32390dc08dfc601f3e80325f6d156d07b728a48db99a2655c38091029f26085e

Analysis

max time kernel
134s
max time network
135s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26/08/2024, 01:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c20614f97cdc7b1ab37ec974e41a4ae4_JaffaCakes118.html
Size

3KB
MD5

c20614f97cdc7b1ab37ec974e41a4ae4
SHA1

e3779e5f58c8944ce61a6aa3a2d0d5959931adf5
SHA256

32390dc08dfc601f3e80325f6d156d07b728a48db99a2655c38091029f26085e
SHA512

8b80f0754a4a5292c53693f085e7e2abceb7cc98faaf3cdabf43fecc77d76a585f650329078b2438863fcc792e0056b2f996de2a2c5de34f4d9b66b68f9540de

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b076707858f7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430798067"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b700000000002000000000010660000000100002000000058384782165026faf633ea76ef9dc543c728820f73953b5a65db5d2f52e90286000000000e8000000002000020000000649c68ad2b73aa9a910d7853eaecdc7a6b26dbb05fb3efe011b1057e50b3212c90000000bc2df71dbba11da32d0f5eaed9df0149ce8be031cbd81a971aa8e9f0146b83c2ae4df3ca43cb7bdb2974c278081b3eead5152d2c3fc6d1c894a89141d18d342789d2d2318aa6e2ffa9b86f73a3e4486fa13895ec98d149482ca7096d1488af78ec8c74d3bc11ecc5310e226ce8a21103b2ef32ab02f3b7cbf6993b295caa9dd5143c69b22cb52b0eb2cf1ac969f5237f4000000062dcad2737f68aa724ae56ea02543d9dc506c8e9e5e5f345a720dde1102d13ab5763ff6bcbc371895c379324d0b0b7c92db4c1088d9f12dc773840bd9089668f	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A342CDC1-634B-11EF-A251-667598992E52} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000621abfe7fe5a9dc4476d55816c57293d554e9119e95422f942e85d3deed62dc8000000000e8000000002000020000000a4852d3fd52955a99d5b2b8856a0c20e622a63957da30e799d33979f40059b38200000005e852edc54aabdf0bc1057228a0d42a977d4b10f9b651cf191868c4f9feb5162400000004062cb9727844ffae3a6f325c64fe7b268720098c0fe2ea0bb6618f9bce4a7db95b39322c6b53f03d51a7f40e3cb72c9e2a2f79f6ff403cc953f77df86af0133	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1512	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1512	iexplore.exe
1512	iexplore.exe
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 2412	1512	iexplore.exe	30
PID 1512 wrote to memory of 2412	1512	iexplore.exe	30
PID 1512 wrote to memory of 2412	1512	iexplore.exe	30
PID 1512 wrote to memory of 2412	1512	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c20614f97cdc7b1ab37ec974e41a4ae4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1512 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f364488976024ad9da4bd005eff7d2e

SHA1
99142a24e157563607a99d7ddcf134c580499176

SHA256
acfa0996105cc47dd4ad09144097f88b8b1bb9080e3a2d242eaa5983f3cb50d1

SHA512
41884cc6389639ad0e6da2f4432707e2f79fe828cdd373dc4612070ce7589c637e0012bdfad2ec503059122d7197dbb0643c07372f9d808fdaa6fae54ab57bf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52239f18170d6a5a3d12f0ee045ae25a

SHA1
ad2a764e03106c78aa7276bc21173e162f714ae1

SHA256
1a6daa71dbb744aad03943a0ef552021cdb94da6031660f6cb526d68419a1502

SHA512
b8acbd587c8c5abcd5222c7e9c045556f42958a241aa591f5f831e2ef6c056fc8f139a0ba5734ad683cf27b6c869792b0edc132bc89228558c5f978f2b8a486b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cc131ca03076494bdbedbb137090d43

SHA1
88dc87502e093f176c2057995ecaa1e991606e0e

SHA256
63b4f123ddc99fba0bcce8152821f3a47ccbad42f9d6cd62926273c774af2777

SHA512
8443ff9d2701724b4f75644c979d81172a5e05347ce60d4834807ebd70d9a56228358c2abf4c7999ea769c5dfb442f5ab27c5a36ad4cb888481d3e1b978fecd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63eb1f39184af5f12f7f2aad50a41fa8

SHA1
4952216d9f4ba13d9d90e6b5e6426abc8008f1bf

SHA256
9a4aaa2a38308216b9e29a86b338985aea2b13e77f651879c99b8e185b049ffc

SHA512
06d36edd75569bfcb4b3c1c2ef9a0846cb023025452d10fac9f6f0f1a7781eb6b95db46d1c9ae655dd3c886f5125e5b81ffdcb53398c849b32821f1c95174151

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0347c55329df358ef3407b854e518463

SHA1
a4892448b01e9cc0de1c6670027ea0cba3192162

SHA256
57b6ba7e395fd9fe0bcfeb190dd333a6e0e0760dd3988b11785ba7b4dd0505a2

SHA512
3afdc75a02fcf0c25f83f00925a4b5f8e3c97ef9a8ef480ac6fd8b4132b5e7f824dbc41fd28bc0d9ce7d8cc9b48f9b534340287d4f526dbc11fa972a2f8d6a47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60b4b97786a6d15347134d27a2767482

SHA1
d31beb3a809bc0ef66ff4c45f9ba29929ab48142

SHA256
2f93c2c4b8690dbd512969c837a158c2007bc959523e8965b36f9b969d736ba3

SHA512
05e0508d8344ba28e884be3bee1cf948af686956b4d0551d8c84ae32414cb36e4ebe23ce7f62ebe920119983a63228cb06f22381063c81b3af2f3047a1a5e45f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c933b0e73cdff1a1c24cd31daa43daa5

SHA1
636a6813777f23fb27ca892338954cdb1fde6cd6

SHA256
1fb0ad209287ff600753a977b8fa3181de6db89d24f9ccf6003e7c0587117866

SHA512
866b38727ce08fb6bfbc5dccd5792868d21a57cb0ac8d259ff9e065872d3e14a7641bb69a8b57f702715fb37c2128999e5985e021d035c15ba0fb3185e642217

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d926f6ce4ce50ee02f5fa68bc7c71da3

SHA1
fc8497f58a414dd79a8c30f9b2c18c39d8e82d41

SHA256
cf25f7dad50253733f8a74e9b5a4bc4246d755eff57d58084e0499fa616e8e11

SHA512
b21e6224bc0c1eddd3c297d332459fe570667d99d62f25049c85c9755292f73b11656164541d4f7ebf12f751055ea222c072d55cf0159017be1f202598fc1484

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88c6c2fbc2ca937e1820f4c53743f514

SHA1
6147f0db29d1ad719fb7ce3244bdc224ea6831cb

SHA256
0ef7b7cf8f4a1274ddceac294d039db609e529821d3b48773fb17ac9b0b63363

SHA512
d0b4375da7277fdd52685cebdde796d8700ccda8e027bced99fca9de3d8c9fe9e2c4d583035924e9309facad624785b7f648883903ca76e79ed03ecf67b748c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e59d43ef9517c93ccf9e0bc01a1d4358

SHA1
a81e4f9d7270b48f0aeccc9e5aaaa5ec2bab56a1

SHA256
558a6ecf7f2e819df40446f68ae56205a988032a349920c5268bdcd245f83f18

SHA512
f4f594fcfe894412294324ae45caa9b43163de35fda0dda6f1aabda70bdc747409993f81503d567a783685c00e9097d4acd775c36cba648b22b04c66e66116ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08aaa18179f8b073c632b655c035b858

SHA1
af75601e7b18f1ba521b8c320307ab323a775264

SHA256
dd764960a04dcd7f25bd9321f54ea6c0883225a6bf6405ee01fdb8edfffbc0de

SHA512
c699bec61be782ca092ab2f73ade2a9d6b8c4c6749c3d63f13c4fc9a286a1a3ad349063453d0e882472f4fb9f48d4a890847e58af93388f04ebb3fbede372cfb

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD55C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD62A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit