036a181c24d6b191656674db6a112a46965a1ef175c5e8f5d4469c48180aec70

Analysis

max time kernel
142s
max time network
146s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
26/08/2024, 05:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c2661a0d78f46341e97caf15047437f7_JaffaCakes118.html
Size

73KB
MD5

c2661a0d78f46341e97caf15047437f7
SHA1

f570c1573b43193c84ed7917af4744b0b49a6b22
SHA256

036a181c24d6b191656674db6a112a46965a1ef175c5e8f5d4469c48180aec70
SHA512

7dd6ac074d8e467fb9444e1fff5ceddf9b24a0661f1e4e6a3d21acfb4d35cb3fb417af2c22de0b59b4d3ff0f74a29c0a034b914d783e837bb52f50fc0e097908
SSDEEP

768:S+/gDCBgtYTSxLbDUtmP0eWyBwT9EGKf0sILp6e45tW/YFMQGxrmnuE3V43SMBcl:S+YDBIsBwT9EGKcsILp+tA9x+DGO

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{17CD4941-636F-11EF-A1CF-525C7857EE89} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000bec3ca7553b6d3642e62a8c57c8a7db56debed0cf71137272df231226aaaf4b9000000000e8000000002000020000000e8e157a258c486e185896d8846f2fea50f7999e01f26c13d7af85c089406d6ce90000000f64d204ae94549b45e88a05969026a8c2904165e4d6e37b6639d878ce2051b095c42f885db4a592b0900355d700169899e9b725964e349cf216ec64f156e5b2f45240eea88497acd7d7d32c9a66061ddc6f1379fcdb31dfb37b2d289c953c9b08e8538d76c7308f093b3b0e354c91b88aab3058f4369cd441720e1aa4f3f2d6357081954083281d3f1564a8acd2ddd0e400000004064a5c59cbefd17d73b7c52cb448213ce88c38c143f8aae6c0657496cfa42e3683d259e1629d7659d4d385f69640aabcad5b5e9a7ff1e6253c18589ec8e60a5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c92000000000200000000001066000000010000200000004bc84e5eeb88337293a46a9f75ca1eb1e24a6710f37608999a3b8e665a2656c1000000000e8000000002000020000000659af3cb780649d751584b3893abe64886dbb4cc6d6311bcd348a0617857ad912000000026a04a330c07e43b92b5a766b3d980c4acd7f4c4f7252478bc9cec5b2f50acc5400000000a5bfb94e2a8edc6b5c14ec46adc7fcea001edabbf642927f2a9bc2f3cf54e47a048f1f0d9db188d7a178a679582711c3504a0b1bb10b0ed305a43214574e105	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430813294"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50b8b7f47bf7da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3052	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3052	iexplore.exe
3052	iexplore.exe
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2064	3052	iexplore.exe	29
PID 3052 wrote to memory of 2064	3052	iexplore.exe	29
PID 3052 wrote to memory of 2064	3052	iexplore.exe	29
PID 3052 wrote to memory of 2064	3052	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c2661a0d78f46341e97caf15047437f7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3052 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22fa2bc51bceb1cd67c46e0472ff3056

SHA1
486933d79a1f64d745bb3988760ca759b4eba270

SHA256
f96ca90d6758cd26c9c6cfddc2eb6c0f78ae234f608e599b60569c5f2d7cd42f

SHA512
e88d8b7db1992b3d900359ae1708ac89408c93de7c3ed1069fefd3a0118cee804076c40e5b4b0ad013181bc5d13f78b52aec53eb0d62a0e51064403c58b07de9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd5fa743a2542a0272dc280741e126fc

SHA1
cffb7ae32d9f5f354e656bba01f8cebf6e6de399

SHA256
823b9f7aeb5899699587755ea64c3ca470b62edf2268eb4d09cc4a381d279eb0

SHA512
4b62db628b12843d9040f22c17997279665568e62734acdbe14aa110d4b414f6313ac840e5f166874e0def2cb0a1e5b3ba2f167fc6fe28bfaa98ebf3bbbf7b30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b32c39f9ca0ce65e75a87e52072d60fb

SHA1
3580c196af596c1c64bbdfe94ef5a0cab2bb8931

SHA256
aa50c8cf6aa8ee96ae8c81a27849ee163c8899024f395cf9d8863015ce4b1be1

SHA512
d49602591ae38964fa98e5c6ec2bc6d533f7ee8342c0e5f8cd6469a2293d7b8a2f5035704876bbc17c990ea4fdc9c87c3484adb8292ed9498a2b19ecab8edcff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
099cc81003d2a16ecb2f361a70df7c24

SHA1
65b0e1ae5512c2481483dbd51bc286ac9e5a29e1

SHA256
f60984cef01a769c641d3f9b0ccc09c7d0c649e02fd4e3b49c1bc55644154f07

SHA512
7f18224d10e82a7d2ade473431b5dfe6f9adc194185743fbeff7346e6423927bd89debdac5862edb453ec409b387104989d4983e56bf25ac6a7ade377a784f63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13f6aa81de28dbeea144ff07a80c20a0

SHA1
47c094caad873a7aec87be624624ad0ea0ff3c7c

SHA256
138e04f624c6bc9f9834b3b1ede557ecf60e5c1dd049a5486aa18bedf0331583

SHA512
2f673ae5bd8f335a27e39be5a1e22b3c75177e09b11138c49772697faf20ea09ef4b36fa270b8b05357cbe4242c40479090e461678b4d23031da09bfa8c9edc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41bdad6484cca826ecbb8219befa84dc

SHA1
5c87726f5cf5654e46456db5717c898c2c0b30b3

SHA256
cf48f5edbf2120a8ae9164869579a46c682de0d0f00fb40f776e50773b07a1c2

SHA512
ef155c460df0b90cff6217e6fb0aa1b2efe369b88c17fd41827847ddcd1a6ebe672d60a48d3af2d291b2ef65049dd86819283caac67837364430488afdcf1eee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
004316fcc61110adf8aceb2c192edf5e

SHA1
8fbd025f58bc8bb6c4fc631a3e0374cd268ee24f

SHA256
22d5aa9f74328b9d8987d8b60ff3af544b4dc420d73273e52ed46ff6a44f7fee

SHA512
6d3ed6ad70eafce42b11c0dd75a9e9f481c3aadda96f5838fcd73ef5ad5f88ae190350050a03ff7bf034805b0cc414741a71d35e48b6f53fc976ed17c3de8348

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a3546f0b14b94c3f2349fe501a6c6db

SHA1
93df406b5ddb968805e2eca783945e2ce99d480d

SHA256
fb1d6955e1c8de31a2ad04bcf1536fe592414060586fcfa250f0d1e03185185d

SHA512
65957ca21ecbc6ddddc5800511816cb619f9ee47a55102c5c07e109d9dab060efe02d2206c5cbebb4e6b2647d70ed82439ecdc57b6929f33978c946612ac141a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61c38259bcfb7d17509b4ddc94793bc2

SHA1
609233b21dc47863b5c3185e3204cc53f454290f

SHA256
8bdcf950dc3bef3b3cca7f1b5701b5aba97aec1448496ec270cbd8a81a0e592e

SHA512
4e41f07a96ede3773ba3f8a5c47fdec8fcee50913de9e91e336724ce17a4729ef2e2e7affbaee5c2543cd6e97548649bd745a4ef0c46624a5601d4e5fe8aa87b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3cc6e68a4382de37b4920d4a3d981adc

SHA1
6c6a7926cb27d44ba82ba1a2bc75f79e72f4376a

SHA256
734e42a579dc326fe7d641a972c23339d0d0d6ce1b47387feb7f0e0c4c1d866e

SHA512
8bda4a9b825cb3f4b27654727308e12f935a6e439d3ccd71ba7158f87d5e453b62f315987ee2b649b89e5c60e917e5aae387a6e34dc8b6a4f5d246c60e148921

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4958a1912488fdf1197555f8cbfa499e

SHA1
348942141f94165f8316ca0e830f014398bbc92b

SHA256
a957d312f99ed7952156cf0dc8786ea172beef273ff36045258f417ca1e47dfe

SHA512
d17fe70f8ed949d8764427a8bf87286e8d5e19cf2f0682b6f416cb3f146f5e90fc0d708a1386a0ed5b498a3ee44474d58f6fb24643457ba74e8dc62892fb19b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
215026c3829ff97e59de936a819cb9c0

SHA1
2919ea68e7bb76739d0ff6f644bfe990a9f3c3d1

SHA256
6eb8691be077bdef567befce6fb3030b3b0d2a3f6ebcd2afe450c276f6e68437

SHA512
dd211e65fed04e87f1c60c34712190a15682190fc03657281e04ba8c10b97ab1f01dac04dc98e2aec9d3d6acc248b8dba35232af24c892e507c696781e9f9b91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c957e1983cea6bdf7cbfa7b4368401d

SHA1
34700cca1465faf63dd4d558931798e466f85acb

SHA256
60f7d14cf44d675c48b829bb58bf5a943149597487d0f1dfcb6e184cf715aa74

SHA512
b67d2801d2ce8d0b7d56e48733e80accbe6954113c08bfeaa52f65e26f5e009a996e06483ad7f3637b7a8d3af73e5078dde1b89cf108cde0361388cb19b7e424

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4815f18f1c6f0435df5bd41c9e0274d6

SHA1
1f54f38c8576afd2f9cedfc0a42f4d65fdcf9f7c

SHA256
569386a96193ceb7113a6681214c179e58a9e2a608b53266cedd27f4a9893618

SHA512
c31a675cfa470230ddfd0ef93663f7b3bbf4336a4c0924ecfdd2e240119a0e4ff6ac62dd33f72ea537df86ec97ec4d3740dce5ee94e1805004704d9f44d8efe3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8e293129078e03ed77e97ee6abc443b

SHA1
3dffad13a739e21b06209d8fd3876e8fc0a396b8

SHA256
0a62c50cb1a286594d433898f229f8dc7ab0ce9c579b9ad332a7b20d984dbd05

SHA512
78686ab2231241010f0a4e5911ca5c9f8ec2bc097aad308fda4e7e92f5e557f15db903a033adbc85bae051097facfd91d1cc657b6a6aec2b90bac2d651a161bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4BC2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4BD4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit