2b7662f2074eb60cdf0c7ec240a93bf015b8d56aaf8def2b35dfea4abcce0f4e

Analysis

max time kernel
142s
max time network
146s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
26/08/2024, 01:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1f8817f85ed2b84e41e235ee08fbffa_JaffaCakes118.html
Size

59KB
MD5

c1f8817f85ed2b84e41e235ee08fbffa
SHA1

d1b00b27fad86a1da169b86dad2a4c2282ebf234
SHA256

2b7662f2074eb60cdf0c7ec240a93bf015b8d56aaf8def2b35dfea4abcce0f4e
SHA512

1f330e4b5fe480c806640b880293c621347290b0c27eb83a225fb5e5362e647d3bdc08d5efe51c42f3183c0e02fc1bdc701cfd8bbeca726014994141fea74f64
SSDEEP

1536:wM53TDbwmZ3vdBZollRazCiC5bjsj9h6kIR5zP1Qa/:wk35VvdBZollc2iubjs0P1Qa/

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0A96E601-6347-11EF-AD83-5E6560CBCC6E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000e492816f111cbddb6f6433a653e6128073323b4cb28bdec63debd8fcf0984ee6000000000e800000000200002000000088e0f90624aea98bf57289a17455620b2c5e59da4e84e7abbb8683fac53aa263200000005911ef5c7bb7d061bb7ff998ccb8d74111abb72482316775ebb102b2513077f140000000b1c1410b317a1852d449773b66d8a3837b622f8c0098742868ca557c058c7753083e3e9dd94a3ec33db720b4e891d053ab11ae6f1cc4263d9f287d1e92f5f7ef	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0c1bce553f7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430796108"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000006eede3a88189e8fa02ee96457b5ae93ae19a994aedbaa44f488506cd2ea3d2ef000000000e80000000020000200000004bcd863588bce20113f2812620cb4c325753d6a61b76a66bbb52cf5afa53f0ae90000000733a2645afe56993b9bd9216f247c8212b273cdebb3225161e9971c49d60f3ef9835c436f39897470f73436a39fffb1b9ca224fe0ff318c273cb42aa2cd893dced9b3ed58a346a96d9d397bafdb81cbd6482151136a94c6e0c02820b820f4ebb7cf75c0d93301732c5a4bf0fd430414c167ec7b7e296ecc241672a8fb6ccbf6c0b38501562c955aa5b6ea99d6ee6fb45400000001c89a8ad7b08eb4219a11662c0d4f0c3739fdc6f050ea53b40a7b24205f26ea500c327c9c19cb22a27b9f1f418f355d9c8c58f37af86dac96e7d8f2a47a60098	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2548	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2548	iexplore.exe
2548	iexplore.exe
2408	IEXPLORE.EXE
2408	IEXPLORE.EXE
2408	IEXPLORE.EXE
2408	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2408	2548	iexplore.exe	30
PID 2548 wrote to memory of 2408	2548	iexplore.exe	30
PID 2548 wrote to memory of 2408	2548	iexplore.exe	30
PID 2548 wrote to memory of 2408	2548	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c1f8817f85ed2b84e41e235ee08fbffa_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2548 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
4c46e3400d9d2d36c88549bc7b3ea113

SHA1
adbbac19f3cf0ba2fa0fa02faa41a2cc63f27fe4

SHA256
7c4651a076bf40121cddf0bdd8d745be71847aad9c2578a3b3c6df648293c153

SHA512
f7fdf7b762978eb98e7674009d0511325859f839f5826ad682df135bbcbfc0218b79d24e39e7d12d0b692ed6d6b31dd797c62c5aca5413401ced1e5b579016f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a36c9fccb262e7ec874128d4194a24b

SHA1
c2f4c2e769f3cf7f08dae2b1b6fdc2a598cc29fd

SHA256
a38b9f331fd93c79ac207b4da3e3cb4121929a691a54f480afee8111f0f88512

SHA512
31d58047c7fff0e4082188f96401617a0409bada71ffb4bd06927b9e66135c1650b0caa1cb7029cf20b77166cbca073dd0b885f7af5468647d84a199569a1103

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e83d649b920f253eee7bfce75cb1c582

SHA1
dc923d3c9dfd1f74e705689b681e3e200aefffb5

SHA256
bb8b5fa4b9de494d97f3ad003c50a4da1e92a08f08faf7cb14d156158f450dd3

SHA512
8227c5a7e05c833e6d45067957f4fe07aee973960f5cf2b9d19378807b49aff35aea069013c1a99031753e2c021c7e51ca577fb5e9b24c022abce28f29f34108

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a49bcf553c0ae3e906e270a24f41d871

SHA1
a35b2fa108deae5c1571c3f400480cbef7df25f2

SHA256
a07469933d4b16129f8ca0efceec5ff6861609021e90b13883231bca081cbfda

SHA512
beeacc98399f88c2eed88fb2268d85757a57f707ed8763d3cd9a84e571b1b68aec18afc7bd945071f418a6b2d633a4589ccd466837eb687d76587665ccca227d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
669c493fac70552e33e72602e7872d42

SHA1
58bd2c7cca7384485572df9cf247519d5c62ba9d

SHA256
64cd6dd09028f6a7f825072f37cefd3cb637be02866f9eff7b2ce85a83a15633

SHA512
a336871dcccc1903b28aceaec6fdc887a60af2092cde2c90a8f16bbce6a81da7354b83601a9262393d1b4955a3f44bddef6d9721e3088cfdf14fb62c6a637ec5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f090920625cd012b1860dc34c76c5045

SHA1
89684682becd6f06776c27f68f59817134ad0571

SHA256
c793211744ce459d7574679437d065bc7f8164b8395555247510337defa8dbac

SHA512
755b1a35f9b7682dd83e10c5ac2047713cb8916e641a933e0f4ed347a5653366db3381adcc1b32c3fa13d71688429f5ef69ec8fb0b18d864cfc343626d26e05b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ebaff7b166b03ba5a9dbc5238875dc1

SHA1
ae4696ccdb02073fc083fda2038b23bb8237bb2e

SHA256
dbd01f66e39205444e159c3521f08b0938728328963c8430176073b1bb431576

SHA512
88874fdf8786ffa2a524367ed85722f83f7e40b0c7154f40b6287557b0f6b28010168f020248f0e0af66db66e6bd67574532e52a9bb76923347df6b513ebf220

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d187d1d882f628006164868ccd95f8c

SHA1
65a026e0c5389a229a517773305b651468219002

SHA256
092dc14fa35e48c03fa5753fcaac0948443492f4159e2b279dc4965c159d94aa

SHA512
7d936782a4fc99a92bab54cc1b5bde1b414c6ee1578b3c137f11d818d445dfacf6f3bba044a87968e2365c0eb8a3522cd8761a077426cbc3f8001e9bad8a266e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a41deaf3e3c9d43fd38b26052f0c921

SHA1
c0f9fab2b97ca9721679ba69939bcc6cce222f85

SHA256
431c5854109817c36ae761e04697ecea711388f73d18da0b9732173f6ae4ba2e

SHA512
e2a9fd63f7102901c8eae57f02e3be4035840481d3f0c6ccafe68ff21106c986e27a91a45c1c7cb71d4607fd4eca79f3c75480df655cda60d5c06bbc736d2e4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c60b3fbb9488de357fafe359cabe386c

SHA1
54bd8b33cd01094e401a43a39ce66addf73f2066

SHA256
cdfc5c6fe6b4d69e189de7987d0640c9eb929b946bf4391d128b58ea69f38d6c

SHA512
ecfd467542b6f20309addeee51b9051dbfd56688612cb6445191c9f901db6bc91b8e02b2e88c7c13726400f9e5dfecb9d77119ef486fc96a94f417775984584b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
a9e8fd530211d002b67ee94b121b2500

SHA1
ce53b5bdf1e1a64b8714d443de21331f36960ea1

SHA256
482b21ba0859154747538b27a9f15b3caccba968ff65f19c7718e7f5d6d70151

SHA512
4a762030dd2a8dc5812246f4211dc356fc3ef86afc89afe6b581dbfd6d14f6b78a4a405348e17a0156399a70e493ca5949f24b3e68e7e950d50f1813d474ade1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF8A2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF8A5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit