a2640d22db11064be6c46e3793aef28c50864df2abe4bcd80b69335109dca8ad

Analysis

max time kernel
119s
max time network
139s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
26/08/2024, 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1f9afadc3fbd82c85439d91f091e265_JaffaCakes118.html
Size

3KB
MD5

c1f9afadc3fbd82c85439d91f091e265
SHA1

bc5f4672e85ab6ac9cb9b3a1f79645dc1456b88e
SHA256

a2640d22db11064be6c46e3793aef28c50864df2abe4bcd80b69335109dca8ad
SHA512

d630b50fe9b8b27bcf3ff3ac533bc1e4d382550206ad9663d07ce19c47c786054af167d1c3aa42496e0dc11bfd81ae0a39695e326dc1501a37d4f7c7f1360257

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{62CE1EB1-6347-11EF-9A68-F6314D1D8E10} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 508a3e3754f7da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000ff4a29ce5ff16a7a1d86cc663a67bfdc265f234ace9966b2997a581576d80def000000000e800000000200002000000080c555738c891c827d981bf467a7f9a246287988a837af1b5860922c9784e09190000000b34ee4dd56814d4c4fe74c13228e5b06e92a97f9e996f787da7087d99ca7678813bd047de2ef420b9e5225202bd44c9657359f1a041b5b0c8d7cd48a0a809303b51d354266a2c6f1f872f1873a6e950d73dcb51ae3b57104527ae3f8f5f129c9825f58909758a076c26f0b0abd8bc0a10d9562f4b9cd0a24f34edfafdcc34c680267b4b8ac07e7440da30f54f34b88e740000000b6f42f5fc86c1fa6cc97df9973152c65b6db986315264d5e44ca3d92e1b1206be6cafff9198e249f7f9c3c31ea9f0090b1416a3e3f25e8b9ca2b1aeceb7f590e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430796251"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000c6154707e079ae12d3fc5822a804f1d6a13eea09fb03edce70777523099aa40c000000000e800000000200002000000089973cbaee4ee01875a33e33226838f5d0c3f0bb2bfa2c796f085fa9412caa8720000000a7bdba02a6eea726430e9cb651eb168007a743da187abff7f7b82bcca331c24b400000003a278b8d7666f05acff20bac77b64edbfb6bf1148aae4dd774f51a476d9b8f8c0de283ebeddd572c3544b1520e3be98e5845b4a346b382f6b2e234eb237e3e05	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2232	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2232	iexplore.exe
2232	iexplore.exe
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2140	2232	iexplore.exe	28
PID 2232 wrote to memory of 2140	2232	iexplore.exe	28
PID 2232 wrote to memory of 2140	2232	iexplore.exe	28
PID 2232 wrote to memory of 2140	2232	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c1f9afadc3fbd82c85439d91f091e265_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b6a3ceab11df6b23e300e0501e60427

SHA1
5f127c0629bb21925b1198f90459258b378d7c39

SHA256
d7d41f5dfa15d3555f296d65346b16886f19e21498e788122a24226168f7fb22

SHA512
e5d42663e106bfdcfd7c66fe083a9280015d5d03ee5ed1610ea247fb9d8291fe933ff5f693106ffa9bb203620e082c252c514116bbbefe93dc160bfa5561e043

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
927b268df8e41cf8c7d43a3b2b9e550f

SHA1
d13a5e7a24f4315642f60fda29c79ba4e5fb6327

SHA256
068ddb5290cd6d80ac702c8433126c4b85b49cc111d29a67b3b28a87518a7db3

SHA512
79ba33b9a51f6578797f65fedc36a9949c34ee0c3932cc33742776552730782b69752dcfdf166963b0edf99c9b37f0561955451d997ee0f37eeb8e5e269a53cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8dea61fa6012a229853c35c20b6b4f82

SHA1
0011e90b72fb5d95722432f64ed8be9b45d5cf59

SHA256
9d361180ba74e66c7faee45ea84c6054d99ff9a1bddb40339278bf0878d1188c

SHA512
595831395f91c3fecdb86773e60b92bfac0bb69418400e193baf27480b32f6d7c5cda4a1044167119e641ec30918bb7a17abd7e1592cd59c4a72dec8d5e09af2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23255eb5dcbe9dacd6cfd3f42f62b183

SHA1
6f45d7e5ebccde67519c620403d0cd214b7db57c

SHA256
8d2d73051d387aa07cfad5cb8122be2c5cc9b380c6b972f0782922f61fa7989b

SHA512
df9059937f2cd1834e29883cb71744ac15b2ec9af4c1b13b5587ac510f691bf562d944496af070cc0419bd0675b8d871dff135012d35a7132febd087e481a0d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33d404e5d9984d4ccfc6f9ffda2bac07

SHA1
382aaec2c032aee46789eb479df154641c8ca8ab

SHA256
c1f0feeb5041d1c7fface03a172444fa4534deef0cdb4820a592c86748faefe8

SHA512
cc3408d914d89220291abea17c69ba3f86551d0f03a7e893fe9ef8262e886a9a2da5cd5395524bf20a0af85b52f8b610c0d17e610ddb49e83b7f3a4d4005677d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f9725273ba33ec625de0d36bd1c9389

SHA1
9129c4a2ad4630a757787fd2f5a1eabeee1668d4

SHA256
2e3213feb30edbaecf186f336718f01827e9aad944e4138b3f598446b1a6b9bd

SHA512
cb5e77429a144d6abf662ded9c4c9f2eabd45cdda5d64596c18249953fe7c195ad84a53a47f6906ec67176ac259884917af3c8e6a8c8c6104ebf352b3227dbca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d43ab6e50eb4658178a55b12194f0de

SHA1
61be567f195f61a75e3bbc6f77e32ee0cf32d80c

SHA256
68b426bdcddfe27ee3e3f88dedf376d5f94de45cf35d804677aac3e807c20103

SHA512
ece0b41f0cab64b3427f1f171da524734106f83d288989e7bcd55b6ac833e51541922c6c3be22051080cf69eb3155329dfbb31d7e4d05860979594a48aafea27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8497a1a50018ec7a866b6495e7f97e68

SHA1
d3abd6a15c9c6f288e06a24f9dd1f81663cbb45e

SHA256
63c1e6267b7fea6eee59ba754ca5084098cf8d1717df39c193255ff6a9929983

SHA512
612c05bdb35e514423f394beb373e6f9463bd14b542f8a98176c875fca9730d55c79ec839ae18e412bfd16cd587c986879d56a7cdaf0ef133edf617523334f98

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAE1D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBA9E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit