b436c0d293c29425afe877fef145577fb9966c8a317594cbe3cbafee95fe4ec2

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
26-08-2024 00:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1ed7fc8cd1438cc8852ea908390bbc5_JaffaCakes118.html
Size

36KB
MD5

c1ed7fc8cd1438cc8852ea908390bbc5
SHA1

21c34bc9c747ecce98d04e16b845c9ef1fdd6f6e
SHA256

b436c0d293c29425afe877fef145577fb9966c8a317594cbe3cbafee95fe4ec2
SHA512

43a0a923145454f1eb8d03dc5863c4b8487762025ce5ce4da2d47ca1546ee8286df3750e390520b3d0465c3b94fb6222fdc4a6c23a346a338e62946cceea2845
SSDEEP

768:zwx/MDTH+g88hARKZPXVE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6ThZOg6f9U56lLRU:Q/nbJxNVNufSM/P81K

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430794578"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000000e64bd47639541781cb31e19b066bcaf0235ded33c3dd2c449aea763228880d0000000000e8000000002000020000000e88fd5f9fb00a413d6f7cea2db0b881b961d9402fa76810128ceeb28a8bbe78c9000000017dc05132887db1f8cc2f4811fdeda9aef6d1b2af8b10984e16bb228427ea91a2d4371bd2de59572ead2f6b5fed7c40663ee1e4449e5a9c1672bc0fd1b969ba12bdb4cee249929e731a3969277b48a7477821aaec3ac7db1dff48cdc35517162cff7497fce61213b199317f919e5015f0b4943beaaee44e04ec49bfa6b45c154745b0fd716ddbd38698bdf2d010a62e1400000004123fe46470425afe9854e480d4c41ef28904a7d33d7e89cfbc09d2d0def7b68f55464f29b366f6af22495bd3552f1f861483e1561c2a4e7ade83c63abd8432e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000008bc3fb405e679ba0c1660657e99e94f0e760d955c983ead4b11817da29056582000000000e80000000020000200000007be5c798df441ee97236c5be3c9e46e2399f813222e98fc51fe999e7c9586d5720000000018ea13462bd4ebbbe8b50c5ff53e014712126751b245d5d1ebe88fb52cccaf940000000ddd35f6073a4fff28b6a02d9bdc476f3653af73c3fc091faed09c772625867583254b55a62e35b92a6fc36ba9973769a982a4b81dcd3d076b5cf17738b10cfbc	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00aa505e50f7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{84308651-6343-11EF-9628-7EC7239491A4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3028	iexplore.exe
3028	iexplore.exe
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2776	3028	iexplore.exe	30
PID 3028 wrote to memory of 2776	3028	iexplore.exe	30
PID 3028 wrote to memory of 2776	3028	iexplore.exe	30
PID 3028 wrote to memory of 2776	3028	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c1ed7fc8cd1438cc8852ea908390bbc5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50c932030e6c2804c83d845e1107bc23

SHA1
90d97b487c11a0c80403a804e07b595238f8d49a

SHA256
6c621fcbe997dbb421814aff35bf7054f4f7788baeabd183c800196a47e6a0ec

SHA512
e8145119806b94a1b8b714245d46b8ee7b96ed84f5232135792baea141983ee06c8de04fca0cfd3a0f9cae2d4e77374fc9aa63619b40d872004acf5e4c2d03bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58b54d5b8cba18bd3c179026a00f0039

SHA1
a004cbc59ecbbf0323910804f8fc81ac5140fb53

SHA256
dc205016299f4d1404fdd4322b817c993e9859896001a0274a0f09faf1c83f1c

SHA512
60ccc889bfc76b65bbe0ee13b83e410623081e664bf3363aae7608433427c1687cfb94bdd429730593f49dad8c58fea13f026d972827a84df0e4d49f96c77c74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98747ea1d4b1dcd742d5ddaeaa939489

SHA1
802f05485d2ca12ca6387cd6da003790be0252ed

SHA256
0e30c0ce106010a8afbfcd708e82853196d88702e718d2f119b051699bff8bb7

SHA512
7a1ccfb467848576117c5790274893c9c9def0d80e662a6cccfe381499eb3cc3d13b8fc3afe2cab4f299d6359092ae38a2f35daa7bb62efe1349ffda76766120

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bab0d79c90a1cc72403f77cfe909685

SHA1
6a98cf0d2fd923f5375a870c2e3f67519a1b3bde

SHA256
31b9c6f8f7bad25f486b4507e1b5bda5ff849c44c848a6f661b48d00d7e5ff7d

SHA512
8aba048b50345d765dbe7a4a2f46280ca7966fadca7b60887ccb290716365b094e08843f18690cba18dedce0c99611f68fce36ecf3d0ca1a3488cc487dc12c72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c4953954ebc78758b0c6d963e31c44e

SHA1
d0d783d59a778b8f87d1de9ce31c80c916622121

SHA256
00e4008e0bd5982f2949428995d84d2b426f49e2585a310c59c5ca5c4e35756a

SHA512
7ea7134e4ddfc7011779876c182b38cd141f61ea58723e9fd158171e6164631fa84c370b8df15bf686398612b2c5c60eb623dcd15bdef765b4bf9ed5824bd674

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e81efc1f05e199ef2bd8b88a19df476

SHA1
cb3593884a7f65623146f2c3c030d26286a91214

SHA256
fde7b7bfc812692f6fe1af8bd76f5944764d3477e5cf8c3a450572ebe0d0f8cc

SHA512
4a80872dc3c17e458bec620952edb9c82a95fb4873a32a128813a7dac318af376c71df7584635883c61d73db0cf6a59cd009a00731498e7f521cf9511f34399f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
533dde98ae79821c8bee0b867c18f444

SHA1
6175c7573879daa00a0b611cbe397d6bd4510e2b

SHA256
ba004005ac2d27ad1db6875898914bc7ef336a79c5bdadf28ae4fa8b2ccd2fc2

SHA512
d198548024f77e34d5da343f33c08ada10bfef43ba320bbdb4f10ef727fe20b82a595edcf400a09aee9cf56958fcece73e36e32bda146f0734c79c0f6c0d2a61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d5b773d386a79b96128091de9f75a9f

SHA1
c95afa24b3b12f856b277a9e09b6dea0cd45c057

SHA256
7d861db91207e455e5d0297c2ca759bcd70f8a959d2fc7b7e877e59e62e8f878

SHA512
3ebb830a16fef022c4c383ce4110b66919f3e95cde7920de9d9af975025935a7b0dbb55baf6c4b25324a8d834eae34290eb454108a549271234cdad09903a23f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b94fa7a00dde7597a6b66c30dcdeb9e1

SHA1
8b07d211dbed920de125f462a76242db1643d220

SHA256
7bda0260ff18f8c9dd32057cb52c25e7ec863f76d6d97fe8582b047d94046001

SHA512
36184e8b8bdc97d91d982d67b96b41425bc95bb05ad58f44624c7a83f2fd4f66724a499162657ccb3101442eabbf6259bda6e61e5851f4979db1bee207aed5e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27c72a3361807a49894a58b256b59d1e

SHA1
9dddf2a24a3528e6ac577a75ee3ad709a7afc6d4

SHA256
c9e7aa720538eac706cd4a046125fdad3b39c619f0c0550023813ea6fff13b99

SHA512
fd3a80c0ad588ac51e881cab300d77f0a85a721e451de1be7b7c358c349a785d1ce6023de92e057607e3fdaae333776c4239d87a4bcd3ff20ba488313972e0e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8291ed342d324f233255e769d92da6d7

SHA1
c7e8b31881b700c3e932e6a85abb841ee4f56ff0

SHA256
6263628c41a74558d4b74207bf18db8b01a25413627d4802337a345143bc4f91

SHA512
55f0ff5721cf6e98927cf2a3dc68967b390dc6fdcd903da16d8b06711f39140c8edf3fd5feabdd06f6bb48a06dfbdc958acbd53d32df9b3c176478d5e0b29927

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
661609cdcb61d7bf3d06cb5cc2053e80

SHA1
b4e9c6b114be787c51b4d7366560889c69fd9e00

SHA256
30b148c836dbaf89807cf801805d1f82683c6ebf68ce8434b89dceb12d80eb6e

SHA512
d73669a19eaa56e2a92267e19e569e9f51bf60598a1214d49645e60e39d9143ee5d599f982981c4597c7e41baa05d9c05e8de3e27ef07ce5baee6ad54cb35af1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab36FA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3B70.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit