22a93a971eca7c986d76b5904f752310d9115b5d3c5380a08df2984b9ac47fbb

Analysis

max time kernel
134s
max time network
127s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25-08-2024 20:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1863288496508eae1ce102067f5ece6_JaffaCakes118.html
Size

461KB
MD5

c1863288496508eae1ce102067f5ece6
SHA1

7c1c8c23da4da80654ce7f97486e33fe45cd00ff
SHA256

22a93a971eca7c986d76b5904f752310d9115b5d3c5380a08df2984b9ac47fbb
SHA512

a0b0a45574e738e61943f436774f7963c70891a2135c00f0eba1e42e606dee14d646bbc5851647c3249b3c3379d565091600539398d1f8049bb2c3e909ca37e7
SSDEEP

6144:SSsMYod+X3oI+YosMYod+X3oI+YDsMYod+X3oI+YLsMYod+X3oI+YQ:75d+X3k5d+X315d+X315d+X3+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{66E9E591-6321-11EF-A6D9-6ED7993C8D5B} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000007ab8eaa8dc935ab0db78be28adf4dda04ecc0c328a53be9cf6f3cc5069f386dc000000000e8000000002000020000000e80cfb2e1702b6e9e761fb27e07e98a7b82efd04d0727fa452377105163b9cc72000000027a465913f2fbd968baaec18693bb1cf0e2e39233151eb23f087582dde6008474000000082a030d33cae628237be4bc9e545f8a39c9a9462f0eb6f0ed98b51b7791d7c74523cdf2c6448e81480c91faf4269e884868d629070415847a2201e2990ad3297	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 206e01412ef7da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000d8580f12821102e913abe07ff649ee98c59dd0b6d4f66981d0b9b8421cdcff7d000000000e80000000020000200000000aef78b30665d2924802f7e1daede5d9f98b8a387d877d9ec6733e5f771880fd9000000035ec20e23c55d0e683d2f9a3e53eeb2d73135ebe0fe4f8b055a03cf2bb5e3b7da8ac0d87f930f0955465c48e6138c752c43b0c358be8a78dd21e35d342a047f7747af058ad2d71cd039f9092f0b09009013bb050d0161107d6f5b21a1bbbc9292a50ce400a6069846d14a4a521b37a01b3d71552b549e250dc0e1b82283d7dfed5b09313c09dd1dd041845a6cd8397b2400000005721a3a4621d7ea7e83a16f473d5fba2d45fd3f6c6978dbec15e790aff81e3bc83124096cfb99ea13e1a535eb571735e3d2d17c8a8dce566d09793d1cefad5b2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430779926"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2076	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2076	iexplore.exe
2076	iexplore.exe
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE
2436	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2436	2076	iexplore.exe	30
PID 2076 wrote to memory of 2436	2076	iexplore.exe	30
PID 2076 wrote to memory of 2436	2076	iexplore.exe	30
PID 2076 wrote to memory of 2436	2076	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c1863288496508eae1ce102067f5ece6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2076 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ced49f6adfc3f018d0221262b579ecf

SHA1
1b57b714544de39eac9f4a72d289ed273d2b1b3f

SHA256
c2fe1d9988d4003dd63e1be0b92387d7dbf66a306ca1f70228df0e979cd96e8a

SHA512
e271fc3f28ec10404ebc0fabca0a47cc03680e117e87ef3d76786d44b3d8cc3664db87a10306e08bfc1ad325401f6ab050e54f32bbf5ee8e19479db8d70ac41e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ecb271983d913185b6c7371d68cec102

SHA1
e26a85b7d784edaeecb370a720a5978f15fe1784

SHA256
21514376dfaf019e201645994a5d38a65fc93f1551775f8e184a5ad110ea4cc2

SHA512
c0bc924a980070594bdf074a85441e461556632a72909f3ffa53b55b3e3a17e223115f80a9c2a41d9d6ee9892be2fc16d48966a53cfe958b0e1620453c1a0f35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b342171b16d3f4ce74659a803503c8db

SHA1
2c4d1ccdc214dc54107e01fa0443ce2a562d4437

SHA256
e1984c49e23cc3811cafbbd2a56a4149321399a21760863a5ffae2330dd2b93d

SHA512
4414da2b585af6227cbfe3110e6036c6b39dd88373bea6c1e864c15ab1f6b809daf7cfe6082eb0bcf7af4f49f8f389755138903a6a369eb2d18918a953196d9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e400bcb7f916cda21c0b125f2ecebafa

SHA1
d7e8671909f6c3c2fd269ad83e9f5616836a1ec8

SHA256
d477fbb4575ccfb6f1cb00ad033bddf4d4de94e45aba5ec0e87fbf11a175426a

SHA512
d78e69bfa7ac1aee206f5f30190fec25c22164b7564c5b4c082c30a1ffb1b73e4da16edf5aba4e6e370e4e1e8fc32ea4e7dd2094f9146dcc77b4aa0eac297058

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bdb60df068b272866e6d62341dcd9918

SHA1
5a4015bfee012fd1ed19dfec4a72290910496436

SHA256
6c7e8f99a18a420f95b7c0e3c92d3e1a8b0619f3f328014cba4618893df98509

SHA512
a865711b1eea65535ac3933d07b7a32fc6ee712b960fdb13dd0463424951a9f847327473b12c286eba9daae222090863fde9ff6ca826f94f9ee18b9312b57101

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc23766ef39184df373e6527971a20b2

SHA1
5e87c0eabd17c67914b545681c33c59d0b129677

SHA256
366c9516c1abe9bd4642042826d3f7a7a5f045499eacfe97449fefcc4761473f

SHA512
2eded05d92302e8299c990cb6d5bcae39b79c5cd72442a21cc4c877eb8f949bb101a3db1460d2bbeaad1b7ff04d2e6e4c025d8ec4127ddace24ecd5033c403e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
124bd594cdeb49acb2fda681df1593a1

SHA1
37ccbe7e44812d6246365cbc4a21079420bd580e

SHA256
2a2c300c86d2f28496edaf48ef948bcc2808373ffeb92395178b0ca2f0a1bbf7

SHA512
af97150b15bcc2fcdd1324b084c216d25dc8339aef4307fc63d6930d8f794fd7f11b9c199819ffb0bd6897b7bffcaabf0f5155f8993381fa513e46da2bd7bfbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a331ada1e709ab018acac624dbd554dd

SHA1
5a873e715b244767e8a8e269272f61ba0f465917

SHA256
cd599ca49dd139470125dbc2efcacf4433850cd983e89267dcf83710f9d8d44b

SHA512
8fc30247ef5c6b00fba079ff08761d8c045cc2c51f4388fdb77c77198b76f40162203d05bc1d0e8e5e192cd64caa9d164c8f4957a3479725b12f0dc034c74cb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
739149170784c5b4ca517be499ba42d3

SHA1
5e275acc3177c638e81d9463a1153520274d1a86

SHA256
835effd4aa1a700544af8f6d332e5cbc2496ccb7d1c7bc606614792a03401736

SHA512
acb6580333147dd1478e32c315d83cd2651f4dcba96647c54ce694c1134724e8ec581b673b12b15b8afb092f3bf849270ff8f8d0da7ad7dbd64a0c6933f0e49b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9be6f728c4e361d1fad7bd6c02193f4e

SHA1
85c016ef6abc0c449b83eacaa89c4eafb357d23a

SHA256
de7fdab30f5607404ebfea30e926fe67c12bf09d18f61185d7d06bacdf1bf4b6

SHA512
b98564a5545c8c7d5cc6c3dac30e282fdca245f3d1d4dada46ae12157637dc8e1c5afa00244c14fd10464a452ab80b0fd8fd5480102fb02e5ea4739550442bd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd5604aa28befd132103a1f4387285ef

SHA1
fe514b20dc7cd50af860e3e6e400a5ba42bc62f2

SHA256
be0a361c53f1f6be622135977c0926f1b8b01d12aad0ba394f207f369eb3044f

SHA512
c5201fad77a450503f92e573db45d5e0ee4ef51f9a7309672e41a69d7c6dddd436d84ca3148ad92b0fb39db96c48304a95ab1f9cc346b002d42daf388ddfde2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab763.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBE9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit