35e9d0644fef09b485918b8abc3c79dfa41aa487f49347cd4483273ed49af8a2

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0a11a8365fc2e7f6f11c78784f857a1_JaffaCakes118.html
Size

30KB
MD5

c0a11a8365fc2e7f6f11c78784f857a1
SHA1

c1766022c1c889c862d4ef56899d8755e6c8c45c
SHA256

35e9d0644fef09b485918b8abc3c79dfa41aa487f49347cd4483273ed49af8a2
SHA512

90ea175e1fde0a61ca8e2da670e09e9ae8dad1ba2c5fe7af0325427bef162bd5c864547abee4f85f6692921d0f99d834207d3936646d4721b72f4a80894ca3d0
SSDEEP

384:S12UHbchPX1NoNniece9mphrYn333marF0GWokyH2Zs/NpBpVobv1wrs6zb67FdG:S12UH0vKmaJMU2ZslQpwrslzP7G

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000008b1d357aa985e81f18c6ada1346a4c994ebe4ec5b62a76125ecbdfd7cf97c3a5000000000e8000000002000020000000366cb88bcd91417d407411e801f4a3e0d0f7a2e6cf28bf515cc8c435aa44e9d020000000f6355066dd6e2b08a0eb6eb2e81e1e1c2d9c9b9879c82959e0d4d57d4251120040000000b572a0d52dc0c678096ce5f540646efd8f729d8668a26a41566acf3de5570dedc584813e094896c1a5a1e9df171f5f06aeba19663a21f88d1303d95582f7f7e5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430746682"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c07056e7e0f6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FD845B51-62D3-11EF-A39A-6AF53BBB81F8} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000bf79cdfd130ff72a02e91920ed455673b2240da4936d08389f794aafa6d8f6b1000000000e8000000002000020000000264185264f520f7f96f5fb1eb8f31a3b835e7fad4dff2f8ccc5c9e35e443769b9000000087a1e9b093fdd51773f5318e5aa87673fb2dbb658ce19762dd20df9458100ba9f7a0df8d7d79b84b0df894613b2f21e56b8ec5e132a80910a746dcaf95948e023463912d5f3cc96e02fbf36287e2b385835a92e804cb38425756fb988e0a2c2aef85849d7c78cbdaf6b6a0be6bf94304dbef71e19df45b4297cf5fc4f8980ac784644843482dcabd0cf4022e018cec88400000000c7f8d33dc6f373a1f7f2bea51d176fb12ca7a1ec57b16d39a659584e287422866fc9a9ca0a23fdf68911530ae6054c40a2786827ab9acca2481b5b0162f07a2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
264	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
264	iexplore.exe
264	iexplore.exe
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 264 wrote to memory of 2148	264	iexplore.exe	30
PID 264 wrote to memory of 2148	264	iexplore.exe	30
PID 264 wrote to memory of 2148	264	iexplore.exe	30
PID 264 wrote to memory of 2148	264	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c0a11a8365fc2e7f6f11c78784f857a1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:264
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:264 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
85ae0d810931a6441a23a67753997199

SHA1
8ca469201a776ab6ea868015366c6e3910a7d386

SHA256
f45bb204daf6977d2d09d8293202aece5b1da85bd10029e09c00f172aff0dd87

SHA512
0b532a71987b54458076dfbf6190442320631aadb1c8d6b9069932d9efc698a6d67e18a3cda1fcb204946ae89d8ff2948ce49964adf613dd5e24bc2a86fdcb41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d24481a41c5ab7da4610589b7fc5aa4

SHA1
55cffa7d1cc150ccb3d8d8b2b881915d1792ee71

SHA256
43f30032ec650ece8ad72f4bfc67298f9bac4f39e533c09a5fced18e9fefdaa2

SHA512
90b904265bf0b2c119ca16eddc81c87c1c89a1deb2a22ee6177779d3bfea874b06be2c3693a17c982b2cfad708139043ed2ab30dcb2e7f9ae607960487aac28b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09c837a15d7d8c0496451ba2178e19f0

SHA1
0f79b8c9d2566bf3005d7612abbeae4ad8485617

SHA256
d00acdf21479107c228e0bc70a055ac450dcd0501ab41f4041e06976bebac934

SHA512
3979d1c30d06228c314040538ad33de666f94b1e5fea7c899241ff68af6ea866d9105e9dfe0bf39aae9676f0ef4e749bc9d6a98f9fd5ceeca1f8557ebefcdce8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3a77f651590ca474c7df560b2b28c06

SHA1
d5da0ce9a0f16101ccf545b16dfd04b6a0e7f078

SHA256
dd1596bc13e2f509a787712c51ecdbfd0a8d380f3fd40fdd80520d5ba012c9f9

SHA512
baf3f224223deee5c64989905cffc18a3867c49fe144000be3e093fa2363c92b7fed1548de23db587e68c3bdac588792469ec1371febb43ab1c29fb59f67853f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1d323f146c4390e8ca8897fe61c2d2c

SHA1
2c3a82cf7f1944a96ffa6db9dd08b1fac29805dd

SHA256
4c4f20a7f37d8a2fa4b1c4dad51a7d12123e8c832008594836964e626920c861

SHA512
ce4e25c75441048d9dc40fc3d1e71bff252d1941a1d045c85f3dc3c17de87f8488214083da183d4b993373eb114af98c500e154604242e24543fa0f6192e8da1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7edbbc36109ee03bd16f9b355fb89899

SHA1
5d5d2055282392cf39219afa0c42c2c55347c6ee

SHA256
f9998f2441de2876458077c8a82b56ee440d9ae4f37399bda9de2a164dbffd25

SHA512
dce3c7e9f23b17245ed3e43d7eed274ae1fe58be3f0d2de62b0cad0544c91a0cb186ae80f08bf2db547f720a3d84b17542632dd9b60eb3a05ad46715b2e8c7d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3690f2a89ad74d86b6633946d855ea27

SHA1
51f6ca8717efe8c51da0702d1603588ceb7229f0

SHA256
4331f67b5c6aedc8766eb6126c2231b333c34a50720d7ba491b53d1dbbc56bc7

SHA512
f2db6c7de560adebbea2867ecce780fc7693884a02fbaa4d2a7f71554b21ef07ca3a15564b7ed64631b641d9816f6dbc1923b0f71017a488da834e7a42e32fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0c4c1a80e653bab66ecb36f6dd9993a

SHA1
63109fca78689d816e2acf54f7f212ab556ee6b8

SHA256
b2e01ce8a50569053770816738e2eaf2d37b9a31d0a70a421a3bdf679d0b716e

SHA512
113d0c31dbea769d6d23150cfd40c76405bee3d002380e28c81cc625ee67d70ef1c4abbbbfefcf1ea95f9b954efa10055a614e4d35fed14bf74ee60c4b48e5f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f928b767afca0662649ba868c6ff1860

SHA1
f4b02d7ddb93141f050a122e8b5248217f3d09cb

SHA256
439b3863d1b29efff2ba28b94cba7b2eb01973c91aa80bae3dc988ca7e7ffda6

SHA512
c008aa5ab3a89f539551725b4dd92d475be8d0b043cd05c5eed3d15f3c9f716eec1943d749f886bd475a8999ad157c9175885865ee8bdcd30d420440bf92b66f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
049529bf702524ed423d8efc6118fe49

SHA1
6cfaa7607ef02c8a9867aaec5e50d9fbc4339b96

SHA256
1b8c6611f709b1c3b53430efbb99cb562a63b962fb082bbc22503b86bdb8805b

SHA512
5f6a928f09dcccc8d2260680024e26d2bec65f014d8073a51136f574fbd4b637a75cb125b48548513ddb62ca86878fb2e318ea57a5ffca091008ce92761a495f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a3ae0e880fcbbd419cf75ecde5c06b0

SHA1
f34b4c8ff6a4e962764425f137cc289a01dabaed

SHA256
13ed15a7758b31a135a8e37f7767f1f9e91e7d79d6749fb1055123bb78c1b21e

SHA512
a200d49b8f7fc05e3790d89d97bd51dc3e469cf214de4b6c560e092a52ded24ee2dc6d7e12022e8ca9741f7d1a4befe70c614654a1a8944789e6f926845f9893

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
ee60bc905cedce1ce69f666fc4d4fee6

SHA1
730ba09f45db102cb7f0d7e234bc0766d5a8b720

SHA256
54d9c81866539c2d233486350607330857b4a5e3d72cf47f5ada21e8c995f08f

SHA512
58849b82000b697a949af0090bc12ee0dbb12ca5f985cfd35b400e77eb56034cd8e7def0cb93fa18e1cfa0ff2ce465cff1906de50f25ef83a94c4da00606b92f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
8408b5f068fcb29421e1baee3073cec3

SHA1
c2d95b96bea9a0f6b20258282bcc3d077ff951d2

SHA256
97d410deef75a7fd47d80c7db8f3022a5b66c17a150a7ea3e6be5e8d237c3b34

SHA512
bbcea3cfcc2fdfe9f6e20faa853992d40bebcb76cc8d3a9f92230e4f9221420c95d405efa111a348d2046a3b900f7c5e997b06be70c0c935b432f00144469c79

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5312.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5313.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit