74041d4d00d06c0908a2960d86e01eff9a7f61d1c1fd22a881c2006e9d782f41

Analysis

max time kernel
145s
max time network
139s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 23:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1d1348b18e657ac2dc0fd4e7a8cbcbb_JaffaCakes118.html
Size

25KB
MD5

c1d1348b18e657ac2dc0fd4e7a8cbcbb
SHA1

f54193821bf421f7a43c131c727cac4d0bce3bb7
SHA256

74041d4d00d06c0908a2960d86e01eff9a7f61d1c1fd22a881c2006e9d782f41
SHA512

9a9ab725d221a65a6eecbb17e70f1306cbd32671f9ed8f0dfe786da8c7acd457e22ab768feedcdb00abdb77b65b83a6208ac65f696db00f6db74de03da7b81e8
SSDEEP

768:I4CEGqSqK4jy1lxVui6MKFmKiU6zAH/xxpdpFJRJll1:I4PGejSPVuXjSQ/xxpdpFJRJll1

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000e1335defba7e73719903a8f68e214f28c19d806f39ceb48ec17306afe571ba38000000000e8000000002000020000000cae2cd83ba53b99c5d7bd3738bf739431839b8c78bdd61df81d08290a182927190000000efac699281cec5eaa0e09c3f88c26e1f936a1dee9613fd1d2e5754b4d7414441c9e5b0a79ed26e353b355d74256459866d3211905cae1b883a3b65f384e082e5fb1b6ea44e43723f9936d9b0370d891233362a0fc8c99ca99cc492ef7e6f1244da302a7213d5971a9b0a69d1aebc1f1ceb195aa3616eeb7ff4d01a6cf650dad3c70768e19b0d3b37a2081484321d9130400000001f9095400d365aff807b1dada444b88dc58b04b7b816fc3b793c48af8c6ccf917cfc19a783eceabfa189bb5bb6983c2fa418fe3e471a46cded8af6080ba40524	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b01089b946f7da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430790451"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E383F381-6339-11EF-832C-4625F4E6DDF6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000005b84386b99c57a6234400b2c7b83230fca94da0b8dd1e07817344ee1e4dbc491000000000e8000000002000020000000168eb2a3b09df308ef3979231125109e907f5cbda17f0b3bdc9c9664d7882b22200000006d7bf57072567cee76a03cf0cd737ef7b9eab29e1990e3d5969bcb81daacd7784000000045d6e492f1c6637cd24cb528fdf39782644b9a8c19c5b203fc1610955eaf817bab582976b4452d59bd4e9aca639df1cef4a0f74fbe85e39c80494550d3d219ff	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1080	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1080	iexplore.exe
1080	iexplore.exe
2008	IEXPLORE.EXE
2008	IEXPLORE.EXE
2008	IEXPLORE.EXE
2008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 2008	1080	iexplore.exe	30
PID 1080 wrote to memory of 2008	1080	iexplore.exe	30
PID 1080 wrote to memory of 2008	1080	iexplore.exe	30
PID 1080 wrote to memory of 2008	1080	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c1d1348b18e657ac2dc0fd4e7a8cbcbb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1080 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
954b8f66b132badf4ac3f078eb91643e

SHA1
2b846a4012308a2467c38a22c30295807ebd21b6

SHA256
641ac54d520cd4371adbd81093a02cbd9c46b5a1648bf5f95a6556bee672f554

SHA512
4ccbfcd9df8538531454c8d96b6458a6b485c6b56dc964a29f3a9689ad3fce2787c5930920ec4c27700545230bfc1a91c3b50df8c6931ce9fb45d9b8e3fcb78d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b22455ba9cbd5d513c6cc35bffa2fd94

SHA1
ac12e9cc7dccc8793496bdb43d1405822c568a4e

SHA256
b0c0a87e77ae5b76e4bead43c6a15b398508d8c40c10c01792da866d3471b134

SHA512
7a64cd0d6458cabd6ea00983d5ae25339c708dfea7277c715e31f6c3298ec1c3668a6002d3fad523a956ac9b8cefd51da94c398cdb114a4de5082a1f40bbffee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6efecaaaaa157b73d7904effb13e651b

SHA1
261288da319da574909083860e5adea101b9b8b2

SHA256
a95920a69ed19c3ea9ad24774d1df36b68c65c49a5899bdac670a8abc7d4213e

SHA512
33b610b0dcce186ef176c033f8b5cca263259e67ff7773fbfc6162370819805292f91efc6108d88616a381a9c0a1d850e1d3e2e555668d7382bce3faf3f6c030

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d81f362f15067fa23676a9ea2f060dc8

SHA1
ed09b139926c1deaa69cf4527a7bfae0f9a51bee

SHA256
3952e00119dcddfcce447f99ea6493d703a810ac4f069d79a7d3a1d48e4691c4

SHA512
815acb82e2235df82f78ed646a00439dc5c11977110e20346966187c45e1f9fdf376ba6d8b0198cb36a4d33f25d9780eafe516e5d234da5ba2a3858aa69e34c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a89810931219e7427c312f9bcb327a91

SHA1
18cd8dd7ba06427cffeb8fbf129542e141207c27

SHA256
d622d6c6ceb521ca56364ecec140bf57af435a8b4fd2f6d1780d49e562544d6e

SHA512
13d62358318f677aa8f9300ad50c340911e38b870f96b0ce001433126a57d57d082c354ac6be5c7e07b97c00b664c12f7e2394fc2cd2037ae944de9f84c59aa8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72f46ec21d07fb1d4f5a3093ec0a6326

SHA1
4bbf30496e8a0bd43f1275781cc8d858ab402056

SHA256
7f32cca16a44cfcf60096ee7d2a37b0e5c4257c268122dcde7fdea1304aafedd

SHA512
5f8a3d1c9a64a54cf2a22dfed4894bd29925dd2e4a32ef62ac6033feb7f44c39e0b79c0d253d4ef4210da28d709a4d30b9f87c78b03355700c52a89c954f1b57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e68e4464c433c6484567ca8a2eb8a3c6

SHA1
f9404923c5b293fe39ea335cd98a3c72e598cd6c

SHA256
78c674defbbb2f162bbd95a5321e35f624d48c0ccefdaafdbd9b3e20fc1c4351

SHA512
72111803b2a9df0d4815d3876593a485ed157d2223524e2319536cd0eb9e96d7188bb7c14bce6aed21549234d6c7e224bac4d79142bcafe8260728161eb3166e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cb824dc1c35a67e7a73ec8d574262bf

SHA1
40dedd344555395c5ba15a1d98ca95438284b348

SHA256
0d8ef823f0185d543c0643cc7a3604c25a57d064f93f615ca8d7657ee1ba0a6e

SHA512
ec1c6c7f4f67324bcfd9835fbb12f190a366e0224a474afb0e8f04b64577afa89af3bf9a466e469d6d3de90db8620b8c5f600a069ee2c1d495cb2279da0cc8a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
618e8c30e71f56f4648012a5f269cdd0

SHA1
aa477fd0fab11bb991d86e1305c412e50a06087a

SHA256
5677fe86e5f82e10bd81c3f01e8e1d898befcf17307253105cd6854152549849

SHA512
19ffbac0fe8944f881955c7e43a0eabae5de294271a761abea1610359f63bd95ab8351553f94fd6d71044fd7a038ec6e9e94d23cf1368090622ce3adb1af9f40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30e9e8fd8f1b17b06738649c557566d8

SHA1
46fe36695b2b0fa23c648fbb338a9561cbe7adef

SHA256
a9ddb086cab74d99796a9ecf6611e9ea42f0cd99e081bce7ce5a8da3d2f92843

SHA512
bc9d5055ec0bc0f548363b444a6494b3276a879024974209d6fbb8700ceacfb6ccada8e9759d9e73341b2816b884dfe732323eec0d6b875e874e87558ecf168c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4beb7933a620578b8ea7badeed3466ae

SHA1
2a3a1fb519d7546e515d7ef9fc1c5be2388ae2b3

SHA256
b28f83bc96ef6230acfcc03543a3d1c46750e5c8d2e52e57cfbdfea1696061ec

SHA512
f4c806bf67cd1a8b8c58131a34655a56ce0ac24dbee9db8c1583ae4a88ecf8851c574f62a1269b87eea4516525c61f5feb31c19d0e66f96665ae3379d3b2cc48

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC786.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC7E7.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit