b09357be03dcb2591417041c178026b7cc669ae89fd5d498fc7561088cd83688

Analysis

max time kernel
119s
max time network
136s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 10:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c08541e889d6ed2655290a8ccd9076eb_JaffaCakes118.html
Size

94KB
MD5

c08541e889d6ed2655290a8ccd9076eb
SHA1

c59747a31e7e110c11c7dbe63e2c6598b88c7dfb
SHA256

b09357be03dcb2591417041c178026b7cc669ae89fd5d498fc7561088cd83688
SHA512

5bdea3ed636e93d9e56708e748ed7aab42ff13fcc318dde716da425ed1a2bb5f0f76a65ad3db69ca5c5dcfbc5311e1d7fd1178cc0f4481f47a6ad5d1b615752b
SSDEEP

1536:WMLiNYf/va7LDVB9FL6onTc1fSGeWRtzgZ2Gy6gBdkrY8mgHC+qpEyW:WAii/TBdkrY8mgHC+qpEyW

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000001442f14e07ecc4bd55427987b4389bc9d8ff640b64dc65bdf6fa081ea3d6bcf4000000000e8000000002000020000000896ed97eb63d4ac6c5cb2934c3f5520bc17c8418096fd134a3a68255ca21cc78200000008b80bc188d25b0c829174c1f15ea8df1ae93a2acbe2773edcc598e191bf856f2400000006aba70f69845917e3f010b8f6ac1676ce58ac923079c39e89883bf2251a6a0c6bc8640052911389cc42019a67e8dc35ce38957178a47ed3f7fb6b8f184478a41	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3BC7AEC1-62CB-11EF-90B1-C20DC8CB8E9E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000102aa0f0fec293e6ba8e197d14b81d5ac4ce90ec15fed89932dc99e2de7df47d000000000e80000000020000200000009c69467e529b5973fbf1097a02406ca3fbba9b6cb3ab6fc628a850f4355da72890000000bd8f7a97d4f8afba70b7bec3e53e72536b6f3dd3965834f6ebc91e344374d4a9f2b0c1c5cdb37c1011f43a3551a004a8bac82ee3d1b7008b22bb148dd552863f767dd1a2d38c56e431cfa51821cfd166397bf61651d98decb5b15d8db6c96527dd8f803bdb08e35324f2a292b8ac39c750ca7a9c4878b193d5f64ff1780efe0907e111ee17d389735841b4c46640258b400000007d9814f8f80ca69f06117e68b06def94487acb9a46251244103450db8697f6fbaf0b5e95d20b1bdc493f35a0d23f0233cbfe35ad560058e0cd965802aed5b175	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 208fcb24d8f6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430742926"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
816	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
816	iexplore.exe
816	iexplore.exe
1240	IEXPLORE.EXE
1240	IEXPLORE.EXE
1240	IEXPLORE.EXE
1240	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 1240	816	iexplore.exe	31
PID 816 wrote to memory of 1240	816	iexplore.exe	31
PID 816 wrote to memory of 1240	816	iexplore.exe	31
PID 816 wrote to memory of 1240	816	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c08541e889d6ed2655290a8ccd9076eb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:816
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:816 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1cb2dc3f11311c03a6f61508345fb2d8

SHA1
2b44654ab9b9c08df97c72349f95b3a7f8cfb9d1

SHA256
afd703bd8e38eacae862df7f0052deef6f13dcdaef4e28bde9ef9746a81441fa

SHA512
f6128dbe38eeefce7aeb14e5a875dcd88af16e7682095879d4b891d8069b08684c9ed922f22dd06f8e3327648b0c15ee9860acc6b2687951e9a72f827b08aa88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa0eb28a7b0fd7ad6301ad90be6c8967

SHA1
03c4857f33096122c170f2861e0d35a9726a5f26

SHA256
031bccbd87ebc89ed2aa08317fc69ff900d17a6c9f94d938d99b967d7a603bf9

SHA512
6c1854c3c088212f616511223a577b69abb5ad40d995597423666b423757cac137e10d2862ff1877bb1f326696341609a18f9ccd9507cb84cdc1d8dcb158389c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64ef50760db8daec0c9243574217771e

SHA1
e75a76d1ff468a61e11ea7dd1e54e9a06e4a32e8

SHA256
ac791c38851c0b608d876bbade0ab2bfa7e814c7117ee9cb594e926d02ed6186

SHA512
12dbb7ffda4ae938071a75e57977c0724684f7fed222ae460f24f28e2a7d23dad3acac90ef13583eb704bd38f98e4fd4daf07d3617a484c93e2b1b7417eeb425

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4021721c2fedcf6851ca6f27036e452

SHA1
1b70d3bcfb42e93347031cd96688d15f0d206630

SHA256
0714396d8a72957e9be16b97f9ff22fb4862facfec0eac25bcc4a30dbdbf56f2

SHA512
f18d2a1481e31f5c2487eb07e7fc5a6a02d9d90018b68c56d84fb50e33c27feb1bfd90cd76f4b6fb8130e2a4b5546a8337052e58d506c5e39b7f56564994575b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09b85174498830b099c7699a482244f7

SHA1
a34aff387926888f318674a6c4aebe00692d7955

SHA256
50d2f249c86c973fe2897879d4860471fcced8e9518b62c00ed4252c6632c13d

SHA512
02c97ee942737070c52ee480ae004718303755b8695aa00bca6801d9a1a6741b543c1abd2f1f7a067030be330afc16ee43062b8b73d25064c3fcaf925e14ace8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb964a341ad75969d799b7aae9693754

SHA1
ef30e809c94a6a696ac24e3bd77ca942633f8529

SHA256
6cea8273ad1ba55be05111f569d1ac7c1f7cdbe853a8bb0ac31fae6e8bb9e8d1

SHA512
3d3903765495f0c5d8d3bee908af538a10f0a8bee285de1cc81078bb99a14f59e213e14511973f544ded8eacb533a1dce7630110138a5f1875ff48968b0ea597

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
881074fea55d4f0db461e11b07e70a8a

SHA1
1a29f0bfad77b73125947077d35864f311b68643

SHA256
68cfdec1fdf9bf85d2e5ab54a49ab3aaa5101a65ead3d040ba09455fc0372a97

SHA512
a75a9a98009f8184944bb9476d6b358268c9d01e71d4e0a8e68a21569cd9335432325601a067f2b27e49eec49e7e05288ad4b61c06b8123885cf861258dbb674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XY2E4O3P\gmap[1].htm

Filesize
162B

MD5
4f8e702cc244ec5d4de32740c0ecbd97

SHA1
3adb1f02d5b6054de0046e367c1d687b6cdf7aff

SHA256
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

SHA512
21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab87B8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8858.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit