99d73e11c8b66c8fccfe1be728d72262

SHA512
0279ea302f5e02692ab1a31cde9beba5c1807e48c32d57c762191bb64f47b08c97d2942c149db48c3860459d650d8ae31ef270e5dd2e758c22fd6cbdabe37e28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d3cd301b2fa28f049d28c7a451ea195

SHA1
6ff413bf0a6d3ca411877233f74f3cd372e3ca4f

SHA256
4fd6ca35a208e6f65d24f97389b030430b84dad7af55b2e72b1ec876fffffb76

SHA512
8744ea73f485de37468935c729a340b45b262001055085e383f3180ea3607b72b6dd7abee586762648b9548d6674d168e8ae4cd249940d27c4eed915f2b3db97

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFC0E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFCDC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit