36297c8e8dda5a5380257102e82bfd2a417fd2f2e42f314c2ee0591ebedf4956

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
26/08/2024, 03:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c22b77d6f28847448d1c0161f3ea072d_JaffaCakes118.html
Size

37KB
MD5

c22b77d6f28847448d1c0161f3ea072d
SHA1

f391cc6d01e93b190fe47f0edb66cff8d6a6207a
SHA256

36297c8e8dda5a5380257102e82bfd2a417fd2f2e42f314c2ee0591ebedf4956
SHA512

150f14404be7d416353e2369db22df2692b2bd0eed4e97011acdc7ff6ae339cbdea66dba575ea272f18253e2311078dd6d38e7eba61a742c0fa2a5fdbb934ffb
SSDEEP

384:MjvHwduTvmBxnxWRL9PicwXWV+PzCsBSGXNEu0:MjquTv2nxALVhKWIVB/XNEB

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000007ba5b8bada4371530052e26a7ce60e89a14d03d92d01a95a2ffc67b2c7a2a351000000000e80000000020000200000005513e7c1fb13e4b2fef5cb9250041270d8298137f22c7cb8394e0402af5f48322000000083e839e11af85f29ac9760e0e9679d9e999222310f248e4b5780e1e7bfb1ccc0400000006e158d66364608f4bd054bceaf20918f88b92b3f723fb5b5c6982718766b5de1b3db9cef44d43ce3ff34f5ddd09c785677dadd763697a87a7f1ebaeeaf352781	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430803813"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{04ABE4E1-6359-11EF-BDB6-FE3EAF6E2A14} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000001738d776ba5fd5bbe88e5e0a1611c63971706c8cf226131341bccb622f6fa200000000000e80000000020000200000007ec133f314dbfbc153491fabaced8740723e14e3825a20c5178a2d997c10672890000000727c7f22cb15b1bba63dd9e8eb72c999bc35eea9860a7ee21ecae2a32aaec7a525d4cf11ae5913c9a7e652dfd1d9c82aa5cbabc717fd013e01018c2b0957ab0221acb38a6a45599b4f0850d4712d48a7ebf79c61766d38c8d5760563e3c5f43056abcf11104ab1f01c01f0ab020b429b11098405b373002fbf157c41ea692dc15762bb3ff8678fc1267942e028cbd0ef40000000649c7eff4ecc98fa7fa9c0fbea14f77d4774af96176c94f57967a34ad430e4183a6f880872839620cc756dbd7c644ae83708a162cfc750614eac28993cf0677a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8099f5d965f7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3004	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3004	iexplore.exe
3004	iexplore.exe
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE
1744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 1744	3004	iexplore.exe	30
PID 3004 wrote to memory of 1744	3004	iexplore.exe	30
PID 3004 wrote to memory of 1744	3004	iexplore.exe	30
PID 3004 wrote to memory of 1744	3004	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c22b77d6f28847448d1c0161f3ea072d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3004 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
39abf028763fbab88538e8bb7b3d60e0

SHA1
8a258fbebf18162fc9352af6ca9b569dc11a594b

SHA256
680e6711a5e8ef1431b1cb02752fcaf415b5a7f0ecbfe11110dba3f5eff0110c

SHA512
53d151e36be69cd2ede371dda84b87f366cbb0cf35167f85bb3c256be7a739917f6097903b2e8933fb6ba6059405114be851cdd1ce392d11a96cc7a670ef3b0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb981f5c164cc28022a7a969d1daca5f

SHA1
fb1256fec6ce66616c9909fdc9be17ae64fc92ed

SHA256
b6c8880d5faf474210d0a9b87406a998d2e52d9871ea45a3ce6acd3d19d72b0a

SHA512
e3d7e59be56c6cdad61b9dee6e3378f92913911d81acb38f7910fd191be98769edea26ba082b329a7a2e9d7f70bef964412d4cb2ea39b33e2651ef975fed1a4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
641846c4c92ae1cda040dbbf02dcbefb

SHA1
436275bd6be6f4c4ed0d3e094acf5ce68a3fa01c

SHA256
f0e0d0dbaede7b34352be2a6899e377bed74b4e3fbfb4b7e618a87b08337e980

SHA512
7e30960b7f8b63eca087b6cd395468ded3aded3c540c1684f8569a4baad8cae9965b81ba5117c2960bd80cb9cc2b2d2cc096859117daac23c17b8da63b8e7961

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
445a595fa12afe9cb236713b58f3867e

SHA1
13076023a56f6394a8758ec332a5a97e5d55e905

SHA256
3c37d0482c14f34473b907c90beb39638e142b00246b97777df1bb3240189c2b

SHA512
0dc1a08caa0910cb995f7a4300b0d7a0af15720a855dedd75428adc006063668162d5ac1919fe2f9884529301b05334b0db938e72300ebb5334b77dbac20d0e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22a7d36a0fe5ba7187493a2f851bb4fd

SHA1
0b98accc34ac923e1070bde4840c21811d60f651

SHA256
76815f9b09f3e7a61212632d170877333d773b539436971e60aa6a6778b01723

SHA512
86f0dd708afcf1da1e3375e3a5d08580f93ee665e972b690176586455e457e11da51affeb53c3ca79edd360f3ebbf564f202319d34717da3acd5b11c8862dc7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60d59c3d08a48962e8f78dc9899dd6b4

SHA1
3f7219983053c270a8dae4c68fa7d67047ba9d4b

SHA256
34bd87a763d246b131c733ec297982a3e8486fc6d354a011d03624ff231bb9db

SHA512
112f46d8d51df4e4da856c4a1a48c3c8b1fae5bf33d3b2f50a0e4625b0cbd482c4cd08657b3a5c02d05dac7d0c95b8d3e31f562da3f74f3dbe324139741caac3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6bc00366cba4f36883ddbfd306c42653

SHA1
ef9445c8e48a8688ddf42e9ad1e758e5e8ec5b77

SHA256
95a14ae4c22a7abadf147b0d29a4a28b5e619dcee83dbb722f30deb00e50e085

SHA512
7a7f5029743ac17a5020beb154a559043bf7628a3828c0d51a91a8ca80b37ee7ee7da936c67be1554cb3ce89d733574e11c9afee1681b9844aa1d9dd83946836

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a87ab588f9cede2ef60ea7e7e5593d0b

SHA1
d9ce609a62a1a59879038c6467af6bf8d12feb05

SHA256
5a27fb310b78b4fb21d408401cfb0b7d20e83b06e8b75b8ad111a7c8c110212a

SHA512
dc5f4270e4a9e4a79287764acb33150f6ff939a393cced762e8f8120f4490b6be3edbdd1f1305644ebb3a6475aad5292e90efaab4ebb2dde5d0707c7180e3346

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81a7ec47e5f124b505e7e909c1d228f2

SHA1
fc252fd7e744f0218e464febea4db631019ae20d

SHA256
1d108159abfa7665ff95aae24b56ac1ba0bf37d1f63545a1349051276e3bdff7

SHA512
5817e25ad637203e3bf2bd452bbcfc06c77e865856e0b477ad47ec84d7a3101f9025abc00dba19d205b5e2f289e9119bbff607db8087a44d454069ba83934100

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69f2f9fc197bb64ba96dab955e66662d

SHA1
51603c4f827f625fb271858f2f3aa9931a4b5c8c

SHA256
08b14af72bd7e6927837d8bc4d9ddfc4d2b9f38f1affaf9362401a0ffb030fc9

SHA512
ee1ef524564f6b135c20a2ffa967ccfaaf09b9ae654e5b68286adbe385dd8337e3c5f80d03ece8e305cd1669f7b0349b028b7366066580d072194a311ead1c8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a669c01c4f08b43fbf714aaaf659efda

SHA1
1a626c7a732832676264654f882e4563a487ab76

SHA256
c88b6af7cb6e529ea3ec7fb9a7830a6c8b6ca2b0ccac65dcb576742fd085cbfe

SHA512
19de7e6a340d18d46d729bfed07474c384a4aca0d8e80ca87af74e93fe8c2287a731222fc4d8ae9a65b3840b6b7fbc953cd01f70bacebaff5fb87e25f59fcf17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d546f76c808033d5d9057dd8b828018b

SHA1
da4b74f68ea6e2b11fe640dd2530de70f7eba6f4

SHA256
deedd07ef4457e2fdec88af6e6ea1e28e61173d672b03df2c727b5ce8eb6061d

SHA512
6e28a2da8cdb7871597e1c69d3deeafab71ba0a39c70354189b99a1d0b8e5646779eaa20039ae037fc184cb85a63dd790deb752a11967f144aa427f735ea0b0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
408d38d1fcd2ad23627f691c5426d315

SHA1
f21d9424569aa409be0063b726628810e53fe297

SHA256
e7fecb94e8ba32074997a6b096d63c28f9a9735dc818754a6bfa72805d6f10ba

SHA512
cb5a4ecf49abe265f17fd42f4f09f602ab44d0d3c097b2fef32f4e3d173d47ddc33edeb897a28ec46352a1e5ce9af7195685b73a44760abc13eb4bbd4b57e9b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
77537ab67812d28d839e16f8696c65db

SHA1
644d970318036db68f134e1239062d6c37d6c2c0

SHA256
8a44b5c5952f91a904ada0d12efffbc0565a560311f00dfdd169fadea1075c81

SHA512
807e888f0b9d0bdf0284fbe75e95979ade57d545ef3ebd261fcbea1d5b39840d2ae1954a4732959a132267f18c7ba4182e41f738e06dafbc67d4839eacaf5bf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2474.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2486.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit