60db6cef85bec4582bc7804dd943223aff29665125758bfe1d3bb908860d19ec

Analysis

max time kernel
118s
max time network
133s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 23:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c1dbca41b7c2476a293ab52b171c0985_JaffaCakes118.html
Size

36KB
MD5

c1dbca41b7c2476a293ab52b171c0985
SHA1

4958268537f65e3217567050373d209894974ef1
SHA256

60db6cef85bec4582bc7804dd943223aff29665125758bfe1d3bb908860d19ec
SHA512

7e77b114d90f2acbee7584ba156c67ed6a38b95ae830e2995cb52da200af817c632d7aef6ef89c715a9559aff9411492fe4d83779fa8be0403d498a3c816a218
SSDEEP

768:zwx/MDTHKMK288hAROZPXNE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6T9ZOC6DJtxo6b:Q/1hbbJxNVEuCS+/Q815K

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000069569ff1d8cd21b9854705605db375bd3657f2e1d323f494c42860045e72e787000000000e800000000200002000000099fae72625011140dd51dcc0390770cf71153f1b4d3fd8648efc8e9e52da5851900000001b093d15d8986facfa736c5f14be8f0b4b49b4bb1ac1ffb2dd0debb37e93508f083f266a720a1a3e91bb8da0b53652c3b7bc57dcb84efefd7b03a36b6f62b17de0240985c196d47c63895c8243c576d5c9aeeb491241d4b9ee884521e444964ec7189c590498a1096905937863836c290d9f9d1f9e0763f1f5452a16ffce426b9124d397898778870cb088d76c84a3d340000000a3b9dca3d21c09913c026021d61878f444302c083b830008f3e8e5d430360abed4ef13db9a5501eb719a11c5f834a021eb95fcc6243f6bb42a272a5487078d01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CE98C501-633D-11EF-9584-DA9ECB958399} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000dbf368849c3b2c8be59f76edd20048e3f692f8fd037e5ce92f1c50fac0339ac6000000000e8000000002000020000000bb9a76ecf359a1df28ef9db42fbbab628d281a7088caee075b3cc85b5d29c23e2000000091826db4288b0c97a5a8844c49bd9fee8db42c4b7c19a5605d6060e2c6057f3740000000f941a14d284dfd77fa8740a2deb72e2a357bdc207ce7551ecbd3a13d6ac5adb4483ffc332d7ab78021ba5a6cc3aac3ec208d709bbd1a22e70bb5ffc5b473fd7e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430792132"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c06a71ae4af7da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2704	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2704	iexplore.exe
2704	iexplore.exe
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2752	2704	iexplore.exe	30
PID 2704 wrote to memory of 2752	2704	iexplore.exe	30
PID 2704 wrote to memory of 2752	2704	iexplore.exe	30
PID 2704 wrote to memory of 2752	2704	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c1dbca41b7c2476a293ab52b171c0985_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2704 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
2e94bca244f17ba28a4e5fad0fe5c0dc

SHA1
f137a235f30da5f8110758b2145065e720b5381a

SHA256
2e33fc3f3c0e91dc83d3d52192f2d68f0f8ae2270619c4ccd07ad386ff6f3189

SHA512
0c9846d8a77fd93cabb7f5ac319b14e58a66c1a2c2b257240655e134bb4c6a638b3a8b6fe1ce2ec00995149436952018d9b35d318cce946300f881b06d893154

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd17b0209d6cc0e51ca0bf8e563ea032

SHA1
7fa740073ab339e11827577a4302676240a690cc

SHA256
e21c8ee5afc36478b3b7d6a4a4fdf0868fe4b8dcc867926e24bec6cc6ecf46a3

SHA512
1796f542e891a3535a256059417b02b2395bb7034570e1b451df26d94a10585eefffeb542a0923e7e6722aac5db85e06fac6119df6774dcfe093efcfbbef7fd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07ea7327634fe2c78639283d3b4b2312

SHA1
458cd2e9d2bb54003c66874f385392be3fb5346c

SHA256
2ab49f2f8bacc58d1e8cdb4970c563dda82dab66cd1736f1f652c18bc7bb6e37

SHA512
a6b8202db3b4b088bf92a87682edfc0524894b309c581dad8e34b74c4ce87e2cbc53bf8af269d44db64d7a5436ca5badf98a30ec8be4ae97dd162b7f1ff0ca97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
418cf6871a70050c1ce24f76f91b66fd

SHA1
1c80f8fbe9870d835133d3e939fc846f36a52d02

SHA256
5911f4c6834f09bd021a1b137c9bd8a4fa823f62309af8e609bd52ecfb1a9655

SHA512
d4125498a56ffcda0723387545adeab939f22afe60f784fd86d2d55262e93cdd1feadc4b1e387d63068536790f05e4e30fb79ea69dc907a17767f8d312b4ffc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a6a423e0c1184f9dcbd2d66d4693ed3

SHA1
044eb742315dc93c6175e2fb857ecd55d5ea6619

SHA256
6d1b2e439af89c8bec3b6c006525280b518cf07f7db340ead053739150f79979

SHA512
20f4246ad60360371b17ddc6810bacf60933afafdbe05896462b8a75ce94c37a5a93088e358d643665e7556a7175bc8db7548fe8e6543294926f293a24cec8cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1c44a0d148fe0fb38e29391718b730b

SHA1
572980e71776770a1dca33c702558aeb8ab93e97

SHA256
3c1dc0b00a82f156533e3ad50bd036485a678cf7f775eb8b156635f8207d811b

SHA512
b51b992beaf3abdd9a9a6180c6dcd9cd42ded485e182ab4b997a6e1f8e19bf577987579caa6f1559f477ba6dffbff631683cfc09c8f1a81b11bbe1dded1fae2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71549014757ff764c38256b1ad9eb5bd

SHA1
a8fe596e11b8ebb19941c7d1ae5b4557dca54293

SHA256
c4df6da9608e0b1ca9fa59bd3a2876f417358807451e0c85970a6f69bd7d8c1f

SHA512
6b67eab412cb966ebda81d4dcad9d3d7c684b1b2f1263a97871b4e69180115ad899317d385b14c13ce0c76203097930ce6a89702612df8ffea3ea4c867f69ef1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d26ef146226e62c442ea4e09d95db741

SHA1
208dffcc6e6ce0127262ad577c670b411e6db75f

SHA256
1ccace4c38e774f52c70576c10a36d36042b0abfce4330be110919aeadf0d4bc

SHA512
588ae9a015bb47ff5e8c8f1a6071da864b241a8058a745988a8186507fcc351d31a67e47c46fe4a5e5e52079ccb3e7db15d78f3a88ddeb2b998415e27a427968

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a91e1e7b98adcbb8c07e090fc2f52b6

SHA1
584be8c50604444b952e1df07c6c92e66fdbc928

SHA256
0df378455ac58eaa394ce57e5423ecb482a6a78406cf8e489af5e66e948c53fa

SHA512
bafd3bb488c1acef7c6c2b4af64163e414a51bc0362ad5946eebfd1b3e32037f24e342eaabb106a3ef0caace6f43f518a9b6b77b50a0a0f2d26f7c65ea4ad1ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d2e9339efcf75d05513184e545786b2

SHA1
32c31c6740855184ae269a3bcaede7f278a86f3b

SHA256
e59fcba74b37f65d07df74156ea37641f3e1cd2b6e651976a23d1f46ee12100c

SHA512
62ed20d1b268004285ae0bb0cd43b75a735b170a604b0c2b0e1f54f2d83557bb37f72f60a38eb12a946fc64f0ff16533e6b4c6aa4872976c160b4d8259a1ef51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25

Filesize
482B

MD5
599e9ff9c08584086d42cb56db348dbe

SHA1
38f0c3f1f93e9109b32d783b9404c72e96e25c0f

SHA256
15cbde3ed53ad02d11a786a3761ecbb94f10006c6bbb8b983cbcb816283b6cab

SHA512
c16b25737e6381ffc814e3407eff5e73d9793d238b37bd1f77a85f5ee78d9e41a0e4488eb9bff61eddc797c8defee58b21fb932d6249559cd7d0c22cc0a4bbe7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
84a0cf33f18962b6c382a627af30a408

SHA1
120e6bc2ee9cb9bd32d5d8f8f0a2f6d6bdc674cf

SHA256
fa6e04460bcbe2e8f26cee0ba93d5adbc482028555bc5968486b31fa8121b114

SHA512
7eb842e20ff5cc7ebcd64a3228c3d8ae1d9764e458f3cb05251816dd735f1d5972e565f7f8b31a689c33c081e03c68f0b8f7b9b84d31c71e9e5fae6eb5eaf003

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5FBE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5FE1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit