c967e6154853d1e76198ba0ecbfeb4fe86fd6b1e769e930ab181e39ce10c2d20

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
26/08/2024, 00:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c1de5d3835885b0d678507897e9b4cd5_JaffaCakes118.html
Size

68KB
MD5

c1de5d3835885b0d678507897e9b4cd5
SHA1

57d55e3ffee2b2729feb8939df5dd52ba54bb737
SHA256

c967e6154853d1e76198ba0ecbfeb4fe86fd6b1e769e930ab181e39ce10c2d20
SHA512

9bea47a80eaf716fae6f6751902481cb99a9f948e48ba5c9ff985254c792fffc87c1d8851a3a651304d13ed5acd79a66cb84ebc209f7fcdb31840ae8a3abc453
SSDEEP

768:JiIgcMiR3sI2PDDnX0g68zJr3JXmOBNBdBmOBAJroTyv1wCZkoTyMdtbBnfBgN86:J0p92H9kTcNen0tbrga94hcuNnQC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c92000000000200000000001066000000010000200000007649fe51e7b844699216cf107934d34425530747a8f8dd3b7c411b29b4dca44c000000000e8000000002000020000000c144d4d3edb6957eda7ac87a9a6da2cda7ff6bde2dfc48adedb435c84c634ad420000000faf62c8782ae04203efc250cade37e874c4de0fc597fd8a143db123d8ad122b240000000677f8f7c340888ab99d7d54cb948462da1db9ae3adfcd2c89a95475b204f8e38968cea5da2dffa1cc4dc932bf65036197c80ac39a078a6a6a52d6b5bca253391	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CF8EA141-633E-11EF-B8C9-666B6675A85F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e090dda54bf7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430792556"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000bc4e714ad5f877c1fe89665592c26077155090b20d68de140bf2be76176ca718000000000e800000000200002000000005a58e38a44e046aeaac50c5a9fea96b4df22a4fbe373d492c3a4b0615e0c52290000000da6b3f062c03d5b91f232a1e7b46331ccea12e2e952726eaf11dd8305cff801176f2c0f7e39746e12d581e3bae4a5d2e683cfd4ed637600ddb413e63b2270f5275cfbf0be58408b4865f34ca038344084cec9b76b9a3208dd8155683f15e854d059ee4ab8d625da0264e5b1f1101a2a8b10f37099535026dec864b2a21b93889f267cbbe6efe8eceb3be4b8603acca9b400000008dd145606b51f250aaf39e75e9b7f164b5889ec0e009f0d44125921b2395bc30d160fd5bb2aa6ed5915a5c0463c70607477d7ab6767bb65fb53dccf7c0396d44	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2116	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2116	iexplore.exe
2116	iexplore.exe
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 3060	2116	iexplore.exe	30
PID 2116 wrote to memory of 3060	2116	iexplore.exe	30
PID 2116 wrote to memory of 3060	2116	iexplore.exe	30
PID 2116 wrote to memory of 3060	2116	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c1de5d3835885b0d678507897e9b4cd5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2116 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b638fadfe5935132b987389349d89a2

SHA1
ab8ce1a9429fd9c5727d938e749a45375b25a3bf

SHA256
f18ebe0c02be7fadfddd144b387e9e363bc8709759a2375f0f9ab93e82af6ce0

SHA512
b790bc05160a5e93d36543f95b782f4b171860e3e8945cbed716ebfbd05a11bca4d8ad27f0d7a936c072a3e3ac37b93877f675d3fb671edac6055a9214d62985

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f8f74b4cac29d5dd24a7f2b2a3a82f7

SHA1
f8a6d526cbf4028d75b6f6f65b2ce65b0d200b7c

SHA256
2fddab24df65347fbf732881c689f862bbc9e589ada2260aa78b69c0d77b3ae9

SHA512
adb3cacd6d95dc61b6dad544efb3121f984e9f7847df951d0ae3a8452fe84ccb8ff89a5b4d77a54c7318c4429508a9e5c220962c5d2aaeb81de057eae0848777

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5584f3c2e45d5aafed675fa47c7fdda

SHA1
670f61d801099d39423d530ce577ee9f1c08e988

SHA256
95f8556654c7553dea2b458831055f4c513702262d13392bcb353a626ad27b95

SHA512
81180517d5d9fb5fcb4d549464548405a4e73805bceaff3c758798bd6c19973f41c2cfe59482fb43f813f31646d58e8dfc616b444db04baef1899ef8d08764e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0867e72a1559c9b1f6394baa21a7870d

SHA1
d100af063c542ab8f15debe78c6bbb2413e58f77

SHA256
3d259d43e0947600e498381a0aadf2c6ddfef46fe0f4902900e0c14e5c3904f4

SHA512
d55cf42726a4095fad5be116e409fdabf2ed50b85df3df8e82cca85e8ada43442142c18f02f060594388a7476c843972b556c490b2c142704b336e2863918211

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8dd5ee13eeeadb64193d550aeb9f3208

SHA1
ac7e42f5c864a86dc0cc463eb456318f97b9680a

SHA256
8017cb4563fa2a854ff7a8cb912b70e80d5c1948e9535b858f73a94d67e96c10

SHA512
0b42513b90deba13e523ea07b0eec2b7defd574a708f9d5e3e19957a6384c8a916545c478908b851ef0d2540cd1df65e2186fd102c7735bf093db9824b4324d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eaa733d4ae630ec1e139fa7e3b000eff

SHA1
6ae7a3761fca1e481c9a623348f8616e732e12dd

SHA256
1b4608025e57fdd49408d7496bf901b52c31922c5f2203be269712bafe1e26c7

SHA512
b6d89498dcd9cb8b38adb2e63472d57ac15f69d11f24e1d8fa07eac37804478e706f281e5acb1912c3e0e97a57948a77843e641d3842325ac7c468296a0302ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36834d1e76104e8fb90ea853fe40753f

SHA1
eaca63f661ec9654f4ceef698d80077305910fb9

SHA256
2d9881028b5898b4f66be9e048838ab1facc83fc463004e26139ee46dea880f0

SHA512
e77d0d0cd13fd52478eda8c327cccffad356573892fc96ff138535d128e58cb5fb3adfd7216fa2d6c1ca8b5181ef598680a76e941434bd7f5406be752bce370c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd7bffbe69d0773c6bb7f21cbab24f08

SHA1
5df72fbe3ee673c55bbb9b173a1536c40ea0327b

SHA256
a131915d6550f9c1d51221c1c994be54dc443aa6739b1f42d1486a461b0680d7

SHA512
a825b6bc5343072d9d199b613ddd98eec7a680947d755534c22bc284caa682c95f2a50070e4c6f6507f009b0d23950ae9cff583ba71ccb41580dfa7cbfb3d6e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5b6aa1e5cc22642068c0db3cf12237c

SHA1
faf0e84ec31d098b9ba02fa033517b1ffc470f3a

SHA256
0287b61147f524cc8aab0674c864dd3715b5b87bf0b0c16f0ae292e1dd5cfde1

SHA512
09b1a8d7c03c85137ab828055cc68ec3da0ec6ec9b0b637015ea21e133de71f855b8a881424d2a32e5698e64cc165ce22cc35e777f7a0bb09a1caa80809465be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
639516e996091750f61baeaf31e22780

SHA1
cec668372398799457b67cb676113fcf5d65d6e6

SHA256
7e26c291eeeeed9ef6677ec1d0cff914533413afed7705de76ddab10efe50bf0

SHA512
cd5f065e22bf05e5158fd218c2d6f4f27dc530be9bfa559cca5932f6cd0ae6d265b3b964669819ffe19f2fa354167eda4ec8be732710fe1030222c197be06b73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9e4eb829c11ec48fb70bdc608fc3d07

SHA1
7f242244687c75c310c623997504844abda3fb0e

SHA256
cf21ffdf0183f4f912873f89aec0e6e1e01b15bab37bb3f9dfdbd2bf3061a7a9

SHA512
380b01486c79dc9e0ea684ad54cc78ea6468de5d7d98a8974e7f6022beded823c10a0bc0a4b5ab34b773e9c7aad9aa23e78b9cbe3f8486c52619d8bca7d615fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6bf458633fad029a42e4c4fb914ee1c9

SHA1
9a136f9c21883eff9d2e03519d8d5bb223496f46

SHA256
f1257ee3db3608b4569dde00803f8c4162ad46d9aadd74d989799ef729be38ab

SHA512
cfe79cf5242e70ebad10b889d85a0dcd564e450976a4e6fa4599d609686d59a2baed688f30578297abf200298ba47360b69469a14a04d004698dee5fa11f8c46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9532c683dce39e61b63706fb29c9b03

SHA1
047765bba1b19b6bb69bbb5baded9dc2d717dd57

SHA256
c75b06a75984eea2432626955bcc80eb2f5b9b308cfbf524afebc68c41d52e26

SHA512
b2552c417fa525d69975f9fec8061f725f3b38ce0afde08390496e9d90db92f4bd504ac5659ff858a486aeaf858dc9c026590a81a432dc437d315405e3d47383

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5156bf167106eb2335ca15deb0dd701

SHA1
8cddca3b07c6cd536a063cd3b215026c1713ab97

SHA256
2b03d5c48204575ff6bd7fa50600430fcc8eebced49b110642acbc993f6416bf

SHA512
627715838e9f0f365817ae4e4bec83a8dc01b4ee8b608be80a6d925270f72584c280f3c6940761ceb8fefa17f40ecac94c341b126ce30ca4dd51b1f98309f2de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
057f4509c0292e7df5569d49f47734dc

SHA1
34caa33326dfcec2801421447e8513fbfd8ddc40

SHA256
6f5d7a2b737ceb4919a544b16348eda2ef48cb8b767e0aa9a06e926f7df4a42f

SHA512
370a88d9d7a56c2464cda0d198b07d2a12744c65610be375c9eaafb314fd5d9261db8cd5ec21a0c787dced4c0757dd0bd51d396e79c0723587d38d0d5bcba6f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b7b97d5e2003f1084d2ed9a62eef615

SHA1
b52d07fb44a3ba9a2045d6aad49e554c662b277d

SHA256
66b4dd140d1865682a6ede070b169ab2c6287113d73d5130ea3b855f2a448512

SHA512
3c1461483ac3a6fe6f6420bb874c8148d8f6504b2226ff064f605ca190179a5c8f8cef9409a867902d71fadfb2c14e23899cea181870f9f34652440730750728

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFA19.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFAAA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit