ca9ec6cc09e797ab73daab4238381fa52994bb9055fa30465953c1f775088dbf

Analysis

max time kernel
136s
max time network
129s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 22:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8c502394b0871589ec68de734abb1cb7_JaffaCakes118.html
Size

8KB
MD5

8c502394b0871589ec68de734abb1cb7
SHA1

c9b59824943c6eaf7034f7abb8cebd57aef40ad3
SHA256

ca9ec6cc09e797ab73daab4238381fa52994bb9055fa30465953c1f775088dbf
SHA512

858da5afbd0591a585f0b0c35ca7711511a7c51650840c47cab8fbe756af0ac31de17badd8ec85c26783d0785785d56c28716f5c5e65b7e8ee4b0bc002c6119f
SSDEEP

96:uzVs+ux7cILLY1k9o84d12ef7CSTUkOSvwPO3ALcEZ7ru7f:csz7cIAYS/4Svwtb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000ce8116d878b8ce075f5d12b293e2a2e71b0fce33f6b0e5470078b22a8d0d326a000000000e8000000002000020000000a7122a4a3b1786e314b096c220a341627f800bab3a4d710fa427728322bb0a12900000004e28488d1590784e83854e8689e0145ed959412e228ffa76a1582cf582488964138ec9664648077b5162bcdb663e0afa73bdfa886c039b5e8ce660e5dd8467a2851b85e17a1811ce92b13a8cfb99a86a3e2a34ac678e11c12fe7fa4809fc3084c847edc6e375d591c2f1b7e581fd87063593faab1e5d03c5ac143170c5f26de6a1ae732ca2527eff90ded382dae16b46400000005ee2ad15f8f84ba47f866e36c18ea6d26a7f166cbe60c54a35227a9924e0508fbf18df99d7622d36ae351863f21993b73bf562cd09ef60397ededc606c3d1a3b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429578835"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0ec49b941ecda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000006200c6766b97ac1ee576d4026f5170001241ff8aa9dc264c72c0215ed86097de000000000e800000000200002000000003a981f8a9c972d4e040f67eb18c85597a7c7b1aec145e390cf102083e15714820000000031d795b791bc9af151b038ccffbb27c18b067f23bfc3cdadc4850a67407f4da400000005b426eb8397a518129734da533baed0acc9ef7f43964425780afefc1884e37dd3a011ec2c8dc98c61a889c3d0e2d394026f924c5784a7c2bbf649fea8c0a188c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E3ACA971-5834-11EF-8BC1-6AE4CEDF004B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3028	iexplore.exe
3028	iexplore.exe
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2724	3028	iexplore.exe	30
PID 3028 wrote to memory of 2724	3028	iexplore.exe	30
PID 3028 wrote to memory of 2724	3028	iexplore.exe	30
PID 3028 wrote to memory of 2724	3028	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8c502394b0871589ec68de734abb1cb7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f20b9082b835a2ee18b4e9fd93bb2874

SHA1
d790ab4c96cc92409020468a3870b2d5506ea598

SHA256
3efeafa9059f7ab00c17e4557730ab15688dc44d831ebd90662bcf32e1a9c8a2

SHA512
f710bd8ed81a873ae94b7031b00c9ebcae949eba1b2972b77dde764a61ccb644f2eb35fe2212016922f067d86fc86b96971e956de82f07f419148b723599ce13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8d4ba4dbfb37790236b0eb4e537fb3f

SHA1
5d85795ba002eed3e7f2b5542fd44e7372591f07

SHA256
77e4caa4cc74b3efb3b77ea92abb2fafb8e2952232c1b11f4202dad321f25f65

SHA512
0f15693e885a4282d9e8cc7da79f31c06481afd6b18b25993dd72e04192469c4e78cb194d8c9ae8516fcb0e5d2adde4397ad1ae6e85432ffbce86935fba207a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10849d5bf7a64d805cf7b28e80b5098f

SHA1
0bdfc0084fe2c8e94cb5b972f6baf00bee08b8a8

SHA256
7e605cc5e8eb512f84593ffb88dfa7f2b7765ab0b3a4ad3935fefe2e0d849fd0

SHA512
384d7131e393d4ee5d4ca7b03235ded76fcc74afdc88fc3e6c5b4aa230c2871a2161061818b20c016df0111a532c7c5e93113bf7a8edd0a1ae09b81b2656224a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc7a84060642185c729b036cb57d06f0

SHA1
28c3c817ed01ec2e44c7e3a8dce0abbae8f3fdd1

SHA256
b8f9288e52cbeba8d4825a54d0162c4021192f08fa56d70e1f6f0856ff2abd0d

SHA512
a3a68e045e66216f2ef751d6220cfbdbd3ed93b17338f7f2a96db1ce6fc81ab877d0df2f31b156340d545ddc8c4881940de5fd4fcd95813f0c1729d3f6ca3911

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f10ecca118388593eb9130d76e672ed

SHA1
cb5ad6830f553966414800b49b22e1130e7e7d0d

SHA256
fda2d28253e64dadeacd5876107a876695d921a63277c8a96032952aa5d8c125

SHA512
69c324175ca459a3155ed71e5ace8abd5e85e76e27b8b9b18fde7d56c6ae5b3bfc6831c03217128b556935ac2beb5de48ee117d14390ce36dec599d0e1f6c6d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
320b05b6ca166fcdc5a05a7bfd2b8029

SHA1
86944c4fd379614bcffc261e8fbc1a217db2017a

SHA256
1ee678c539b6d524d8c23ad21f2c55d48aa05699bc03cb0ff12bb082e543b800

SHA512
abe9db98ffa538dd18d079dc41a83da4fec4d419febfd9a713c58bc76825eb27d871fa78cd6cbeb40d9eec4167d6af3a44c4f63bba9079412041260800ba264a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
085b99881197c87eda5fd8502af0cd7e

SHA1
02ef8920003fc319d5ad8ebba6ce78df7589d1f1

SHA256
ecc1ca5cc754a9d03e9994f7a7136f59be1b05efe828a476370f3ae55a60a410

SHA512
fa44d76d101ce6971bc864cb3c1995f7befe16d44fbea2afee05547c827cd8c49a6d783557c85ef17f664d765a73aecd49d7abcddeeef8ea4a6d6da28cbd9b99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97ecad2c4f778ac13d6d70d1d4736c27

SHA1
6ba7f67969f21373c8bb933cc3fa33d1d7988bc5

SHA256
90531a8ad9a0fef0d585bc329dd8820615b09a3b1558a5d26fca53e478121c51

SHA512
52716bfaf5bf9a6a3c5dd3a00af3e0fb20d2c5790a3b74a2eb9ea00db09f128cfab55c30a4d200c756fa6754be9460cdc475f760950de6d47643583e8ba4dc3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41a21a1f06e61085214ca9eee8fef5b4

SHA1
73e2150eee31cdad21a3dd7b31130df3b622eabc

SHA256
99c3a5afb8d8c51b2951ff8418d531794b4c3bd2cac27f6c8d750d40f88d1d27

SHA512
ccbe5231a74a42effdb167159de376316cb466565a0b55f69a9aa88822df3847af72175a70a6d88987089c8904cea5208219c83228964d578bbfe0fad6d853a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6fb7b4e2e826e5874064eb46c090fd3f

SHA1
167994cc6be3125060672131031bc644ed6bb289

SHA256
d2be5d2cc86de7e3ab6aba7086f10f428e2cf2ff750b00ec7c17331414dfcdc6

SHA512
704e7da317e42647224a44d74b19f7ccf248e6be148567186c48cf38b1375971139ae38791ab87521b3dd8b69416c3bb3b44a64eea5c0f7724787e403a0793e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab96A7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9717.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit