c29cab5249666847e27a3f1ca303e295ab185efe43cb966fbf4239d9bd8edcc5

Analysis

max time kernel
137s
max time network
151s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21-08-2024 10:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b3243d33ed0cd1f360d80f2f0d09f59e_JaffaCakes118.html
Size

56KB
MD5

b3243d33ed0cd1f360d80f2f0d09f59e
SHA1

9a2a42e2058b89905d2cda0369b626e85552874e
SHA256

c29cab5249666847e27a3f1ca303e295ab185efe43cb966fbf4239d9bd8edcc5
SHA512

234af3b8ff65901e6c3931bd0176a1fc446b5b1aa7ef08e4ea287ce68f0eb1490e77c0286e3624a4b40edac4812f762f014564e6f3e47572c6a111806b68389f
SSDEEP

768:Zcd9QZBC7mOdMoHpC5I9nC4z0obKVi/HU+bPd:gQZBCCOdT0IxCk1x/PbPd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00082a74b6f3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000d52c3d6bff9092fd5aa4ffac8ba7fcde209b7c6a52839f68401054bfe302aef1000000000e80000000020000200000009b061e5ea83ab784af02d6d64c3ef8175613d47cbe2f9a6af4e22610203b9a4d2000000075aa6607f42ba9fecb6361fa42f1eff1f8a71db05b33484066d36241df4d58e1400000005581a26919e78b5867b154b18f73bfc53b0e820f72459dc3f82a1eaf55692b774888d695784b3eb0c8c4ddb96e9b593274b69973d74f5b841b41a19e66f16638	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9C9A5331-5FA9-11EF-BA79-7699BFC84B14} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430398623"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c0000000002000000000010660000000100002000000055e2df24cdf912084cfd48b14d686f1da1be743b05a3e0c3dc57f808fa946629000000000e80000000020000200000006c6f96a4d3df1b995e1a4c67823f832c03d44b90a396b2e837257b8757663b78900000009d9849a0705a4cb003ef68ed2b505e606ed46f58ee0d185455854029bde54ca7a9c10e44c50086d9d14646619abdb757a358d5d929a6b66b175cbe0989a4fcb285964edc165615dc018fa6a65d31b86924c38633ed77914967d59171c2cbd3c22908ed827a9e3b8a0bc329473e0e7c8275014029fe127234e73456f4397d676236044c40b03c4e22e959715ec9a080b2400000005e3513195a864efa23abd9c0a20cf30ab2fb7dcc61b4a686c3abb41ccbf63f4d52f3ea916b2ae7c6553dff88c5a35358b4db6a98f7ae835968de01a2836f82b0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
348	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
348	iexplore.exe
348	iexplore.exe
2296	IEXPLORE.EXE
2296	IEXPLORE.EXE
2296	IEXPLORE.EXE
2296	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 348 wrote to memory of 2296	348	iexplore.exe	31
PID 348 wrote to memory of 2296	348	iexplore.exe	31
PID 348 wrote to memory of 2296	348	iexplore.exe	31
PID 348 wrote to memory of 2296	348	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b3243d33ed0cd1f360d80f2f0d09f59e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:348
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:348 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
fb57579d89ee9215f29a31358b306721

SHA1
1a803cbfeff93208ab8e7d9fcbc77580caa2b2aa

SHA256
abf2fc41977763e21fd46d826423d81d2e60277a66f0f600740703a68439e482

SHA512
4520929f4310b0e9996632e9a7055a9778b006aceb51b35c53b2d04d2944f5d91e7bd5f2d9e7466a6f8c2b6e3958a95a6da01cba1342a1227596b79122d07d9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a92cab1905d51a3c320734c50dd82849

SHA1
35058ce795cbc05dd08e3929f20b74e6e7b19881

SHA256
f2280ed4a17fad31c13a752e65a5f0ca5c8334697071cbef09aadfd254fdd26a

SHA512
1196c14f15f6d7ece1fffd102022f75c73792c03aaba0350c1e56aded2cdcc33e78bb87a5c7d04108bc4a9cbd0f4dcf5575f95161c1de61503e52654c5dcf288

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9fd38effd13ef363fc6efa5f6eb0f4ee

SHA1
f8ac98be800d73488f8ae012c4f328a7dcc50e05

SHA256
63d356a9bd61731d8501fb567fc972c3ff69c2280583bfa2852ea99b1d87f5b8

SHA512
4b71e80bbe21e012500900dda6f460d1ed6c7eb5c5b9a856674da2efa281abec963207cfe6ff1cb59b4b774f9030d6bd3cfc9cfafb4c566599a8ed1b0df823b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ed95f1db86758c0149cf6d7a66bb1f32

SHA1
0cd794f1cb48158b526f75cdade630842994f55c

SHA256
adb3028b686be5a5560f736110f9bd78a8061636abccaf4ba6ee11b04840fa72

SHA512
c21d77cd5a02fab8f9f3f55a86e6251a1f4c37a2bcc27d95f790cd120261c8cfb91933082519a6a645d596d021f062037fd951959adacfe7f9f7147f2d56c5b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3349608b0f875c9c3a06ac3143518c02

SHA1
a88ed9dd74c15c0b02705007190d8543326d59d6

SHA256
262a4299bb09acf18893c2ce6a30e0c9ad7ac55af53585cb222f9f1a3cad35b5

SHA512
d4d1e7085bc62ff629f6fe70a8f5fbc070da5796a7f3e928b8397470d3e6e23118d68c571d7a46e6fc6a4855d57e970cb9e66075203b9447dae2bb0b55ed3a84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9f94ae1d02edcfa15585e5f16597377d

SHA1
e0bcf503b69f6dbf8c1223ca677eaa93351ee84e

SHA256
bf0f80d83a123f6a486dd96cc50f00bc6ee70431c7c36c764991516d7cd65fdb

SHA512
6c6ec2e26e30a06c236e5456faa8d69aadb351bd4ca790411f566e254b23db2ab4ec55852cedf83579ebf02c72e117afed24dccc2e0e09155f5772eaa830cae2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
82f4788e8f6a9612f73dff566929940b

SHA1
599983c366cb876384c119e694117121442c238b

SHA256
984ad2c3dfc84c4631c13d73dd4261624e5ea469b150fde8b314ad9421c77609

SHA512
46b36f69e29880e5e7e122e40bf0fa4f2d4abb54f2cfd5b989e480dfc638d7985049cf042382225bb4a740d6a6771b63be39c03f684fa7170515668f6c434e20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a366b5126887b581172c8bffd9d448df

SHA1
cda643df1b0425b4f807dfaf4d1234a4113d39ab

SHA256
f8667c5e60cb7d5cdd27fb28cf6bc76c97a89cb8d35fb43e8b10f0da37d82ce9

SHA512
c6755904071bfbc6740ce01ee4e9bab0e64195a62461db0b53dc96d941cdcd2f9384786a7faf3a1e92a4f7b14213f4c39cd6ce7881aed704397085d1351c1db3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d3fda59c659f6034efe027ed54db5d3e

SHA1
015ef0beff38cc963908ac90b28d73cbaea270b8

SHA256
d2dde7f772ecae8450b1700aba41b3d09fed8bbd8a9f515da107ca6f41f77abc

SHA512
176f5059ae593d2758dae209ffc2c928f3dbd8819d458645256fb6fd7734cf54209ebae79c6e78afde34a1d3caffa4f2d8296054dab217ba61085380ef282c19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3f3158beea296403cc7d211b2459ddf6

SHA1
80ade385cb74c899eb111956f8a09cc1c1b7eeaa

SHA256
29a7bb17ec36a66de1471e09905ae35a4751828afefafe689de8103687dec1a6

SHA512
fff9bea574cada0891b18600552777780296edd90ec67d985e80f54cdbe88f1ee5fb42deda00b2cfdf85ca763569a7f71f337b4de3654420f98759e8bc2111be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a9f0ad5e4f1df1ddb632b7e0fcd5514c

SHA1
cd6eb37f217bef3eedf0410b219a0d8d248168f8

SHA256
01517b5a2bddf56ca0d43b406eb793c57ebd54d855e57e4c719f9bf7172235ee

SHA512
da97a169d83b6d7234e409943b606a9f50831e88be664ab39c20c208d3c3dd8a44564dc534c02fd41a39f7f86bc31f25e13322cebfe741fc5271a442d574ea14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a193e8002ce11704a2348a3e5c008c54

SHA1
8596f6d767dde192b56a4d2fabfcfa3ffb2756a8

SHA256
28430dfc41e39a9b753761f73849e3fe0e1ef845ee66e5db9bd5a8e5032bb300

SHA512
262727d595378fe97b35e1b55754a31f3c364e3800c100ac344b135e2c99bea5f91304a1c0253d26aacf1d1fc0ce4c37c0635c6b4684d98400d579a4c2c2e5ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b30facc3ed18017ab78953e3a63104d6

SHA1
f35dea11e6995d8da005a8f10dcccec8ce10c2a1

SHA256
340f51939a65cca0d40761792a795656e23923733e49eb8d8b65b65ba5223abf

SHA512
32f0b897b71279dc4e7ff2064c1ad487e7590d39f26309211c8c8e35e9bb731c17aebedaf06000c650d8e405cdd885e15d61136c1e875d226f92dff0b47aca3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
37949501dc6435b008303f93e697cad1

SHA1
a2f9f7cfa1f7e87f70b984aeb94d67d1e10c587f

SHA256
1a614b5039c68aff70bedbc378f1d8fe7292ec4d400173d629f6055c3ca1dc91

SHA512
070f99f1c67616a599525825785938a7555b59f34bea42af7f2e455d81cf708d8d33e2f86343673d478cb8dd55d005420e3d53c8bd6e0202eb1ddc69b4cf1604

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1080498e89193ea44543e275cb0f35c2

SHA1
7d952883b076b46f779d988c5360849f100250cb

SHA256
c84f88897c4ef68d86a9b6c98a5634010fae40ab59eb5f7964d3d59b4203caa7

SHA512
fc19a486abb5b25b59fdabd93f314b7123c4c8167329fc7789c0acf6f3eac4ebc8fd060021b6368ebaef067363fca1d96ed795a0642e927f8a269df57403f51f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab773.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC18.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit