c932e808bb0209c1897ce65e1df184bc001a3ce1080b8592b5cad68903d11344

Analysis

max time kernel
141s
max time network
142s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
25-08-2024 10:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c08d7e1975688191d550bf993477e090_JaffaCakes118.html
Size

57KB
MD5

c08d7e1975688191d550bf993477e090
SHA1

f5378edd9ae8a2cc07a1efdf4fca5211a89a6b8f
SHA256

c932e808bb0209c1897ce65e1df184bc001a3ce1080b8592b5cad68903d11344
SHA512

8cc715067de58ea1583af4ee62c81ca87fea735697495684d4afd4cc07ae0f554e894912e91acbcaa83db9a44f08ed6a65a9800b04bcb2a0d3651305b43445c7
SSDEEP

1536:gQZBCCOd60IxCa1ZOfcfOfafLfefhf4fLfgf+fZfmfkf7fIdfofYfHf0fqfzf1fL:gk2k0IxYUmCDm5wzYGB+MjkAAP8SrddF

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000b70dc47607bb060f0b73a0758720dd0502c0eba233099bde0ec287b1fe5f3724000000000e8000000002000020000000a21e17d5f84938829bce88722c67ef9045dc93db4b6007827314ab94fc9f064f20000000312f7bb1e6041fef77abd00615b1cd303d1c51b23aaa7a0a71bc32a45514fb3d4000000054e6810c6c2c83a2fcb0adc9353e46570e00ca844853cc5b81256b94de5d98389ab8e29dc750b2900460c0f9675364cb39227cc8f32a0f4f8a6f25ec1d7522e5	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000c80d270cd73e0ed41fbafc9d520ef5a197e0a2ea4ab57276ae1f1e41aab62cc7000000000e800000000200002000000085ba4efa9c65260413b6bcad0f0af7432f59e846085c5a9ea1c99d25f77e0a5290000000881ec85d4eb862f15cf8c9be919e03a77319bf65b7bba9de9a8c3f078e7a6ada7b2f2feca7856efbf5d56f1206add6f572d2a93f418cc4716caa7b610e8e54d37786d37c4c68001a78de18162cc3347a78b8598c8241639dd724b02f1ba07af4925c7771cdb45bdc71d328d3a0d3ebfd69a11859158551b3531c6122db9a75e764b03be9fffa16305cf251456d5776c34000000025ec58a37b0b837595e4ed957f5b6c134a1d1e4d1138b34f4be7d7f8789ea98179981bd282aeffd8dd677e8c6a3044f32aca02150d2952ae4c83ca9240ba179d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D3CEA641-62CD-11EF-8F8D-F6F033B50202} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80b368abdaf6da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430744037"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2160	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2160	iexplore.exe
2160	iexplore.exe
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2500	2160	iexplore.exe	30
PID 2160 wrote to memory of 2500	2160	iexplore.exe	30
PID 2160 wrote to memory of 2500	2160	iexplore.exe	30
PID 2160 wrote to memory of 2500	2160	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c08d7e1975688191d550bf993477e090_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2160 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f91701b2ff7043ae70b2501febebf79

SHA1
46096a6e841bf6d5f459f51ba9ecec53151a6a9c

SHA256
892c62f346966d3e7b4b7209b8d0736336aeb6587f703287dbf3141e0519c9e7

SHA512
d8cc0bcabedfeb11ea9659ad534689a8cebc25ca25dd7f20e679fd39adf05250c9155eabfc4735e67426e4e4a72429dc9b520b4e530d0e438c138e5322ad5ccf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0401b388de889fce6faacdda3d8d071

SHA1
fc6b5067abb8f3a81e83ac9d929506e3fb634f4b

SHA256
bb45bb88f935d6389b471157a3fd4d92632fb43040b18ae913c8a0cf7ae714d1

SHA512
9574e06e4ae21489aaf2eee5ade4e688f7e8429c4f1270238bde23dc0b2030ed6522e3f24e1cafe30caf9d22466b256cfb2b79cfc7b1ef372dd424824d0a2081

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
754a39a3cd524936b38dcb6c990f128f

SHA1
300e0b4811855e4daffea9aa01248349fa1d1b64

SHA256
4ea7ccb20cccb874a734e8478d9a06d158c343883b682621aee652e07f6a7777

SHA512
fbedf4ffe32dbd9fd9f7081a274caae699c559926afbd16cfc0153cae93cb914a1a5072be66c1ee4f5929467885b26e4a1b23be2101474d1b94fe80baf5d6419

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b1b4e388fdb316dfd98d920f86988ab

SHA1
63c12ab9beba913862fc945aa5fcc5bdcc71f07a

SHA256
2daef99a751aa3073cda2a41a963ca35299009dda93b78925b6a4e1a8af61f65

SHA512
07d024fd3974bcef7fb68c500eb364f88ef2c758b153b540f631a4c465ebfe4a1f41a566fb4f89e429b219a078568a7425a253dee524b98956221d5e5391344c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b45ea841f8995372b4d9079cd4f11959

SHA1
69007235fd3b0a32e62fecdeefa18ca41ed6f9cc

SHA256
7ec0f0c42dfc64ec29ed4d3dee1496e74568fd387a26771777f64023b9041495

SHA512
e5345e96dfcd45b2e17368be54f6c930653a0f23ac3022f0785b6e0c86a3503ef7ce0ec0c3bf298a200caabfb8486ebba6d013d636d772b567c73c9ffa1e7324

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9c614e11044df95bcb3c8cd451d709f

SHA1
61f7261d5aae6fc3c62ba6388c95219360739a7e

SHA256
66e492b023c9ec0d6925e546639c98aeb7468604ffdd4e35ad8c2a0b27b99673

SHA512
8f07c654d4cb745b95d2f95874530b144809845db802e811c3a3d65752d68387ba3c066829488e4cdf0cc330f51e772dbb79ca5e85430b0263a4607f8af4c856

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75b589ab658058daf4d3ef7eeff505e8

SHA1
94e36f9a41bee032df72e59e5a3b3f3ca4a3c6d0

SHA256
fc27825886fdd408bc88f0b358755ea7a8551e76d697e51af510fe146d9e4490

SHA512
9beeba34b1da05ef15a033635606182bd4a1edf8321b3fca656fba4db819519736e7431c298222d385ba70627372148dfcc52846129c2a465f14110847528011

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11de606898b5fa72f4bea360de6a60a1

SHA1
715a4721bb914cb9a032b9331fdf6190e3a2eab2

SHA256
8d2815b55a80d161467b05fd933cb272343fafe4378541c56b09b1c2356d451b

SHA512
7e76087a9e1cfc36d60faab50d5f6fc447cf859a49bf7d748cb15550f910d40c110eea2f624f87e28ac4d1a5dd90b2629302d24b4f884977fa81786c3338b510

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c87cf6242501a79b6ac23f176a5dd2c

SHA1
98194c7d576173253b799ef6fb4c989d65d9463c

SHA256
135cb672a67f630c8af8922b780fa3b1cf6cbfceba60d677110a1f027e589646

SHA512
365b450a1a5fb5c92f235290485708b4acb1080dfae83373d12188400eea62a56226239c49a51b519306c29a636147e499467a112238a42753017baad03ea441

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b422625116de7c71026fd5ec58707de4

SHA1
90619bf2f5c57b6bd3d23521d878df005bb76f21

SHA256
97c7cd746ecdcaf69c70c539f8f5c8ec942c9cfa97fd149e83801cbba68eb20f

SHA512
37dad1250798f421f8563a3c8e1f4fcfe9684fc891113d6e409977600e74ff12f928b140c62f7966b66ef4b0449b7c402d3952d63851f0181edd3b1cce323399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
234dfb229575663faefb630c0122ed5f

SHA1
d17e7c8d9f3529eea8533b3d7c84dea5dd45678f

SHA256
221f823d68c789e93e6ef89d8f24e93f9dcd3dc31df8d57ab59a413d458803fb

SHA512
5beeea40e371cdd838cdb23235a04e8612f14a42dc2863c0b13e3fbd86c4818e61494835a97816cc25d6f21168131ae9a6b20e62d63f547ec6e8bcb8de97fda4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43f5c81a93ee2202592bf2e3e1b46a8a

SHA1
de6ec19084f80aaff8c9b7abaf1d29aba7e77783

SHA256
d78206e89716ab686d39ca74ade67071eaee390c2369a9e99d7db28d23cae309

SHA512
389ee059ea2d3c619cb481f696cddcc8b3f1afcb8672d5b0c5666c0b5762c2a8f95a25a4dcf2eac634835fba6313e4e132c9e35ed575acd5368e7c337496136c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2ec9da5c8de45b536468ecd1bb6f86a

SHA1
5cf3432954accf626b81e16d1b706e17cb857334

SHA256
ba0acbc290a96958c28f08be38e3723b307944cf826e86e0c90f0ba14a06de51

SHA512
8aa1ce399ebf9b8aa2295a7873f966193623c2bbb1fb9ccafd0940da21189e4cd8403efae733782b369b6bdd487ebd20643319f2f73baca246b061c2d39fbcde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f3b4f2af71e7e8815f27d02e0bf89f2

SHA1
e3c69626c77071a703d55fbb27e847ecc5a77b10

SHA256
9e57cbfc8755ecf7660c5bb2fa9fdc118db9ce985267a7472fab0f19dae46562

SHA512
248d83fdd06cd62503b982b39662d94cec508ae3307b73018f63b7efb575a166dd495cb3f7101a03b97a3a92747659b56cbe77f077093a537934e1958883b022

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6E01.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6E02.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit