c923de4a996ea65ada7b2f56138e522599c702946f95919a2507bfd62547663c

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c10d4ea034442f9ebfbda43346b834ba_JaffaCakes118.html
Size

35KB
MD5

c10d4ea034442f9ebfbda43346b834ba
SHA1

4051a0a63ccb2f4d1a3cc8c5c558a9646d21d817
SHA256

c923de4a996ea65ada7b2f56138e522599c702946f95919a2507bfd62547663c
SHA512

8ed99bc180f1e85ca9adc1278876eee7d2b2de4feeded38b598685ac9655e616e2c71499aa1594dd8aef511e7f7a965060c1be67659f3e9f619483a91334f3d6
SSDEEP

768:1SC95VEWjI3CHShGLNOdDMeDNOp9NGn9eBNg:1SC95VEWjI3aShdKeEpIeBNg

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9067af0c05f7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{30E481E1-62F8-11EF-A4F3-F6314D1D8E10} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000009ddef6b3d648a4c85f1be60d589f93a51ee57a8396929a55b59642b9518cac56000000000e80000000020000200000005431c82207c005401953148c13ee978b2421936b81e8e71e4db6e105c78431cd90000000ed11c043d8148b0f3421d5453b545be53620fd5119d331f1503a8abe1376a138dc2fb694c8999b12032438990c52215fc4e17d3eb96bf2a8806bec746b96cf427a8d02daf2007327147270712b6d1b60769f2674f883f4131ed96d416fe58c422544f195e12ad92c537e0e3f6d7c9efba45d6c6f8c18200371a1b9709a77ce1408abf23605f33bcf1b0f597117ea92da400000006c0f5578bf1e645188565210fd89759364ce1f54ced5e3d8b7ba7fb329b54314df9bdb84af0e47042cc3fcdbbc3493a63927b3e6062f8ec51d5cbd834fccfeea	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000001610daeda25aa044c4dc63e3ca95cc301006b21194b3ef32b3ff9e29bf3e2951000000000e8000000002000020000000f4981f8b01b37f588923aceecebc0043d5daf286ac7a27c5ee0d0a2226d981f2200000001c00adc6fca78ea82c695f3c82425e40b80022076068444a1b21861e67f74aa1400000009cf54cd22a5ec23c3d67a0b0706f384635643035b3c31f3dde6885d17998d59dc5ffa436a56ba889f402632028f2c33c8a017b9ba04216487ab96aad79741eac	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430762236"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1872	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1872	iexplore.exe
1872	iexplore.exe
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 2136	1872	iexplore.exe	30
PID 1872 wrote to memory of 2136	1872	iexplore.exe	30
PID 1872 wrote to memory of 2136	1872	iexplore.exe	30
PID 1872 wrote to memory of 2136	1872	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c10d4ea034442f9ebfbda43346b834ba_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1872 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
bad1eae84a03f3db991dabcb6929395a

SHA1
a9560a3daf8408252da6d72fab13454c4b780674

SHA256
b069c47c49903936ec1b59ea7f9235536ff58a374cbf24b4980ccced3d7b743f

SHA512
e6f0b985333a0133c38eb9098ae5ffc7ba1de28fe3be5ad762bd38df336cf49d9b9a9329eac183a8c4441fe12e583060ee16e8a4a95c3e7cda94714d5493d39f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d707a7661176040994414314668109d0

SHA1
0a3dad8edbb3df7a66e11d19904c46a8b53865b1

SHA256
1ac1383a12e0d5701d4eb5f25f79d09f8b0ae509d8d6081e1ca85c0e7a068bab

SHA512
f59629e7fe70e9ebbeda027a39d559d142aa92d7b25bbbf4c7e650f4bbfe75249a56828a7323cf9d351601e035ba905781993423eb3022c76c84c424170a61dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d99bca8f08fd920cd123b1bf34c3bb2b

SHA1
c595c6e1c1247a63d772095fe1c38dbc63bb7531

SHA256
4c9189a5a106e3124b3b41c071cdfca6e5e734668f3f192ef16a1b33886239a4

SHA512
ba0ad7913c00a2aae398927dbe2a9e08901e32b796221cc1a38567fd7eb558547115cd981bbff0f0031d8d6cf05df5e192c476c639e2bcd03961964e389904eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
966b164e9ff38ea1ba19ce7281fb046f

SHA1
0b0f16aa110af288d6b52d631bf727d71fa47ee0

SHA256
39ab24512df24616f8ddea6f62ee2be0f9011931b61b18c541e65e8d86f00630

SHA512
464b018043d38be7469189f74e88051c6973436ff7b19ec70c57e4c8d4551cd0dcd448f5028688da0fb6e6fb8ac45a818a6d2cc24dfe225b139cfce2aeec49fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
558d0d4d881bf96ef963eed0cca108d7

SHA1
0c6e93889c09438a543be54309b4c695a1bf6e33

SHA256
37e09d9c3ca10c10c9844855839fcd7c2f5006bde3722ad3a76399057ac7eccb

SHA512
484e873cb88ab2059677806b8948e1028eebc97edeae4c45796c0f6f2248be2d2c53c160b659c1db6eeccce8e4c5324ef0ea26c6e26963de25c1e2032962b94f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26636b0b673c6d48c0d6ae0c703b63e1

SHA1
22cd2cb23bdd4df7f16f6577f9f5682c6e2ca19e

SHA256
ae18fa678ed3f4251c3359a07bfb3b8ff6e33ac7aabc49c074728b73626b0181

SHA512
bc268335eaf4a3088f47df1e886c2dfd1b52110ddd463a231fa814ddbd1c20589babc8cf8ab6bf984d20418a6908368e4598ea7b8e3b3e823e037f3adbb34226

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
8e9690f1ebcff560616de441e5c59f53

SHA1
b349271a2f8cc851a7f60d28b631d883e1e17d29

SHA256
50ef54a5c8dedc94a99b6a3f7061889d703596dc5cb3772ea7deb5afdc9096bc

SHA512
001d5b7676577e11b9f204b4e781a66142bdf0df7aa9b037381c1709d7164a376ce32e166698ce41e68293811e0578c25e67753be7e6b046241625989ad391da

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD9EC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFDA4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit