d4def31717a2da05562e9f743cbb42bd4185b69236dd36b1d06954fe729364f4

Analysis

max time kernel
135s
max time network
129s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 23:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1c88ca599a0aceb6806734d2742c2cf_JaffaCakes118.html
Size

29KB
MD5

c1c88ca599a0aceb6806734d2742c2cf
SHA1

c49319e7510e478d952c4f9414e63c80f616f795
SHA256

d4def31717a2da05562e9f743cbb42bd4185b69236dd36b1d06954fe729364f4
SHA512

595941e4a094a9ca3042a9975502ea7e1fd07a0f76c333c9aedce7e07e1e79fe5c10fbc513a53ca40cc42407e25314141dfc780188ab51f2f6cad7c2b91e0a9f
SSDEEP

768:RZF02AmOahaxHqMUk/EWMoZ/EVdCWbth1xI00Eo:fhaxHgksFwMVxBG

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000be23e8ad3fedbbb79f1e0fa5d155c2b11cdfc07b9c16cd921a5b46e8a3edefeb000000000e80000000020000200000002e18d90f2a4051b37e77d8860883e32a47fdbf0d5a81def6143a4adc7287c94390000000b50ac424e8aa1e84e309f2cd4c9b3e76766ca711fd7b946fc0705ef477013d2bfcb81554519b03af723b0d99fe222d570262b5c8152f346b8a0895828525170ebaa11b136ff99aa0009e0aadc89ab2e1a82715eda4ab0ba73644bfc890f9b4febceb45025fd784f8917543115f79c278c36e6222b584a755171c1279a8beba73db9ac37c8bc62b9b23fad43f181a757b40000000d02f43099ae424fbd9ee26c93e55787fb5ea03ec2593c99e1426ea20e1ccfd040933911d529f3e1becf27e3883e111e6fcccb19f92f367371607fd6803d9ed6b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{196AAFA1-6337-11EF-8340-72D30ED4C808} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430789246"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c70000000002000000000010660000000100002000000047c4c142c240933c22f91a44816bf6f7d9a5d3f2b045921dd80f653b2742bac5000000000e80000000020000200000004b62850e3d3186cfdd61f18440d9400a18b65171787d85bb74a940289803e52f200000006652b7ca860076c2253f7a7e975a165efb632f4d1b19ce3904fe20c0b2ecf7b44000000019535e69d7b64f42f209bb4c92ad9013fc71da3d0ce96e090517754eada37ca6816d74af13ef72baa7632022a3b4edef67a24b660dadd7fff260fdf6d540f280	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3023b2f643f7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2308	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2308	iexplore.exe
2308	iexplore.exe
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2128	2308	iexplore.exe	31
PID 2308 wrote to memory of 2128	2308	iexplore.exe	31
PID 2308 wrote to memory of 2128	2308	iexplore.exe	31
PID 2308 wrote to memory of 2128	2308	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c1c88ca599a0aceb6806734d2742c2cf_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2308 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
325d7154e2f3a2288b29a6cd4c2cff5c

SHA1
a337efed45d12dec087529dd520b0ce0b4e863dc

SHA256
a95fda965e0a8297a377133609efe975fe10a187772593167478ccbbc6c26cf1

SHA512
e696aed690d5eef80bce5097a4e3243815bd029d0993c8e8a4f5afd88d6999d2b382bd456e8db6c3c8bd43e797476f54fcc9cdfed049cef8373daa040d682085

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b09402764f17a2797d4eab45700e6fad

SHA1
f89e03294979b5c7cdce7b1cc83e62502fbb4451

SHA256
f8391a12d87878d56dd2fca2b2730a840bdb68a7c3f30022a372da2d284467c0

SHA512
8675da4a72204060a8f970ea82000ad63e6afe71ceb26685083681e9d52abf2b1e491fb51ed7a1033996850e64d4e1b945d7b77a090e57f0653f58454f4601b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a2f2cf28dca0ab8579764144f5faeb8

SHA1
1a12060d857ee87381f2e76f366ac1d752369a19

SHA256
5f6d821d5335f41ddff7ffb7bad9add05be33689996dd260b7ae6345ed138d01

SHA512
bb638d5210cc966aa4fcfb6be763efe57456b814ddb4ff5fe1ec21bb1e7334c70d28073eee1c1ec4ae0fd40d000f5e5339d61a0b44b8616583086b4b638f513b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17e0a8976787397ae16e78bd6ebcc08a

SHA1
7d2f7dbb7a386863ea39a7f0b4edbbc48b15e6b2

SHA256
73e816b80ab133c680e38e399ae4e44e575c832afb204f6ca93a0a8ecd943a96

SHA512
b43d769e2c3e52774503716ae04e6811c6826d14cc680ac472c6180833690b32e60a0d732dd05c0a49a892e84ac674e0ab9e5c4f622b673e04f30e2468ca34fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1f5990577ede39e4815e947c8ff09fb

SHA1
7092846c0592f5213b88bf255e0098a67b8971db

SHA256
c340e4a72ac4cf4ce9ee4909e46642d5f1b24110ae7c87c004e6c2f83567b7b1

SHA512
5f0a819074192c64141c3ff2da4dd260701109bcabdc3682ad09ee319412328134020b02315f0cb0e35ea8551bd3d6a323b0c7240b3957bbc51e0c850d093652

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
052ba9310e227e9a91740a57e08bc47b

SHA1
2ca045c4a6be7a87209bb31c8f5a850a1e502058

SHA256
20111ba14eaa9b0ec81f9cc8068a81427e2510b8f82f4104983e79e5a31b960a

SHA512
ba6d268e0a4df91f3b8d7a4d8f2e4c411e064533467f95c2e9cf81803191e3b4c4e1c2e65260e95fcec79e8717f8204f6c5b15a4bc52b116449c8075ce53d927

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4efd0e0be9ca0a1326aa6e35ffecfbe8

SHA1
b177f757f959680bde592c84091db8cff002f3b9

SHA256
60a625ae8a370ca6001b4eccbb92393a65f70c4921b2cb732f60fe7fcb00b51f

SHA512
f597d04055920f86c1884bc4097c7fda32fd914b2bb6fa069a14182c43615dd4e86d6d1ea7ff324e2ce3fa2c17f00e1302f848dc3bcefc7dab04dc80f7b7716e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31dc9a524ba6378ecfaf06e6ee7d1ccc

SHA1
5e59afd81caed846a43c1e4f97718154fd2b7e71

SHA256
fb764e602dd26311380bef781faec56b7ed385602011da9b473efbd5b67b8b4e

SHA512
1f969ed4bd5c84434d4f033b3d5fc0381851355fbfd61ac17cd65aaf5660110bf23c524b324c840c486989df1af96d1d4601821136a4815e95f385717a6f76cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
916717dd286695df832ef551a8b37710

SHA1
0f8436709cd869fc19060d514c112efc9ac24901

SHA256
e8e127e03807be35130901699c3f77ededaa8a4eb47de4bf923b2e51b6d10f63

SHA512
265cce45f1fff9812421c55b0986acc259499378510a1d7a909e2feb22fe76c824f649082c4f4ed6aa0b648ad24b42277d9a74e99b1c362bf7a8b1d3db97f883

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4668b3b495589cc660c497e9370e0c2d

SHA1
27d8289e6fb771225410dda4d31a79f266738a8a

SHA256
106085edfb5ed2237ea8eef3579523f4dc52c2ef16a4465c9ae0da09cf5d1a37

SHA512
d63aff0c517a05f75ef6d8ddf04f373169d6e4e551dfe2a4f878146997025f70d410baee19f452c241e4e154d530029443280f388fb3ab3a4da4905fc85a4d0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf20c82aeef56feaaa383e3087043438

SHA1
6bba2954e17704cbbd6156086377a827a92001dc

SHA256
0d225d57ac8a8f13168d507254f1b15c19642f2e82729da4213a8a5ec9fb4102

SHA512
8f1bfdc1dfd4e335a72f628f8762fed29cebb5e981bd74c9cca524f110356d8016bff1811465afed3118e28e74eb5f3dcb2c14be50741b9bd53090701f0e069a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab342D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3C99.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit