5c208861eb1644e4e810f6e745602298fcdff21b307b56800124802705242939

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 12:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

85f85f60bc09ce26160de9baa9beb892_JaffaCakes118.html
Size

51KB
MD5

85f85f60bc09ce26160de9baa9beb892
SHA1

d41105221354d3e57ce7e7b8a382db0aef8c7074
SHA256

5c208861eb1644e4e810f6e745602298fcdff21b307b56800124802705242939
SHA512

a4133a5c2f6b01d6edbf21df272469a8f88c216dc79f058cd105b5a5e8a6af3ee5f24198c66ad8e05c9e79ac26645ab0ebcf49ecaea661ebe140d9ff8f171a7e
SSDEEP

768:SoRYR49z3ZNh7YsxuaFvG/Es7nmu4eyTP9BzTJwLY6uwjg:SoRl9bfisxu8kmu4eSPfiM6uwjg

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000f6e92d2af1bded982cd74af1cca0200855513f447ce115b92a2dfc6e24014f93000000000e8000000002000020000000d6f51926eec66851489cdc26f0eca0c8f7e23e713aa495bb5eae950816c0518190000000568f5a799c2ab86f25c1a30f8d2aecda5886332a9ca245efb60f4124d545f15185ce1947cacd9d7d173ab76db9da2e154a85c73ea699c783849642e8292416afb64c0bc14309a3c327be62d9a8944023aecd396183fe1d89c8a64a7032e67923e5a27012bb21481218c717a2041da13bc073d5ee1bcba9228109529811125abdbed09e4a5055e2d07b703de69e732a2140000000802a6a7d4bfa6495b7025ac6db4b87db3d864609ce1dd21b4754848761487f89c3a157cd348430ab3bee9afaf4a747d0d29365b879e6575e8b739628d38185fc	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 305af6e51cebda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1F0CCAC1-5710-11EF-AFFE-C20DC8CB8E9E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429453091"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000794f8f8d049e1ede1541a418c4680b40a80bf8cb53aecb58bc39a2058eca497e000000000e80000000020000200000006c04809f451e8e74641aa120dcf73bfac7be8deb285cb0e2fc8225d99a185ae520000000f0cea8d21ac4905c19df805e5929b2b11e8b15f49e6770f9b87aeb2037ecec7340000000e5cbe8bb789d747e55184a928a382e6e9693a38f82b1b99a114c92052e9fe40c9621c8dd5a96abb6fcae510766ce9ae8eec845a21f707befc67ca20b6aec4c53	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3004	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3004	iexplore.exe
3004	iexplore.exe
2068	IEXPLORE.EXE
2068	IEXPLORE.EXE
2068	IEXPLORE.EXE
2068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2068	3004	iexplore.exe	31
PID 3004 wrote to memory of 2068	3004	iexplore.exe	31
PID 3004 wrote to memory of 2068	3004	iexplore.exe	31
PID 3004 wrote to memory of 2068	3004	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\85f85f60bc09ce26160de9baa9beb892_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3004 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff977fffa3317561ea3a9d93aaa1b793

SHA1
12c092dc17869163861b937ada2726c1ea052812

SHA256
ab7b9bee17e565d265ec75ae9679c5daf09db1a240e4223d53cd42773f10dece

SHA512
22197fb44fa921bc2f98d2e532ac5c48cf82cc36b9cd32db2256996b0cbefe02d28ddf7d6448139b6d934b40c39ed1cc47cd6c61cd6da0c7e1b76bd5564d82d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85ec84067cf6271486bbc89b5e82dce5

SHA1
7025d356cd5ada6fbfded23f47405d4de11f93b0

SHA256
f4ba2186b96a5e818fc9daeedfb20883f7442d69cc5410a7b34d1790acfcfa65

SHA512
becdd8ebbf8ba88d2a837d24530ee1b4c4c9b0725ddcd1d52e2506c262b0f417b4ab171b955789a8a2150d9abfdb9a98815c0c1b313097384679479d161c5386

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
580d316e0d80d48fab37a9bb828ed367

SHA1
363b85e1348d0cf29e79df616d6cce4088aa018e

SHA256
836d5c66ed5adea78e5bcb16ab3461a5c4fae1e3eff273b28d73bf248a3580f6

SHA512
21f8aa1994002ec93bea6b2fb890159420c19bbb28daafb0696c59908e8312198858d9c1bf8c3d2db37ccf1907bb1f9ce163388fea91b47a5c30d7a890577776

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6e1f4b6c5c035db1ec5a3906bc62123

SHA1
39cfa9e541e476898f79a2390f3a9000b724026f

SHA256
7fd77ae6964c0526316facb6ee52a70286b902132a268fc2bc86d81081e8216b

SHA512
5c5e215c38067f53b5cf26114893f531ca1465061ddacf7774a9df9dc1614980dbf714c4c3016f9d22fdc933629ddc8b97e931baa2ccc492751c6f5c078eeed2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e18c5241907ebc903ee5ba1cf473a97

SHA1
5a19be9fe42f149ff580cc7068d53e5ba57e2420

SHA256
ed7450431953de76efdc7fc1e34e969214fa3cd99466d63b09b31cc7e9563e80

SHA512
29e8a0333e5319ef61ef38282afe1ec38e0d17af6c5064443fc73ac1690641900b252c94c5daf74e990ea02f9b32053a57fe9a5783cb9a7fad1448fcc00ee62a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46c64c9164d9931f4ba9567b657a1a89

SHA1
bbb6815ed78f6dd3fe7b3788be3c3be739340690

SHA256
223aef499b4e4b4e29ae6cc951e5603218f8c8e150eb524e4d86a1d111c9e0bc

SHA512
34af60018cc2832752dcc1a1d14d71a9c31acc2718c0b185aecfc19e7dc771be8d343b8ac742f87fb91f98e3cd470ee4b630ef8ca9b3876200165dc4e51f3354

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f61269fbf74eb09ea18a2e6ad1f19967

SHA1
f735a5ffd000d3839047f123e4f9b6dbe599c708

SHA256
df49c5d4d0b1c68ae32db06d6560a5d52dad18e485308134570d4ac3c3ebca83

SHA512
6c778a975d032cd6ee70441f497728d04202cb48ee0e6d27b3ac0334e8f3c31d062184314c40653e26259378761cf6ef38a22c517c71c9dcdccd29d088d79d72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27cabb193843c90293e184503c53484a

SHA1
4d5da6471f1b302da91c0fbbadb2558a6281a77d

SHA256
b74215165ba8f97cb63c2c2afa963c1d6c72b36a28be2a3bcdda36e63ea3756b

SHA512
e1e5f391b787ce4c07ecfbd15c71788db9ac56fa6c5c79b693a1d1ddec1b48dbac362a6bd6f3c44ce13e7314316b5b21f3b636ea67ce7894d30f8c72faf17bdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76d9004f9dceaae5b71cbd70f4489a74

SHA1
d6c69b2872cba0f5eb35d948ca5659d7e8fabc0e

SHA256
d3da5fb1267dab95c8429c1b49a971a039b36e7594021e6ceb96e9587ce38e4f

SHA512
a8d93b1e50ea4344b9b665534f24297099089638d2bef6e360d07108c1aa85fc8488bf10d2d430e6065777745bfb756217ed3e333567876ad1c866ffa938fa6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3866e8c0a2d13a4f57702ab0b6d37baf

SHA1
257cfa66a43827efbcb67300b37f3b9286f8417a

SHA256
d95316d933b18e45fde40b8d4eff335e3df5e40a47432f851ff6368719ff9ec0

SHA512
24edc978fb9e3cc53ec51a809ab6b0edf0c0da067653a1e8e1680e9de8fb3cf44b77caf2244d650d042556ef335042d3a85038214a27914ca66f757656ed72df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2aad25d87c69ce756df6128daa2d6aae

SHA1
a8ac4c867690f313c5c6ebc7aca3627368de3a85

SHA256
0d635a9926e20d5e5dc238bb137507e1d34097f9f3e28096ce461e2c6a5332a5

SHA512
ed349a35c913a7ac9c6abc9b19bd5c9fc7c6a6470efbf714744d78f136a7ab5d154cbd1cfa379c712f6f6ae571dcff939def2445f8817e5cdf2c697e24921c2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab531.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE68.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit