6a2cf4d897d33341ad5b1a252016d951db0ce1af893ab96b29297f67a45d4169

Analysis

max time kernel
119s
max time network
131s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
26/08/2024, 01:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c20b47810a546ea4f8acd17dc6a9211a_JaffaCakes118.html
Size

19KB
MD5

c20b47810a546ea4f8acd17dc6a9211a
SHA1

9ba6c1bcb27ace2a534a12028f51a124a12ec4fa
SHA256

6a2cf4d897d33341ad5b1a252016d951db0ce1af893ab96b29297f67a45d4169
SHA512

6612bad1e265d911127a73dcde8aee5a2de9fcfdea69e20786b99d43b02b6fda4eedb36d6cbfe302cd0d3b4187a714697e6acfb496f560b7c94352850a24eb04
SSDEEP

384:mCm0evK44uvzgu+TW2tlw919/THpU0SlJoy:aK44uv0u+q2tlw9b/tURJoy

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60f1ad595af7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000f86e1fe8e68575c1161ac478f254a89402ed47cc7e7e75bb1f07616b9b1809f0000000000e80000000020000200000007f388cd2fe65a6e61f116712834e5880c39cb70308dc8b6c8493b3d2bdbf0a2d2000000007d05b7b4cf4906855deabc3bdaa2244debd970abd04fa621c84009fcde6cb89400000007001dd24ac8320a994553add9752d1b238478a43ee79fcd90421cc3600a83e1bc30131a3ea9d08feea05ed55505e2f44ddd2e75085daa8bfd62c5f120054b5ca	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000ddbcbf2350e96e43a888f788c6e72e2c376b6a53179ebe771fb3da652a75ed87000000000e80000000020000200000001ba024cf284447db26b4c18d9be86797dc2efb97c8ccf167802f8d087078a8f19000000041e92b6c5d7e7398b26e1548a0ccf1c78dce2aae08994154013c4e1e707cc2b637e14cbf7d47aada246f3b2987c82d5bee23502bba4e45996d5d75c1d6fed32aca6c64712891bebfac31aa10e5ffda714a96f5718176147602e8b744184ec943cec159e71028154b969bdff8ecc47523939ca83cd05a692eeab743fac3c9632a5b99fea20d3204cc76b6a4bc60bbe48440000000de847438ac7722ff84a266b5ceb912ebc776e0ec29f2d7f95d21c5e2d0a742f9b82b5db7575d48b1c4142b98b36346b039a0ef10662dd8fb24c2578951d7d6ab	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430798848"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{75EC6141-634D-11EF-82B5-E297BF49BD91} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2644	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2644	iexplore.exe
2644	iexplore.exe
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2792	2644	iexplore.exe	31
PID 2644 wrote to memory of 2792	2644	iexplore.exe	31
PID 2644 wrote to memory of 2792	2644	iexplore.exe	31
PID 2644 wrote to memory of 2792	2644	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c20b47810a546ea4f8acd17dc6a9211a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2644 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e6804d8aeba7f2656a831acbd95a5fa

SHA1
e287ba4a98c2077c8b9a032be905241b3fd951ac

SHA256
dec24233921a31d83b11bae034f600fc507188e0b046851fe71bd6da4d47f97f

SHA512
67abd1e0ebe3b155dfd313d186e9b0a43e0b4d1ee492185e6adc98607a120d30fef9b61e2d57c2d3cefa8f9e9e95e15497676355caad9fab0a51fd94274ed6d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1105aa0327193b6bab16db22338e6878

SHA1
cb1801e4739178fc4600b5bef5e0c00fe7022832

SHA256
f1efbbace73aa226b7c130277a98927807e53b8fd95ff16c9f91b2ae85f4a866

SHA512
cdae97aa0442d1bffd22b54620d9d3cfc3c156733ac15c9502a37fdba0d4dd0ded29f1610ca95c1932212b650f1e6c5f0442ca903c81704d43d06dbec4d2f06b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d811c5c8a64323a1e035afa1475a440e

SHA1
6fdd1a7d97f6581375051b15c37a05b4d90fc338

SHA256
5b80dfbd90e8e1c02d54d70c185c4298c6cc837884dcab9b4cd3203f6d0bff42

SHA512
c94e2ba315041725b8a7bd6516ce95c04663b618dba1af3cdf5f34fe649ced4fb42a86218bcd4bc4f789849f7a08f6af52029cdd7482fef43220d9d4f4862f93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
308b7898d2632e21f282fa5874d9d630

SHA1
32c8bff44ed36b822bd40694b824e89a012a2156

SHA256
8d78d9ac055a016d5b887cf97782fea6d8b0708791e5e64120363bba276b5866

SHA512
4370b4715e8c2da530620ebbba4a71ca16f43fc6490d0695721e5a3719222ff01599d68338ef2a5a334f1f60b54ba6a95b9beffa2d832904d1a3d0494a20c9cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e4b26a21ce6f31206e04be5e3bfece7

SHA1
ac2ef3b8f399617fde99f6aadeecbb05e11c430d

SHA256
77c6e6e1effa64971564b860dcff50ca6147839f4eb3fdb24b9f765c903ed5c9

SHA512
25e1c425fc3a6f7f77cc2c7d7082be30ad7a442e90f671a7c40fabbc8a9d591bc6e3f09efe93e449e3fe581afde7cc1e89aef296ef2c29b1fe121b4df3536fcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76adb3626080a674441ff619c753629f

SHA1
88c647dbe8e9b8e69500aaa9a4b14126bed92a6f

SHA256
b8a2cbb875abac7049c1ed420cf3038053fef6c41828ce31d811f1d3d2726ace

SHA512
dddc1bda843347cbf15545cccb5f0b643bcad0ce161fe7a0adfbc45cef5bf8c6c8b53d80f630e8dde9cf66528908fdad5643189b00629bdbf73099dba1c1dfd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
055a00abf08a1dac7676770f5a2dc5fd

SHA1
d6fd0cc24dba33ec23b920a5bf0604efe33510bd

SHA256
21e609fccbedf0172313abc4bf61aa65d8c5bf0b311bbc1475f3e86a333fb2e4

SHA512
66aee234ed6d9388e5e80a0c06afb1957d97f754e3ed26fa30d60063b282077c5378362511b49a7622298fe8fec52b89b2578774fa4bea35edf849087e617cd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87532eff9fb764a12048b7ea48306b79

SHA1
4cf0b340a741b5e2aec169696c97cf7ab55a1b8e

SHA256
7f101c79e826f0a7e11db43a8a619bd3b2328cbb0cbc3ed01708e057ebfd56f3

SHA512
ab86f117fdace1882e2825558128bec53927c846af6252896d80eae75e18d12be0d36a4775224c156acc44a94bd983b4e128c5c3fa0a0dd4c37445aa6b0f03d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ea982558b71e79c0612e2361829ca98

SHA1
c1ea59148e65cadc1e379e21cbd0cbf6cb61d6ee

SHA256
8b202546d7b5d3716082c38e493b8276f47599614f144718a36f9712aa8ce242

SHA512
8d0cd897aee23d4a854a3383af265e8928ceef6abcc3211f8d604965d25a48d547b866cbe49d1bef47656cc1366a635c84359e6afd6024a29035321bf14aa0e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78323dbedf92292accf73900de227e55

SHA1
bcd4464d1a65f760b2dbe89a00e7a867e57c178f

SHA256
1e5aae2a7d4d5c2286a73355edc8556aa07013e425e03c1c4f67dc24de077d09

SHA512
7c2696cc7b70d641e6c9c629e0ed82490244d5dc49f18efcff8af4c3cd7ba6fd44bb16abece5407afa1ce6289f93c4db6956d4dd2ccf5f1e841a700b5dfd0f24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5983fc470c7584b715bcc2b7bd2be6f5

SHA1
4fc7d576e4d37f2f4ae657972154fb30932e9c3a

SHA256
503a7af20400787b12b50188338adc31b50a4abeb2619492daf97c621da20a6a

SHA512
c8408a5bc142340f0e5f946bd3eceb9bdc55f9f4ceb5a57fe1dd47127e861c290446eac328f5b1c37ec25e7fbb07208c5a4639b6ab19f0c0585d92f83a5e6593

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cac17df1a3172ec4bfd9895db2ff216a

SHA1
6bd100bd40e3f403ab1e4826fe4728df409c74f0

SHA256
857f172c0b71d15c1013e137c0ca2549b3c7d9d59331a71cd2e6fc72d3e79478

SHA512
a3372537f8730108eb18801f96860895fe40933efc9159fd400eed15bd8e5081cc11df594048f0582d09d5f3b42462e65d23b39afd8e823e2fdf59285048d55d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b9d1dc58017a2925581e51237b2e639

SHA1
9b1e02af3cc4e811b749c43b55391e452017a789

SHA256
fc7556367fc2b2f9424294b746be8e173928fd40cc80391dcfa6f36f31b39d0c

SHA512
01495b3e690fdeb7f474b6920cc28e5ed12dfe6a76fbd4ee286bd991787294a6eb8aab55d4f7bc244bc1ba7e24ebb9749b5a43a5ee508a6253b0812180d56b77

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab624F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6271.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit