1079d055bc4d28c01cd6689979c7a96a2b5a9abba15e75456878924ad8ef5d60

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26-08-2024 01:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c20f6ef611385db8c2601b2c03fbb112_JaffaCakes118.html
Size

302KB
MD5

c20f6ef611385db8c2601b2c03fbb112
SHA1

1995d327953178ba9aae2106a8de4891f7485a8d
SHA256

1079d055bc4d28c01cd6689979c7a96a2b5a9abba15e75456878924ad8ef5d60
SHA512

84ed1d9a947a7e223a593032eefcab8978bbec1b75b2931a6902e6dd7b498737624d751d653513185b57322ef448bee0d12587a0b2b61c61d31e3fe4f8a243bc
SSDEEP

3072:QaibgFYchC0RqTSfhixYu0pNrhs0Q9jTiH+cNuLY3fQ3eQSu+e80SVbArRHNGb3W:QaibgFTWyNa3Gi/cU4v2YLExY4

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E04872D1-634E-11EF-B6DB-72E825B5BD5B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0489ab65bf7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430799458"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000005ae4030a2dcaaf698baca9a086cece75b987988008df8216e973604bc8e1c79c000000000e8000000002000020000000d918269e1763099769e7fe8b7dfb1fbd9c9fc118d4266f1ba021cc0a3fa79bd09000000084e35568f5e806aa10a733939842971a74352758127fe4646b9970e4d27d6193ab9c0c339d3db684580aa76a52cc9e508c7796ab31388c0e82057f1d7f3736d2e5c1f50768cba78023d2fdb27aab9a8bb704a1c7fc8aa6daf96a23bd72c68908bc80bcba5606da9e28736da01ad3fc38d32b6b865ddde54b7d4a953efbe2429c364a4768bfbfaf92be4aefe6802de6a940000000b20c5ecc3c8760a709a589b2873eba2f0d0bd8d0b3cd97d227a637a2e10980e55be4d80d33c1feeba2ff27bbe793af0a00b3e1c7a3c07071345bfa67dc2a6b8e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000076e6ad14978f19e72f11c084d550c9f51b482a57f982b200d17ecb56bdf8e98c000000000e80000000020000200000008c883f092e042a5f3632b75a21bf0e2dc6110e6a23d3ef9db81b50dad6ac91a7200000006a0ba0367cd405e380a3d683fb2368cbc4cc5a482326cd5ef7d470d0ae8a276340000000788480389d9a7bc250f5fd59a1a1cfa2afbc8d3f0dbdae38cb60db6cc2c1856316de909b1f70cd55c6483bd0992d153c82046d411a2db62828a69af512f4d308	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1040	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1040	iexplore.exe
1040	iexplore.exe
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 2140	1040	iexplore.exe	28
PID 1040 wrote to memory of 2140	1040	iexplore.exe	28
PID 1040 wrote to memory of 2140	1040	iexplore.exe	28
PID 1040 wrote to memory of 2140	1040	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c20f6ef611385db8c2601b2c03fbb112_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1040 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
627294eacbb19a207c383e87dd24999f

SHA1
b8c4371207aee7aa11dcc5bea8f3e861fc05d811

SHA256
b32ac99e3671cdc21f8360e728f3bc21b030b8b4a853e9f5543b93b5c7fdea0d

SHA512
1baa779955fb2984f99d5f6ea4468265192cdaa6e250dd305bf227782429d57d8817487a8256edb0cd595c39629ad388e0843880738003e918e4b4eff999106a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3de3ab721657aab1d134bb4843c1d2fa

SHA1
1a46ad0a6addf97c3e434783df6e3039b11e2d04

SHA256
6da1e9a8fa6b32ae2842247600d48ae25437241f580ae6158961e79ef7acb3fe

SHA512
85fe75303a113fad7dad61e76db7d14839582efb6b11ec7650c8c6f42c53c1b2197cee34be8098f06d369c03f3718eec517c9e4c55f2c595d37197e260a84dfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88e3514f0d02cad387fd0488a35c7ca5

SHA1
af14074670b31aa907589a3fabb1f69b829e8951

SHA256
eb35a439db48d9e236a9c48301847222d1c9aad8be4f521464db9e353b9b68fb

SHA512
f9c31bcda283fef5124ffae575e5fb4a5c88e2620077b2cc2b5a555b0b197eb69333e061afbd4726de339a63ddce3de61910b203dca7a285be0f5928e609abda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b588bb5ced1e5cb9ac41edf224aeadc

SHA1
58630426012308cedb61392eea4b1759d58eab33

SHA256
8fc8d85a492f2cbfb454ea71d952d6829dce12734ec64d1bf04781d69ae8bddf

SHA512
06850359d0bd0eb907fabb50104aeee9087b778e17b416c1df80bd767364a460efa1b5186e5b1d785d585a9bd754a7dd9dad714bb12ff60becbb177e9d864c5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e1a6ea33f7c0d771184e241d64c83ce4

SHA1
4a0a15f868ef9129d73869d43f0d0187aa9aa851

SHA256
7c00cf307e88472bd829e4a1c356f69c9f1ea54e73a92bdc856a8df710de681b

SHA512
f4318ace91dd40f1f68c8a60ecc05f05843c3b8ae7aa7d1cf3d386d691adf04583f5e7c09c31e391b2f0fa78315f3e82fb05de392a2e6e0a5b1b5016763bae0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5413a4ea19fb8348a2c270ddc7361136

SHA1
2e962ade5dc6804403561c4bc3d25a486f564fde

SHA256
30505d43eac7f3e52c87decd23230d8559dbfc39a82d9cb5c0510539f54cd2c4

SHA512
df20aeca9a66568624fad858c202c20749a28ba87d9d4df755cd8c17314d2eb1802b2ba36bebbe963bc415c8c89b67b082b6abeceba661644e34d0d972d7a6b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f7169afc9eed53b338861a2661f0f19

SHA1
b8a9301cb2df4b9752200dbbf7896ff31234ee44

SHA256
ddb5cc4d6bd46950d43b7a3fe5b87a3b13102fd21f9f9789230b7e46c1fe62da

SHA512
212c55accb008e130520035a9cabf743136522eda17cc49fd9977c6ad47e2e37500fc5f68be24767a142974470d7b084ecb94ed03fc70423d11e2749bc565b06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7befa6874bed3cd8ac9d2fac5394c562

SHA1
ebeaaf9e25c13b3f1b460dcb7c746f942eb017a5

SHA256
24fa30705203af871be2b0b737c820efd6140f73ce4c0ad7504fc3d19d9182ce

SHA512
e1d10e66cf9eb6d68a8b5b4b1045f89acc51618d18e0b749e1d67e63b8cf810968ee15e0d57372cf204f6c4fcfa586ca37e4c03174edd24480764f993e91a578

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0197e3e2229b836befdced038ba94c1

SHA1
40fb53f24a4c0dbc682f6aa3af9353fa68fb4570

SHA256
b63f3444112fb1cfb90ad1e95b8fa841367c7e5d9346a8dd5f539c9a2f092568

SHA512
6c92a3310efb5f0b1285e6099837961072689e8092be596a1275c3937f3dfcbeda8cc3e511d9e62df82df2881550b0788d69ea44ca2224eb839ba7f0079ceb22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7fd24268e4619dad3c44a0b2060b25c0

SHA1
dd93f9401a99bbd76b3456990f5fa0b65d523bb9

SHA256
38f5fb580c52e7a0e76df4061c831dc630d74b333a77b5db1bee788ab303806c

SHA512
b777e2ffc74ca324730b78bebb58c34509db27483727c24e4c3159f553ec53f7a7576936e8b8344afe2cd71a0bd12a91b0d0e0306712a1e257f3db96e90c2622

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6decb8ce8ddf9b6ff8ec7680a1af4c44

SHA1
e27db2c6819a54013df75966c6ed9b4beb3c914b

SHA256
3c6c13b80690e6fee93437f77efb697f6abc4f73d765aebe6c34dbeac69a6a59

SHA512
2a0ae313afa813f1ab1b18ff055f6e17fefc5c8009a597651983344f1f13c95c94a069f1a7cf55c313715664dc047577deb1e85f59770cd98be612576f396438

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Filesize
400B

MD5
7beb198fe9d48e2c1aad7418cab3f425

SHA1
54ca01d6bdb42003dd53d8418ebcc27af044b430

SHA256
39dfffe2e566788088041748b47f8ca1c8ab2c37a88ca2c3f3597e671c5d5492

SHA512
82d73a4f16964d27148582d8f5b8c3921abe787518002b8cd0c362eb9ebdf567f47186b8a77063f6b944be3eec698b1fe0ca4c1d82e0eab902df8e64cd4c58ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
dc846d2289d26da55a3d66c41b420bbd

SHA1
4340b9b1643f192835a157526a1f1726c976084f

SHA256
93f3658cd2b47c81bde1ad92a6bd0028441b78665352a409f6ff94eb98c24968

SHA512
97aa44b467a5cde8a34c534ba84d06b54c1ad9ff9dde5e52e98024f472097c59d8f6a08ec7f2ead3415cbed668e0099d672426a0cf885abd86ef6831abb7464b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA22A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB742.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit