dea62faaf40608119614af8c83fb2508a3a6e3906fcfae8e9dc0c66b411a2e1a

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 15:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c101e44bb7a0495c4d7531d482c103c9_JaffaCakes118.html
Size

1KB
MD5

c101e44bb7a0495c4d7531d482c103c9
SHA1

ab70973a3a34b8aa4eec587284ec6d30187f61af
SHA256

dea62faaf40608119614af8c83fb2508a3a6e3906fcfae8e9dc0c66b411a2e1a
SHA512

3ef8e2a634af814fe84f7041cc8f7937391b7169591556a654f5cdce8b53ba2066f7890367b87654da9a7f644e1da435b0ff5a9c02701a4176595d86254f1b8c

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8051b17a01f7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000009b0d6f44ce2dcbc84dcc0cda31f6554efa87a15f0cc0c1e51d4ba21779bc6f40000000000e8000000002000020000000a295de60878ad9128f77fd823233de2144473d0a9ca6c8389dd0df617d0c2fa390000000e2d7625da5ebc1eeb1dbeeec75b82f80dcac65e28516542022aa79f7930437dfcb024d781c584e5ada4c681f6d85d63f8cefb1108b5e3958dc3bc9d9fac3cc8dceb4023daacb4ff3932f011d106afecc5ac5414c8cd15d6aee6836e3fbfb126512b4f6e452e0be00ceabca9a08be412309d8bb05ccb7ffc242dacf66dd27ce2d44242e57f9e4c635bc843bbd575651e440000000e3ffb3b97941b5c6f84230d83fa651c893bcd5fbb4f3919a1f8877e5af3d4257630e4766b33768d0d0c666f4a7335ceaa506fce2cf91c3b842c9a98e3ef3a770	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430760692"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9E846611-62F4-11EF-8FFC-DA9ECB958399} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000000ba9d39b7e8d1d232d217bf6bc3d1af6eead060489b38325cab8bfc3a269c1f3000000000e80000000020000200000009cf69b4024dae3186cf53369dcbd5d4af7f2b8d3b0e9d38e1d8e424784d0f63220000000648e50f1ec8dfc40efa30a27d6102db28fe55ef927ab1f12dc6d884b0d07bfb64000000034b765d49c54bdb518b737907f81ca928fc1738725fd2b57240b3e963e712dcc8e32ee6af64c2a4308432c168a55427b505a3a11334fc503c28e062b32757337	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2372	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2372	iexplore.exe
2372	iexplore.exe
1052	IEXPLORE.EXE
1052	IEXPLORE.EXE
1052	IEXPLORE.EXE
1052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 1052	2372	iexplore.exe	30
PID 2372 wrote to memory of 1052	2372	iexplore.exe	30
PID 2372 wrote to memory of 1052	2372	iexplore.exe	30
PID 2372 wrote to memory of 1052	2372	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c101e44bb7a0495c4d7531d482c103c9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2372 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
0af69e428479b9d8ce6aca118c48c2f7

SHA1
bea41ef9208cf536dd0be8ddecf7f8a8cab075ef

SHA256
4777bdee741274ca6ae37c236ad3835ff3eb5aa65ae9905ff8c2721b186e9048

SHA512
11060f79757c2518add76c6d3eb4034484e16befa0c5813c46497e69fd30d8299081cbcadbb646661c529bcf4f51be346736cb235552ed02c4dc303130b64a20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b3d5dcd965ade8ad3a9740247b2ff47

SHA1
ee046e7f618325f0b9ac140115e8eb7e0b84be75

SHA256
d45b0198aad92454553a3d433f470e5f452b62d56cb5ce109fb6d52a5ce90303

SHA512
b0d8975ddd22fc1172523721341d057824f98c4b165529e23dc9a36f249c25e2bd14e0981d31101897284ed5e220e85e87301087e148de54eea3b87c5102c183

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a662619f384a88bdeb6514330252d188

SHA1
d6dcc0a98b688e9fbb3a9b2134d7afaff1d94240

SHA256
b7750cd8ceaa922617f464f9f2e9b749999feb8a67b5a275a32292b55bfbe46f

SHA512
7a8a0862161536f3bca1d04be67e052c826d84f35f8c14928b85edb223606033b943cc2b6ddba028c8bd167378abddfd25309bc67da6fccf7f874d4ba144e16b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a62fd4b6e694306f1626516f75431423

SHA1
301e0905f012a8701cb714ed0222f1d1f4c80bc5

SHA256
61a60a7f3fe33d8360d937c533653ca6fb1dc59c7a7bddcd187367475f9f4242

SHA512
6c8a3934f828ee248b7d0f902eb0e065ee70f3386ad19368293b143cb17d0a3dc78589b0c0d9412afbe2aff300cc79220114a1a2bec55a7581fc4ceaab4b662e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca266ef7abab45bd63d9abaedde1879e

SHA1
fe7cc56f5ed11a735d01cd1d1d9c574a27600464

SHA256
0d1f29331e1b36b568f365e08d425398075701c1f87e64bb9f82af1bedb4d599

SHA512
18ac56a54e840a2f6b7c36e9f2f6238b6df0ca792a00148800e1adf6bfd4f16522a0d24a8f4d0f78882097452eeeb97aa7617619cab589af5dbe7374f971c62d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef60d228319d4497614481149bf1ec4b

SHA1
13d5d2603ca2d638338617b040915272584d1e7a

SHA256
dfbd4fbba5a332db78db1f49fd66e44610711d542c0e0fc3adc679b4a6431fb0

SHA512
f0a596dbfa65592f9a1be0f2bb4f71c1fdab3e7acf4ee0d88d02ae5006aaeb5821e8aa37ee86f808c846eff597f471161053e0465e73169aada8b6c4c4548460

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ada4cd24da5d2d1c3f6ecb42f91b1cc

SHA1
a7fbb25dc67cf683cdcf9f82957bc951db57dbe4

SHA256
0271996c3f94e3980e3d4114557db5c4b399e4a32b025955159bd01ee3570210

SHA512
7f84f94bb16db8fd14f1c9f76c81656388c7fb497953b889cce702bb69e0db369f4a0434b535b0bb613fd431d452c8c6e27908180991325f647badb73df9c411

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89135f6c93b93f320a9b425ddda0d6fe

SHA1
7181dc4c85f9a05c3a0f734cf6a2b128e66075bc

SHA256
247ab871686b3ed26f224ceeb09e26c1b03a34747537d26902872dbf3588f1b5

SHA512
04d72a4a211a007019bacee25728a08d64a30c2c65ca8cc674b7a7fca80c44e7ef69a4811c62a898a6617cb260315dc3a2d0beb190e913e93d72cfd75d8efc10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00e6046438e8baba6cc4c04b9012fbbb

SHA1
a714652222cf48b26dd2424fc4b8cb0b93c04f04

SHA256
da9dc51db92f52fdd35ada860271773d505cf7a2f3fc6adb54607b749654bce8

SHA512
4c2165c0f1002d0c17e50569c5a7fb71027dacb8994c9945b96ada167b63a1460562921f289cc676b4c90e3e7dacffae8aca289fb6a27ffcd0a9b0dde9cb5819

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37468c98e3f6d265bfb93661b6a92629

SHA1
364b10890b3ef35e84bfe5b1b1f5f2badae4a927

SHA256
6e49ffd7931bb7ec4edf6be948631c8f56eb98101d94405edfd75ad703b04c19

SHA512
34dd0ecaf74b7fe18b5ee0a483e020b038d7532dc266ebf1a3c3821968a71fcef29e60bde11165841fb5cb21b661da768851a7ef38cdf10cc94d86457f70326b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9d2390d70a9ebc6e18cdf2175e1590b

SHA1
811753a0779225aaafd015f04a960109b9d5d519

SHA256
efd0438ce95ca5e77cc7c47d73860f443780f90281e260dbdc24b1fc2f2a625e

SHA512
da985dd0bfe69cb4ff3e0c4a56d74ee454ca8fd54cf835fde42e50531d551cf0be681b4c9ff210dd44337611007bdbf3a2176be144f8f04e6ce423b7a4d6db13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f05f70708815bbe3b830f1b8f49116f1

SHA1
b492fda4bbfb80b605324abf6f86bf035276ce90

SHA256
ec2d7b5507e3125545cda4224a4aaba54b7b8fe89d3d7b19ffdbb97249a5f089

SHA512
ccf29a66ba1087cf6112f6629a2e615cdf1c437d4f1e6b2abf95a02e4cc9e4c6dd959ee1616fad3f9b5e3c46c49d43429ebbb7e6c9b491eca77d51928554584c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fda428195c07b534d719571c917693d4

SHA1
8805f8eff2684424f8153038117739fee16a3e51

SHA256
cdd8a34f7e82f9e26ad84ec15ba722bcbb7a7f9d80c22983bf89fafbcc868465

SHA512
bbe784fa7299c7b8db0edeacd79ac92ec0fdefc31f38a24a9aa66f9212c029928b9da00d56c8c32f1e085fce092fc6dfd9a60d2d28d1aacf4ee31209a225d435

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
e384d43b1ecbb5e63a6188372a88f735

SHA1
5d37dcfd0c58d1922b2bec1bef7bd436d7eadd96

SHA256
f6ff4c466d8daebf7057a6e233697a49853e0c1599c453677a1186f41654ca11

SHA512
5590d526406f65b805c473694a50ffb2c49e1958470ff00921d875f4fa098f2e4324b85ea3e9e65e7f5cf76f688e95e55e343475d44aba632d5c5ad86b5dd7ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF7D7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF970.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit