03886ca1f4bae7b8c42c64029bdeec992c3f6fdf1d0862d5fbc016c50b6221e1

Analysis

max time kernel
67s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 08:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c053c8a8c0c317e6d916aa8c3bd19837_JaffaCakes118.html
Size

18KB
MD5

c053c8a8c0c317e6d916aa8c3bd19837
SHA1

f6b8c97135f18e7624b3e8020b39d686fb7db71a
SHA256

03886ca1f4bae7b8c42c64029bdeec992c3f6fdf1d0862d5fbc016c50b6221e1
SHA512

fba4a1da92ab5f65cbdd3b77f2237972f00d65c1a4f27f48d5151f132e89dfb69045de480ef8b521e6feb1816871da456a7ba3138a57e53d04b74eed33a5f3a2
SSDEEP

192:ge6smYxrFkIdfFL8nltq6g1mQqp4CqYVmKY/Td2DEpYBL30wp+GZi:gE17L4VmKY/TMEyBf8mi

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 307fccf7c7f6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000000f2a9e37dca909c5704593e717b92420d4416f72f2963c2073a69f922d60ddad000000000e80000000020000200000009734a8fba64265c628736d3f29785a649f1d62ec87ff82f7304487070871963320000000f88bddf49a29b1044a27b570127beda9efbb75f9872a1b61bf8e9a01a304e72240000000a84b8c15df5ec556b49b1a48cb7f6a28ade2fc94f7e2874039778cc5af7f5c19665780d5a2e6daa1afe0937b4c0b07fd5da86a675dacddcce20f1ec22868b6ff	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{22B7B571-62BB-11EF-A2BE-5E235017FF15} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000003694bb364fa4d8bd77697e92fd082f9ff97cea87615c31d23ef81a65f3abcb42000000000e8000000002000020000000123087ce4c25cbac7e04e6f10965b4d4d2f29946d493b60a568264124a3959ad90000000f260b79bcb2d3b571bda1f086d140c59407140d0649a9c774fc9a01d79c615785761d575f7ddc8672ba1adb336ee78ed50dd241b0d4ff78507b1f20132277e59ce2b0520881a90244932a5db1adcc71483415c15bd82cfa5d70e30183a1bf50320f59db66deca91f3766c805528be927c3f46a83a5105f5eff5ca33a434abb04e5e7e10103fe12d386f1361b5aa7ed3240000000d66b5269d20179923e3184155266d69fb5e90c2c9fc50ad1fdd540faccba6c29e56cb67836dbf9a408c4a96a7940824cda27dc7c6020f1be74a264a55ee3793d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430736003"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2220	iexplore.exe
2220	iexplore.exe
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2592	2220	iexplore.exe	30
PID 2220 wrote to memory of 2592	2220	iexplore.exe	30
PID 2220 wrote to memory of 2592	2220	iexplore.exe	30
PID 2220 wrote to memory of 2592	2220	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c053c8a8c0c317e6d916aa8c3bd19837_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7551597390f7c71d9736513068b317e3

SHA1
29f20bb2cf59aa99beae824114ee801321189d5d

SHA256
930fedf0952cc5588a4077b639ecbe35bd6c8ce9ee2009b286ba0bc3f0ef8ba8

SHA512
d7ee2b0ed48ec572c3d032a73af0cf52c64ca34ba8c7e3af4a455a7e6dbec2cf63ab75cb646040c6103bebf5184e6e171933808746d3b4884ce9a4701b323b62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7971cd568c4c7846dedadc7aecdf1cf7

SHA1
352c2cc5e7ca756f65c19db4d710dc08bf36719a

SHA256
0ec0ca6b9da472ca2e1b1678e7bda4b9a088131b6cc17f5acdc90059c9f753f9

SHA512
d7d7faa0fe38f9c91dfb019d5eeb26afc7c31ecb647c8ebdd3ddcfbb0a520600c137daad8c0fe252bb94a4796b0657cf95308eb9852ea5341b69433bde4a4fc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b941439c2d10e6539cfe6899309546e9

SHA1
88c8e9983e7368e0496598a643935c5cb4a1f17d

SHA256
b908424a54a0215a0952463b296686ca3774f9019a6b4714ff349fdf0e67329e

SHA512
35f97415be4e84ea0bbfc919889a8d062ea56d1ca0706ce6e81e1378f989825b4f54aa57f056eebc93842526729bda85103f644cebe498ef3d8df4801b1b28b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75ecfdb8c812305c95d1c6239a819ca6

SHA1
607b75aaa2f469d202e3bc483e8ce8d6b2bb7b9a

SHA256
e87e071474300fd0160a8537cb5dca83cae38c627d08a9b0ca74cd9835a293f0

SHA512
7036c9cecbded825d426fa73a4da69a25eb6506e6cc259076aae541ee464ce469ecc9613d520a94d629a53b561dd91e03d2ac6bba39317f42fee23c70cbe6a7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6707b1738bbcae22885f4e4f706d2662

SHA1
ee7d5574269e583d7549c672b1a74482c658301b

SHA256
41fc0413ac5092af0d6a14910068a283edae67e84482330f477a52637a09b6f0

SHA512
92fcf28064996842a5a867ae4197f406d882a9fea8f22618eab8dd1bc6101475a1f5530d4fe6fc022e9fd0c4f23cb2212c3ae4baf3aece52502de3a5574ee34f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3d48068cc87d5f644470763767865be

SHA1
1a6296ac8d8430d3e1f93e21397163ab2a2b50b5

SHA256
f7fa934519fa8784f483083924d989e448e61066fdd15ca37dc1cc54ec2ae4ba

SHA512
012eddaecf70b6f6bc4874d15be62da97ecc1acbf4a4ad042a40c44a0fd1ff101748f36f92865baaace5fcfb7cb85dde4e840d0b78fc66be00061bf1365439a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a6c696cdfed833494851cdb52fa32d7

SHA1
ecf1e1af99ddc08e51d3645674a6e33ddc90eac4

SHA256
f425c47cc30f24bb248601310ed6cf014199b2d8893b3849bce11ad1f2e8b34d

SHA512
91c8f8938b4749ce557f76ecf74f03d212de5925f0d72b7ce5a338b5a2a6b74948cde21d678d8faf3cfe6ab3085d66a8e0063bbcd829a9d589e12ef8d4fc6c11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e798050dff259576ffa93c47c76de5c

SHA1
a757100a2af7ab280deffb21c24cbd2ed8a7ffb9

SHA256
e4e6c413b7f501e976647f4f3a48b4c07eb7d7790aa61d50dcaf33adb5a126eb

SHA512
5d2165f3efa4e63ae273f9434b6e9c84d465d4918567a0f3191e3df3406810d0e21f52439f295c980caf2344643414c91829ad8cde079b7f22a19c90215bc60a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0dcec78ff654c2b3c19ecfc544c922ab

SHA1
6a731494adf0944bda6c5e75a460590291aa6bd0

SHA256
f4d73aed72021abbf0aa05d62741183bc38cc15dd826dc98a092af0ec1bac94b

SHA512
5e7fc6b5c0754b6f1aa458b6347b22723c9f02b83f678073450dc190dc5e4dfcdde9bab23ce2fbb302fba010efa05021d38a937833d67ce0f2f3784d2c71a5f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3d87b91cef3661c06f15c42d28f07cc

SHA1
5bd818010d715af9032af6113fdb9e0b6059e6c1

SHA256
7617efd71a3ca7c331962b40e2f82bc4bd3db42b1b750b654c79c214d1c0f345

SHA512
626375ee1a53ffa0b20b96a0e42ebfbd548f5049059773636a9b5ed4adb1f3f5d6a1ffb7c7d1eebc1a914dac36a0f9ef437e3ee9ae6713e5bdce91a3a906fd5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5eab73a67f17b07391895c03a93d6341

SHA1
b5f9d6df8f46ec2abb25c303f2e62ba0d3279e09

SHA256
30633eb51592879395455a116cf68c4a9cb2b8b3ec355bf2da5b479fa8968524

SHA512
723486c84d204ed6f9e5d8b411af5856f13ef6fe4a0febc1e0e947843b33455a63b7729d5426ed317687ce2c0ea324a9c0e24701b79b2e5e9c72f6b47c5cb999

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBBB4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBC72.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit