87f1c8a8befb096b39b559c52315043e3a30fa2ff3ca95ed0d37a1e3a1620a20

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1568ef968a6ba5404d4f4d07e741649_JaffaCakes118.html
Size

10KB
MD5

c1568ef968a6ba5404d4f4d07e741649
SHA1

f0d886bf89f0f666b3ff58a9bf41c99fcdb5fe8e
SHA256

87f1c8a8befb096b39b559c52315043e3a30fa2ff3ca95ed0d37a1e3a1620a20
SHA512

acf63e51e15fb1027d231bbd027950e97bbfb57f56f9ebab40ec7c490f1c2db667e7f8cd96c30ed8decc477158d30fc653bd77ff4197853caac46c298f2155f6
SSDEEP

96:uzVs+ux7Wx0LLY1k9o84d12ef7CSTU/GT/klkympH13x3TaclVHcEZ7ru7f:csz7Wx0AYS/+lP8JPHb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a094d3551ef7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7CE56141-6311-11EF-8BEB-4E219E925542} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000cf704c251425901a8573a3cabcc892e73ae20c2ac7f9808fb21e0044e02bcf81000000000e8000000002000020000000ac4c31e7237f3695a5365126dcb446746599150f58b6001608cb27fe32f761db2000000046555b88a6b271ee77fd7bbcc6749eba9f8f6f0a76ce832075105e0227a7c6a540000000317e22cf74f26b4c15ec72318d61bf93b7668f0750372049c090c5f02b5a6f07c774ad03aad5ada298f66347de4c1e3d9722630a13767f79351cf690168b37fa	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000008f274a1861e98c4c8fa43cf4328dffb6694caa1b9a09081e191c167b033dbbfd000000000e8000000002000020000000b5aeca3abcaed2b455cff8e102822c8b188d5e8031e0fe0237148ef9cad993df90000000efac93a809837ad101b8f8ad5cc125aaa05c928170132d7417b064f3fcb34f8634c0cb1b319d8039615f21e271edc347573c264ad8bd55efc56bab33bf5153ed9d5599776a3b5eeef6803c4178194f082237c0c702e5a3e7a2f94e67ca21e062521e9a3bfadc1adcb8285fad3808f91d1e8226bcfa570122c1e6ad44447ff1b146d017f71b5593f06a739e8364112c8f40000000abf1de7462af1600be4c257203cca221fa4de464a4ab2097d1a7466f2cfb4fe9b91fdc06b67a990b0bd76d5c7e697f4b437a32712f28ebdf7ff9a50f3ca26813	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430773090"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2232	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2232	iexplore.exe
2232	iexplore.exe
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2404	2232	iexplore.exe	30
PID 2232 wrote to memory of 2404	2232	iexplore.exe	30
PID 2232 wrote to memory of 2404	2232	iexplore.exe	30
PID 2232 wrote to memory of 2404	2232	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c1568ef968a6ba5404d4f4d07e741649_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03a93027d0f05863a23c86a53c82c984

SHA1
6ed4694513fd59f5f289ba15ec74211c45f5a41c

SHA256
1394707a6b72c468cdfc8549f856c95208db605f68bb4ee0c6568b3377f7edcf

SHA512
56fce9fb00b2b22393c446715732d74a6a42d5159948ab4bbd06237e34ebc211570b747748a41d3ee050506aefa784a5810e0deca2183f4c38ca175be9b1b904

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aed34e88a737ca8d787a6f570e61f704

SHA1
42159bec12834c40006df33c2c87c5b99e57ad4f

SHA256
7071a98dab951d52529f9cbfa9b31c2f69f14d594f369a1b1a979a64d7f239dd

SHA512
6e8e37dcdedd7d137c0def2eeefcae6d8575198d6fcdca4d64af1cb0e3cb446c83a33e0cf1301b35d05d10d30493eeb0deb4dea394cbf650d4ba737b1c833f7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69745ab91fd83782f7c16ff4de65a997

SHA1
0b1a25e45a6dbea0ac22c7dbda7f773585ccd2c8

SHA256
4bbc781de9654343fe874e36543d190c4ce7cbaabc8e0e012b7402f91a6d6114

SHA512
22b05dec48891423628f11b44dd0c3d5d9bd9c32bb6ac16e5f2bc37ff13d66c4516f7f2c621d02eb88aa90e43fc93f7e6a98d6a2a417d7ec52e43f4a6aada052

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8240b1210d56e87206e83e8c0353b92

SHA1
54cf6eb95cb9d311ea4725c736f1c7a2cf71700a

SHA256
f44b94fc04329ea12b2bbcec60c261739babcda40148e04609af171b2502eb75

SHA512
54c086a720381d2c7e5c074372ea2a5f91f65d089b5595518260ef01c1a0f2cae28a4cac768811b064b6c83910a57c225de753906f7f1a0fbfb4a569e4a9bc70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3cbd2f83d0d9c5390bc494a6ee71eabd

SHA1
752e57143635a81004b4872cd59be96322de52c3

SHA256
586f4a58132317080a5d2b9277bc52e97894ccbc97676327a1bc99c69cf03bf0

SHA512
4d314c2631c6058de24227719a4398b07ba1414443b2cbf4d4c44f6f1fd6ef96617226df488abbf6754da5a0396ae0d5cb95f01521eab9fa5a42094ab3d9a1d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c963a334e201ce03828e122918e53013

SHA1
8b18a0123e320152aa03cf7fa068c222afe7a463

SHA256
7bfb468af60f898e0c08d272f1043615f354e2d2d79d8bea9bd0e15320692c46

SHA512
480a361be2d4af825ab1acd2d135ae89c54e61da5d4a7bcf21ccddb0be4f21643a10c44645cdd4cdf50f4d4538d7ec499a8087f635197b141ee47b5490e4c361

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
949a89a2f0e1b57145c1bbb352b97086

SHA1
9818a7773129874d0f9d4082ef974b76a336d241

SHA256
238ed8ae6a04842d220d9d5932a6d16cff41e40dd72027042c431129dc4e2113

SHA512
92dfb7948323877838949d0d1acadff34616bdea2c0eee9a6ee2be08b7e1341c289db0fef95be90077ff102113bfc1bd1375c17c8dd36cbdaf3de98075d233b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3588699d95d28c384e7cd3cfcf1c2790

SHA1
c996216123d871ac9454851a70c693033b32b7d7

SHA256
9ad108f4b611036841edc0b20f32a189de2132efd7bedbbe63f34b897b617275

SHA512
516a69a230b1b6cbd55378509c347702e0c3df3a6a7d38ed25d244da0dfb51f21b3360dfd67c4a9778503f58b80ad444391f6b308a1c68f6af0cf97c91356161

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9fc08677a6091282bd87bc75229ba82

SHA1
097aabc81227a6d0c71c5c01cdedff61e6cafe93

SHA256
d3f1dd732043f8aa20b624e2389e0fd75dfc8d59c0eb79650ad3a9a6b9391b87

SHA512
5982e9c0ef35be3cdeb479d5affb1b68152c3a001281d491b975d844e8b656f9bc1cb55e379593a66f05f273ad7b9d420fe134f7d243c68a3c5556447f2db732

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61bf27a97be73268e5ea0c3f98035ee0

SHA1
25dadadf81f5581cf769f1ae10a8cddbe271ae89

SHA256
36a7921ddc63f92b0c5aeff4d924716fd39709f93153c69e001d75db087f2e78

SHA512
35e9ebca0185d42867b6feec304714268e0bc80110ddb9f885c85534bf923460172716ba1535323aa7bf8da9373a2d6f1dc5ac129de8f22931318ed981db6eb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d86f10fccaeeaa00a9aea59d48bbb2c2

SHA1
328750cb1b3382fbf0bb77bbe857cb4fcbd7996f

SHA256
03f8a90df2154ada4b85840e67150b9335cc6c2facd4a29d53eb79b5f83e3dd8

SHA512
da3fddb7904c0d45fd91f839e2f9d189fe5319d3f01b6c95638e9144d46f7590b8a5ee5d38523e18a2c05f69fa64ca791bbb915e82c28bc33523b19d98397b93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3cbd11b57d1ce53c44d3990dfca27479

SHA1
2ca8edf685496932599cbf2f8e6573ba3091644e

SHA256
acf580ef89cfc8dd5cef001b3ff25ec663907b7e5b6e1707f246e453848c41af

SHA512
217274ae84e92a7368de003baea41cf3253e6b39bb344f1e50a5001e84bc8029ef291c3f23542160357ac271aa1c6ddded26bd27ec0c537ba83d33a740d5db60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72718581e2a4e6ea13c759663a431305

SHA1
d0b1e1069f652b0cc9cf0cd38057eeb64657cf55

SHA256
dadc0c10559c91109e4cc830dcee8af215a427a3bf92fa6a265ac1d2b234e048

SHA512
b2b423b6db51e3b2bd10d67bb7d0f79f29f18aaefff6d8ec3035b8c274950ca1b97c889ea04d48861e9b7f1988c0384a011c512796c16287181c5f58f0b93351

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc1af9f92de853e78ac6dc79de9e583e

SHA1
5e0c70e292da1805679deaa1bba5512dc846a61f

SHA256
4a3261b76549197c1b9f2451f41c94597ef7fba9ab733c6b248fc5ba09af416d

SHA512
2f5646d2281b0dcab376c7e44ee5ecb60674a0293377033e249cc4546d44ccc2864edee65cc6e7c17d5570cc04268961e6523423df46f02ee9fc072aba1ff61f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f2f28ed4d0a0ffdb0c18f2f9e4b9a2f

SHA1
9e722cbc4b97581d795298ec05663872044ce169

SHA256
70d7274ae95826885f3a22243753793e7b328d89cce9093e5db1d1fc30281feb

SHA512
ea55c2b51e837354876e10c559f309a602037d0cd2eff3fe9c1c6bc4e14f9d5a87098efceb07221af57421aeb54cac27766c5e3429bcd0018448e4adcfcdd30b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFB70.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFBE2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit