990dccec1eaea37f2917109408bb17e5b11e5c308d23b6128e5f571577635fb5

Analysis

max time kernel
119s
max time network
140s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c0c1596a5d25a7d3737a44393550df22_JaffaCakes118.html
Size

6KB
MD5

c0c1596a5d25a7d3737a44393550df22
SHA1

ec466448cd46aec650a0a7eb31c0e2efbc86aeeb
SHA256

990dccec1eaea37f2917109408bb17e5b11e5c308d23b6128e5f571577635fb5
SHA512

e529905c81859df60a298e06913ed2d9560ebb10c8b490fdc0f24072b12fedbac667e966a41d8580d033a94ba51468e69f8c454180cf59bb62d7dcc0f17297d0
SSDEEP

96:uzVs+ux700fLLY1k9o84d12ef7CSTUBZcEZ7ru7f:csz700fAYS/8b76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000005c03dcd754d820891ddb87d9bd3e8a9e8b5f911f6d67d1d34306dac36e754cab000000000e8000000002000020000000596d7d803f25262ed548778ba6425c5beca36c3ef006ca94b8ed03b508b3e145200000005bdad82e79231453d10e23f8fd6d626811a0dcbef0d3244a0ae8a1681dc8ef12400000006b6ce23e020b4b87055114064ca359b16b5126b172396f5eabd8e8b995cfbc97fe51c588ea64b62bbc9a87ac613e56ec289263f5d70a387e5b802f05f97b9f79	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70422230ebf6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5B1D3021-62DE-11EF-916E-DECC44E0FF92} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000450a6ecb001365cbd0271a9a01be8df517da81a92a11ae089524964d65055c20000000000e8000000002000020000000fcec55e17f80f7404fd45c2ab3e981ec27f2034d9cd8c6a0116a63da896f4d8c90000000986062265ff3d230d0e2c1aa4d6302678750e453a32ce0eb7bded08a24e5c01da4ad9ef3486c1d80c3f2f00b55361109461f55a53e52955f7e48bb0e8302a9e096343366f0ea970797e65d4a9d60fac234522a7d2dd14c09d35fa8553d19922c7a0a241f8b5e7c48951b17cc4a4520fe892ac998bccb092201aa6a761b91c031e1dc06391a2927606b169bdf02d37cfe4000000066650de60991c952a76a16517a7a56fb0288f9898c9f2dbd3ccd150871838f33dc2057e03b8a41a127f4d3d1d22824195e296abe65abf2e41eef81bf63f74e5e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430751142"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2212	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2212	iexplore.exe
2212	iexplore.exe
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE
2844	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2844	2212	iexplore.exe	30
PID 2212 wrote to memory of 2844	2212	iexplore.exe	30
PID 2212 wrote to memory of 2844	2212	iexplore.exe	30
PID 2212 wrote to memory of 2844	2212	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c0c1596a5d25a7d3737a44393550df22_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
388d92b1aeea07a6cdef45b905d70592

SHA1
7ec8bbb7fb34038ed42dbc10c199209c52f9bc92

SHA256
b07f9e56c29fb89766b04d22ecc535bd301b085bc9ebed9b6ccf296ede836052

SHA512
9651160792c277a5a27462f1f81141e995f6b2eac883a4fe6fd900ec94dd53f8f72431f4867c83371dd86134fbef323791bc3c3679a542badb45a9b6f20b559d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f993460b74c129cb0ee4970c6d4f14f

SHA1
24b68d5916de6652d1448cd45ce4277a5d2f8a53

SHA256
8fcfc0aa1a45bda37c5add05f2ffd49b49137a08055af319acbee741dc6bb965

SHA512
1ee872656b83bfd2eecbd5851863e45134a0cd38125af34b06c3996ff9b440ced4f872219de433e3fed278056bde5d905c65892714b9793f6269cb87328ab122

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f553b34d6e6bd23657cc33bcff08de83

SHA1
678001f0dc9eeaa642416611c02f32379d3d93a2

SHA256
a3a429411155a2f7d3bd633230c9248bacb4e45472011394da1998f72651e07a

SHA512
2f1be4cfde7cdd66c0e0c1e2f35955f5e47d1efb512915dba09c44d56503f3b5fe618e8315f1f53be0a439b3c07be43044fb4b087e45ab48298e9057297c8352

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2ad039eb181ca4e53d60b346eeffebd

SHA1
f324eb618c15b78bd846ef7f23953cf6e35b4ff9

SHA256
611647f45a0fcbaac46926ede2ce20871b4e7cadfb2b593e02fa10abe999097b

SHA512
bf1085b07dfba9fc742f3107ecf8e8b47109bf2a51770d6d39e14541bf631a5d18fe4b32900a90b51e753bc8ac10d3eec3eeb2affe9d3b226cbe7743cc0bd9cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c02121b633dc8a3694b4cb0aa91b5d81

SHA1
7381086c46c62712ab6b98e8b317aeba89da66c1

SHA256
bbb9bad00097bda5663124a522e0ce443b27df1e2902bff7972a1b9741cb32e7

SHA512
4130ff96494c8cfb3398049966238284cb7e7e0d2d539caa12441be3a3c12563c11a3655527cd6a32abb287d930ff57787cf8e69ff3a47158ac733a1b4de942a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6dbedeff0053d37f97186ae92180fcd

SHA1
c251f45546408826e600610b329dc8ef45201c85

SHA256
d6f497f31a890a5a3851cd1e38ee4e1c3a3b9288b7a2e8c9ab05692f0fcdbca4

SHA512
3c0f8b5bd6ab72589fcfbd9322132132711b3ead5a5582316f59f1902899d4b75977c39c5fa905ad924eb99ccdda6705a2964686ff6d6ac042b6c306eb6ed013

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8b31d7226177bd459de9cf38e8c7708

SHA1
b8bc9c461c618f2bf529a8fe42f76791a4aa2358

SHA256
627deb80b848605c09dd0122a9d645367b4040f63f948e9e989a3305a58a039e

SHA512
6565df476902836191cadee26bf8e124152c1783d392fdfd1b15a1da957d8740173633872db1c1e1301cd916330917ff64d84017c78984cb6b05ec05baf895b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cbbda2ffe21c534ee13b42b72ad27178

SHA1
418fda572bedbb6bac36d419d6b1deef747e6257

SHA256
98cb0ec753cd8a8ade27af4dea8c1e6c7d689315f651b72219ef6113fa30d0b1

SHA512
fb975b0378c6f733ff8964cb501571d3adb54e5eaeeac4da1eb071964128d3b6437bd53ce1ff227881c83e663617e87e7d72ea88ef88c31565052ffdbe8bda44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
755c990b34166085127fb7ab8147a67c

SHA1
e2279ec70d04e4660d94dc782d0db3ea8b9b1a8f

SHA256
5a6f0d90db02f6314ddd21e78771d5e382fb2b68a3a5546be8802aeb3493ed24

SHA512
1d85d266571611e4a09b7a60a33db4387625227cfbebb157d806e4666be802bf446991769db922fc26b35c4734aac660bd1b1f423452fac19d3e05c3e0faa144

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6c5929358a39e3ebacddb7a6bdaf71e

SHA1
bb90dbb75a735878ce25e45f9bac017d74ea73b7

SHA256
a7c3bb0cb330d2159f943ed4cd6ac5c4a3c2cf4a61bf00cc224371792fd11ab1

SHA512
b8c801e2a5ac02dc85077bf1c80cd5efaf86df7c81491d0fda2a9c0b375c779b50e2a09a06970ba9f579774becc290e4b580065332848bbc36bac455e416e7bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cacb0141be4f1190026188b7a6adda8f

SHA1
f359e165cd4fc8182241fdea311cd5fffe42faad

SHA256
2a2002ffc8f3703aa0c6e83ea44c0d76e0bdce2aab72ab2e1c80373cc95d175a

SHA512
80b0793a78e51902d838f32a6fc9035e00805c487b28bbc82e510783489d86c079496b15727909e9bdd38fd81086cf1ac4c773bf7ca63ad4cacd03d41209b73a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab38CF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar397E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit