c84a41b3905dc6d070e07aa86f8954a14283de8f64a2d2a8713f23e52f21f068

Analysis

max time kernel
136s
max time network
129s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c15029a63302c482cb6ea4cf8d018a74_JaffaCakes118.html
Size

10KB
MD5

c15029a63302c482cb6ea4cf8d018a74
SHA1

43daeaa11d684d0c1df137d19e4f992de58cdc50
SHA256

c84a41b3905dc6d070e07aa86f8954a14283de8f64a2d2a8713f23e52f21f068
SHA512

a5d1aa8e604e19a90fd860438e6df58fea649c63b6610a323603baaf497d07e5462e318ac5bd6e0ae54e831c163c64558d3aff0d3e0a17dcce52e1587f43507f
SSDEEP

192:2VElIsr03+C+H8k/w1wvqVkZ++B+W+tn+7+u+U+n+jt013auBuLbdU8d:sElIcuL4/gYLBVcnY1DAyt03aguLZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430772267"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000007891ac48f1ef700bb79292d5d1ae4c759b32b41c7d28911a42145581faf5afa7000000000e8000000002000020000000f4762ad295849f654916d6f5ca8e4d338b25e4a79dffbf6302435955cd481a4120000000fe65f6f8a80c6e0fb75322851c68aa9eac7b1e267b2fd406baf541c24c154d3e40000000750ab15f21d33077d8c6d0f6883ec8339dc240fa9c7de03c8a1f01d3e1e4b1783118044b7c0ebff70973104cc99bdbfc75eca6ae50ad6c22e2f5f4c090e082d9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0c31da41cf7da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000c92dd3c5b794d39819acbc252f3a714ed5e23170f2ef101cb7a8f4a26dd36d0f000000000e8000000002000020000000f17fbe84a5e17ca1011567bb7eae40b7ebe3248b2314694c5b5ba79a099d6f7e900000009b7f69815f94ffa7e469890f8e378f1ec2beb74e9a74d6763888fcd6493298e49875cf1817ee56e292b28f8ad8e7c1a3071a1e237335ffac1e5305f5a44453ec0eef5ff27add8aa0090c33d4fb966d0bf8957fef6cbf555c104904bd40f9dd433213582ebbb9784dd9b135746524480388c8c8faf5b9fafd54d984086b44cff3e0781329238a0aba0838c47b859145f7400000003850fd826d40fbdda8cf7ae350ec67a415b9a567870a8bf746abcb6ddb9f3d019b375f65471c3e85c7eac264279ff3f16c5fb3a6c0bbaa887c783e8fe47b20e1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{90FE8FA1-630F-11EF-B39C-C278C12D1CB0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2296	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2296	iexplore.exe
2296	iexplore.exe
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2372	2296	iexplore.exe	29
PID 2296 wrote to memory of 2372	2296	iexplore.exe	29
PID 2296 wrote to memory of 2372	2296	iexplore.exe	29
PID 2296 wrote to memory of 2372	2296	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c15029a63302c482cb6ea4cf8d018a74_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2296 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f53b3c518eeb42ad08cb7ba5369ed0b7

SHA1
e1e2af3e23dc8a8fe75b9b475697a7581f8ee801

SHA256
f5b9e9caeae14635987c8bb19ac455f2d858f173107a00165a454d2623f1d65f

SHA512
a8be98693e2a98a8570bd2de6a5f7079e9b4e0921ff280bf92f4f569ea64954cd250b026b8e763717c0ca301842336ed38b1b7a73d3d8329c1ea1001ccab5fb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dabf47cd01d6e8625a21b04a15bf32d3

SHA1
7eff1e0b64ad0b62be3953e716eff680781abc07

SHA256
cad36ad9a9e27ea5bc2afa7c7d5ef143e430fa860f771c4a54b4e2e48b1c0e72

SHA512
0637005d80a57fb41a271de93e89dc085b92fba1ac6a22d458fe7f5b4a89090a43ac7e684ff4f0ebdd8b5738ad89c7546819b852762ed78eac6b0473b8ecb0a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb1fe71a59d3e7194e89bbbb82ce376c

SHA1
d4d3db4d87d8253fd968093a9fdd6caa6868a680

SHA256
8278abfd3cebcb3989c7011bf0389ff7445cc1bfe59c1846ed3fa1c65084f8df

SHA512
e0d17710d06e61db5d83692ae40272a85e3fa8e2abf0ca64d7c54f09eb863db6507b5d3b152f9d4f823154f2eb6dcd49c85ec26e8c70ba8dbe0973aad789146b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1f5b3bf1badf20b18e29048019299c4

SHA1
1f5a47593dc1a923351ace125de178a010e35725

SHA256
eda7c974cf3a187e06f42dfe079bc574671787c2da111e158551ec103ddb0173

SHA512
8b4c3287639248a782e6d3dd364a4781b8bed141d4db9bc5c8ab1dbd5350a2978463d512584c95c29596d6497bea3d51bf4bc5b18392bd73fa5128de7a36c0b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6234d2bca0c2e10ce0cdf4edd3d358d7

SHA1
380d3a579b5d169e4e4e6cd77f86a185d2ddcf30

SHA256
c147d2fc00d8ce6145239ffe6f3b8cc1b8072afa321413897af2d15ecd3eac26

SHA512
8d00821da0ce241bcb49749373db1233f33b614585cd74105c0f00d09c11045bd0c296102bfd4897cfc63cae72de6cb7b5f38d29db0626dffe6fd1719a71b164

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76974ce557171fb3895ee833b089840c

SHA1
f22b42fe73532a24c4df983c39b65850d45795c8

SHA256
bc1820373dfd5721c923e0b5f37a1e53a3cd5f01c63395d2d263f92c109028a5

SHA512
816528c99fc43c5c89a08374ed1eaf49e36458c98569fe0405b735bf68b48b966ac3ee55bde387b85a1f7327fc7ac6ab74abf4929ad0e552ddd3bfe2682097fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cfeea224dec947afba8fe8b339e96a2c

SHA1
fb01022430352518fc71a2ee6890a3bd233799d0

SHA256
45545be07ff7e926fbd34453c52d56f01ee9862e015a7c4ff9b2d4e841cf433b

SHA512
111ff7c3e61450cd16a3d438424a52942dd859215d0e9bfcf73b50a76426d4de3609202c2424c919a031558053b07406857d30b453af1b2095daf313fd7cd468

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3c99fab02083309710c36a7207d23a5

SHA1
ebda1eab3e7dfdce8c4d779a6fbcf6a2531bb2b9

SHA256
04063ca1a8ecd4364eea7abbe29692c34f1f7b640d7f2dc33247c456c5459d6c

SHA512
a17ca176057d4b4f22dca04d3308bab8a7962388aec550ea0c9ce3b9965d239809f91e3412e702dc1645af1ac84f31b6e43e3fd98db65658b00db321e8d3c0a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45898bae7003f3879aa331146a439358

SHA1
03c82938df2160db2fc236c24811f8c49a7ed8c5

SHA256
1dcfe628aeffc561a23f09714bce19d34344804a78baebd979db366fda0cb934

SHA512
c9ec9c72bbd5e06099bc1ba2d3e08656fdeb2b982663577bae076625b84fb6d1e6f242e85fd95b46232273dfc0e964172bb95b0d006af7d2c1cfaa99facc0191

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b03771a543f9479ba6b14d3fb149138c

SHA1
e109ddbc4ea08d5f64a9a3bbd2722b1f8b282623

SHA256
89bfd3ec3fbd8e34ce8c116f10e01b06fc63e3021a2966971c1c5ad66e34795b

SHA512
3c153d2e204d4cb79fa96f658659a409ab1bda5533ddb6a523cd332a4f55fc3e2e54c13eaafa3cc2a27e918342b085e5a5ff90413cadcb45c7d16d0feb1bd3bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab5dfa76c0435a60b1d7f1512db493d8

SHA1
19ff5e1cb384d997d693b8b8c80667418ae377d6

SHA256
57d3cc4916359d4a996dc77b6dc6ac264d7d352cecb08e6cb448e9858a2e2f11

SHA512
e85c0071a53b422006d7fb2a179d033eada9bf94398db180c5ce552eff60ef53ad9ec17bf7a7d806279de7fc640c4f05b04d8a662fad9b2f5e8b4af8b62edf68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea48e3c9417578f6aef0cc95783fc8ee

SHA1
e5ce9d7fcc248a4e20a6c18939c86a1edc64e7fc

SHA256
40ad8590a053325198803d47f22b763ec62b97d6f7979067f795b123dbe12ac7

SHA512
4cc8abd8dfdaa51f9d1e5dcf423ceaab2618f9272dc470c1d753c9f5c25b03db4901dd07854b36dc7703842c0b7312919920d92ae7835f65790aef0c62c9c75a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da33a463407159e1f545ad375b277859

SHA1
5a39390aa30122691ca3cc732f00cb1de9efcfd6

SHA256
83d546b62670ce11bf3e070141a937f6bee1490f84e0ebcc86bd182a2318c0b7

SHA512
2424eac44ff1276eed5fb8075eae2dcabb65cb167fe1fcde5079f4fabab87a8a7de7d0bba5f84bb3dc765f38bbbebd10155fdf9be37e54ddc65147849e4b4232

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
608bb6c697582472a73b68bb72be59ae

SHA1
87cf15dce9c11366c320cb368e0181ce02945e13

SHA256
0d407ebc7fb12f8c08ab9e6d61752124afa2be50d24db98d66f67f9c4513b6e6

SHA512
dc748a3db60e1d086b1436d6b7f9cc412780ccb165b7bbc83c2e9de549d209115147b48168876419f7662c0306d2eaf74caa0233cd9fa16e81b75a58bad3796b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
741bfdbbaca5046897e6cd6336b862a8

SHA1
6b7fe483a2575b4848dcf260a999cd420b2f0a13

SHA256
fb4fcb006c187395bf1a14479b80863e934f2ed9bd47f7e51e2e841526b24e48

SHA512
9c58c25b8389374469f8c48412dc667028f5d85b40cbd7466d309721e42f5a7d33c5624e3089739f9641dede71237fdb1c0dffbb66d8c7570bd04552bebfaa75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c305399ada9a89512b4f6150a186d473

SHA1
b51017afacf98cce162c11c1c0041cc7744cecf1

SHA256
b8986c42ffad2af28f41ccbdf2505b91e862090fae6e30ccb3cda0f0bb026a4f

SHA512
ea17c5090c9d4faf2751f6a2674f157ed78be5b4929f3f745ac464577bb5f957e845fb6bf67a2e1ce5f9500dafb40e0bea687e58bfe278a08586b857f50dcb3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEF60.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF03E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit