8f57fe8771f7a86bb0e55d60abfd14514ae2e592db209a8fe7e94d1d89da83f0

Analysis

max time kernel
121s
max time network
148s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25-08-2024 23:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1c928580b53818a49eff340d4c94052_JaffaCakes118.html
Size

47KB
MD5

c1c928580b53818a49eff340d4c94052
SHA1

722966fdc1f0a3d60a216666f7f25a2211551e7b
SHA256

8f57fe8771f7a86bb0e55d60abfd14514ae2e592db209a8fe7e94d1d89da83f0
SHA512

afdf25c159c8c407b5e4ab9dc88668096aedf2fcbbc69ce7609ca604182e4e838ab65feb9e4c0e8a8c550b1f0351e24f9ca04b816ce59a127d2465a120606b75
SSDEEP

768:daT0EipBPU3fodPhg1P0VjKzSO+CMHskhjUKZvmOthSA+RrX6YrK:ITupBPU3fodPhk6jKzSObMHsYnt8TNW

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430789364"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60e4673144f7da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{53D517C1-6337-11EF-BC8E-E6140BA5C80C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000d07c28feb476e9e726b02e9e00edce3e1b7a234443f29657a01acda03debafd0000000000e800000000200002000000094fb50d93ac82f6e194178d128852bb4c3e2d8160af778a4c9c9e59b1e268d57200000003074914e08472eb13fb5f710b8e4eca1aaed484931706cfbbf9a8ce2dfb7b0d640000000d4713754e7ef9192f2fcdbda8e26d32adc3be34f53041d721dcb91adf4b1b31a40bcb6b7f4677ad5148cf8f069d3bd4033f3d7f822ced0c97fc2d07615cddce7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000c1f44023745e9daf1167fb19bf0e879dded59921c529460f68750e3426506355000000000e8000000002000020000000058a17418141b98a015da08b0293cec47860a42b0e1882a69dbfa46aca8d89c790000000059770060ac7849139b3dbb2182fea5b5b33fa6f1412137367e5a898bc8d26c65c4bf5fb3525aee08636dc2d49594ac3822eaf91c0840170c839b86b28c2be21de01c7ae95baaf983afb4752e06a0efd53bb79e2e0068b9421013bdbd4d74375900974672b1b460a6fb024ea54d3545b2689fdb9bca6fc6036b03805793f07f41b72992bd26ffe3eadb492d62dc1b6e34000000006d803459126707b3ce647ad849e06ed2509daa104b942e227d99a922939c0dd22cef6a4bb76286a19ccfe40df009095514ece61a28b3909622f0f26205d3d8d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2104	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2104	iexplore.exe
2104	iexplore.exe
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE
2344	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2344	2104	iexplore.exe	30
PID 2104 wrote to memory of 2344	2104	iexplore.exe	30
PID 2104 wrote to memory of 2344	2104	iexplore.exe	30
PID 2104 wrote to memory of 2344	2104	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c1c928580b53818a49eff340d4c94052_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
854B

MD5
e935bc5762068caf3e24a2683b1b8a88

SHA1
82b70eb774c0756837fe8d7acbfeec05ecbf5463

SHA256
a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

SHA512
bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
eccad6b747b2b1ad2de4b73b0cb148ef

SHA1
9d5aab7decd955cd39b57bba153eb5fa385a644d

SHA256
65237a528bad8f00dfeda062cd47149a35497fba2a459e759d5d9ce8c5f27bee

SHA512
0e5015aad17c05f2ff7d1e5eb8395d3882009cc196f245b0afc27455c56c3627d91ffff4d39bb3c18bd756886d38417563a44e0230befae12d5d2f0482d9e559

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3929f6f3bea7e29dc02b84b75c6946af

SHA1
f7b4046fe269cd2f6ed4491b6254a243950d1073

SHA256
b784d1bbeae4960b137929a8e4380a124ec8c749d458cc952c21061cad0f40fc

SHA512
a03f5cda5939ae619595baa64911b3697520fff8b487356f778c1fde4afec85fb2b8658255da82437db21638e4bbd80ec4b57f0e0c782a46a4a5982b7df52043

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69250501e2acb8bc4221d2d1dd20443a

SHA1
5ef0904c0c9bb81a6376d99bc04fef3700f01fd8

SHA256
fc613de78e519656fbac564311d735461671fad68789a9826e0e7257676cf552

SHA512
1be82bf0efc7409fd03e2d65bb7d94837edfe3265c9c9dad1a6023b12d46b0db7115887c80603d93601e66390d47fdbbf9444959d8b77f8519967b50201194ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee169b65129a4131ee4679783d3db7ad

SHA1
a78ab3a228b5eea8273c3262a48abacc6d0ab155

SHA256
f762da48ba72c09fd464a0c8a8750663c2789b4113a9da3ad26719283c51a402

SHA512
8955f72c07d71f02f07ce2aebb59edb12dda14aeab42e3dbbbc58c4c919e55818e72974130399309ccd1aef53a6e113524c1fa4cf03475b5eeeee8df7a956845

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f691fa3240d0c932cb23ba2b89e6e50e

SHA1
8e0752465f751fc634bbe3d2d20b7f4919e4410d

SHA256
086655ecc2fab72131af87569efe30579ee69d9c35ec3633a9196481f6ae1d8e

SHA512
ec982776b1f8c7467155d63364b3241b6d155dc99920364fe02e429d348833ef4d34683d0bf822c5f2f1f064efd87bf8387a25e302851ab35f183adb56d4332e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d0c436ae77e3d14bae6360f5c1f4054

SHA1
68cb1fea96f70f387182552d80aef440d37d5596

SHA256
93cfc0e9ae343d4fc9a700d59d80d4daedd8232cae0bf527dca7f9a213e742a5

SHA512
d1b5ec5cc3b9cd544ebd7d18710f8501be5400cfdcd0e5699b08f69139479d80ecebffe12928440683ea705324b4d32cd89a6e0f72b08aff0842a19bfe418090

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
623e3818c90185afbf9ffb457ec5ec04

SHA1
831092516bd653e490d7ce5eb87f2d35db7d73b8

SHA256
48c4296c72717d8a1d6afbccc6cc3255fce8cfb5e5c14ee864e4a3e4da050b1b

SHA512
c71481537ed89eeb29ce2adf47e70f11924687a2a251d079382590f4743dad59cfa15c5a5d249f8d3628b773320ed4bfa6ea54cdc2f0b94c2e69685023a30537

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe01dc545f9804092685d006208229c1

SHA1
3e97bb3ae254e4c326a9b4c9b4b97f164434f0ed

SHA256
5ef1edc8a7aac18ee07854af1835c7cb766ceb15f8b033fc5484d5c9fb903cdd

SHA512
9ca5db93a95e4b525a8ca0bd0462ff1dabd49ee98301d01f5200590649d2eaa69e69df3b198b0a755fb89602efcebc975711d284f52baecdea9ab9f959586cbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a51eb8406b6f3244b934ad665dd9fce6

SHA1
6b5beda0c6acfd1b51be5aae3890188177472bb3

SHA256
ba1547b7c0656dcae6ab9d169b3775ee337b11fb9c502ad427b3310d6d007344

SHA512
e007f5a8eded14d583987e9a013d6c3fa9e549b01efaafca1ba2ffada1c8a6e751bb2761b0ade22709cd361a22ef02b492ae074e210838acf62217d85f18d4e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b2ba48c23971c0bbe97d7c939985a2f

SHA1
f1d58e32ad1a4c22b7b35c01103a8c6b2022aa1e

SHA256
f23ea3eaa88f5dc8a976ff8630836d13bda85031c27e65b6ac88dda7c8851882

SHA512
682d010166293702ed81bd1192485965247e8d809486103aca04fee9564e5b29c700d6d1f3a6393862f019135bea801e831fac8bc010bd6abe773ddd37d26657

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
6e5d8b2634210e9ba4304c9edd3c2c2e

SHA1
e28d53c2b2b97c1f614c5ab574daf4b909e00c14

SHA256
3161eb4cd245138973587812e935a8ad813ad5f97576fb98276535c0ee7283e4

SHA512
9a5c19758dc17c8f667c2b922fe761f5e41870392f1fc612d9d8ab1e1043a5a033ebd4cd933a65edfcc3767d1077434a889ec669afaac010dfb14d3aefda50eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC5A1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar14CA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit