56494cf48dcf84cb1086ceeaa0c353bce78277c98de9bf13b0a162095065166d

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/08/2024, 07:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c285be622d96ed0b1f9c28da79f67e68_JaffaCakes118.html
Size

5KB
MD5

c285be622d96ed0b1f9c28da79f67e68
SHA1

1808054e0fe837ae8285440ee0b35fa7988e4159
SHA256

56494cf48dcf84cb1086ceeaa0c353bce78277c98de9bf13b0a162095065166d
SHA512

3e18af36ad051f7c60936f49b0c64f2f2d47e4ed0c53a3814f59b30b85a83628a6168201a8bf4f8a0b25eaf764651745ba0302aad7749f80a4e46bc3036f635b
SSDEEP

96:vJ96XMIZ0xjNwL4uJSjFTpCguJFgi8Ad5+BjcVer5okLN1BaOltmSn17srlW+Kgx:v36XMW0xw4YaTpClgiuBfdfgOl1OHsDw

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430818597"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000f06d4038200a8e7a858edcaeac70379ac62a8728eeba2de57e3120006ed3fb9b000000000e80000000020000200000001e028b066a7e974f1e7f56f742d92310954b135032dafc9cc81b2cb20fec5e0190000000793cc40660c58f3fbde23d37a04de8e5b1256c2bc74982949a6b8b8a9fecb87b4b52b2dfab67a3df83c1410e22a89d85884d53065479bc8b976b35fa1045c233ee0f5fb73cd20f3e3314ac0dd83df758592e8665b9f6f45ee9b00d2d6d26123479b46520b0b89b9d1f85260be56129573e65da1b4d2ae3e28ec87fc3aa457bbc218b3d32909ed40265c0780ea1317b6d4000000016968fc8dd98a6ac13e28e18b6c3faf99194a3a13b010154cbd8b32a427fdd868a17adbe1ad7a17dac6a254bdcbb6778d110e7e108128dee3c39e108cb4ea018	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{70A0C3B1-637B-11EF-988C-4E66A3E0FBF8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00ba6e4888f7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000003e9af9ae79b02e7a0c06eb1281f1b312a3b259cd4857aa5303c9fe09c1b5d629000000000e8000000002000020000000c6389d1bd7e8b36f545cd51761b86830e629d8d38a2c74bab41a8d876669569520000000b1ea181055cbd87fb7c5dd9b2ee3fabd8936dac05e94c0378181f967f2d9f852400000003f12f80d6056b9782343ae1f9e6a79280d25079ac5fded5ec88970054b6b476e200fce6c5c668f12a79a8ff8e2c3f55ce4add34973f88fb705bd0a18c486a62e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1908	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1908	iexplore.exe
1908	iexplore.exe
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2688	1908	iexplore.exe	30
PID 1908 wrote to memory of 2688	1908	iexplore.exe	30
PID 1908 wrote to memory of 2688	1908	iexplore.exe	30
PID 1908 wrote to memory of 2688	1908	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c285be622d96ed0b1f9c28da79f67e68_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1908 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d0320168991520e811fcddbb771c64f

SHA1
256152328042efcfb190f6dd16ee00b75f09f3a1

SHA256
75f1c1847ac4d6f53cfc318e24111215e35cf32de2fa9485b7ca770fd427e461

SHA512
02b8422ba14a00beacb9b7c76d636cbb5524d319faeac41992731a689c6e38efb7132d62bfdcc79b7d53907a1b8087da0106d4515f6139ec26e231ef1fa646ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eae94430524add432db9b82f6956096e

SHA1
236d224f12f56d3a77551539cf413edc3dbed534

SHA256
0a3fbde4e61e3323a90c1a2ba0b488836e6618bcb6b84da4f3ca15ee60c7bfba

SHA512
4e04c84d1bc0657d12f72d6c98388b224694220b5effb258431bd5a441dc88ace60c49e2ce2f8468097fdc6ebc6c26c827209597afc65399634c27434715728a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ccb4536287b3cb182786f387236bb4da

SHA1
c07a7af1400c52c81018870eb11bca1fa108a23a

SHA256
0b810f2f0c42f75093865328b916b27dff590f34a54c6a794b493b192809d724

SHA512
93111e0d24463f5cb6908bebf4ddd79fd7e1ddf06e48147e27bcaaf0fe52e142cd4e9dabd926e940f6ed59342d55504992951a186a5e2f72e9f069aaed19eeb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
baad9890845991a3e159d1088cb84875

SHA1
663ac071c7a86f05f0e1256c611d5f02f3732573

SHA256
767de5622f9f55dcb61b128981884470373f9f9008ce85fc67ff3abdbc979e25

SHA512
4cd9d4db78ad0ede57e6b493c32d989ce35f36f1404d448b80bfd55c0cd0ad35efb77b6d7670ef27fc33af326d63a7cc3627a5e243c07eb3a933037993a214b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3addd08ee9bba71a2aa84ba4e5ff4c9f

SHA1
7cc39aaa1f4f5577012926c262bc0b8419619226

SHA256
a23a41fd0589c370e75358e4dc28ea376fc09fb6e26b3c1f7b93d2705a3c303c

SHA512
fb4452be79ed90b05b4c26f06eb60f955f3ae8e5c736f96b4b46cae7acbd19e6fbc7df3c75edf8a4360da2c8cea5df1ed66d853b351eb89deb41a1ba9a4e2c14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f20ba93f1cef8e08ca1d68cc70159f70

SHA1
16085d7f4f963ddebf72a85ee58563a0fa7c1bae

SHA256
7a23d900d3d1edbc881f1d4d328f99ecadf9d8baaf1a3dafd11be4c2be146225

SHA512
7ee94310d56f69a4f66c2201feb78118566df39f5f38cda1b0b2a8a718364c8e9f1b3a98e077c80fb0bc7d7df71b71f67323c36191f76005dc5240ac22fd542a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20b2f46db825c2a6eaecb101348d1b5c

SHA1
3705492396082526fcdfe15cd2d32f9626385fa6

SHA256
bf79b88edb7c8970d32581396cd933ae2dd02122c14e34fc7e22a05b6f5f1fb7

SHA512
953b8a1b99dbb7ad8f95c5e666a70315058be605fa4f9692f426aa5a0efa3b3444c0424751304c846f3b6439e2e962f6c89c04823124c3ce2dc0acc1dd54562b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36256c6528190d47d71592699e0ba893

SHA1
d1530d1e65cde021d369870842ae1bef050c3e96

SHA256
853cf9b5cb696845e8ff47c7090c74fbf045f2fca32ae465eb71016ed4649d87

SHA512
626e67ccc546f86d713f1e2903d368e80e8b84b892a729aaf1f7e38d1ab90c287dee8e5796b7c37261e5e8891f800928bef68cf23b1c3aee9c4294095c274926

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88f3a39d472a0053ade6f5adad2df809

SHA1
294a761b11392211e02d6b41a66690b1bd218451

SHA256
82bab3461d89e07513a314d1f52191b8ffde7a98470103d6c0901e4ee03ec79c

SHA512
ac5e0b65ee9505bc738c37301965894bb54bf78a20aee24e8087a1a7acd0f3e3e0e3761d76aa241329c2cc88aeaf87f8f1a3d8cafb166bba189d6882ca6d419d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d325b17f0153399c603629e957d9519

SHA1
719ea4aea886b147e389b477ac03d062ae16aba0

SHA256
f055dfdb777233097f08e6f16df9d5e55902bec2c7a81e4f80a4c6652d4b795e

SHA512
9adaa099da8cdfaf1e586fbdd496e4331342ac42eea297849456de20b51b3eeb7b1ebf0c82b83d81db233078822312057750d0f737a56035da2440e565a044ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f04a4322279c162548f741f79973865

SHA1
192aa16cc1b4fd8c9d7427ed8f748904b997275d

SHA256
ec9b6dca9653e51ee96a47de5a2eee68644204793f7018d87819cb0981796e04

SHA512
9239c1cf70693db1846782b1c1d68f61ab00cbcc03a0aba87eecfefead76661fbd19959a34d0593b69dd4bd6905ae21512dc330cc5769f09c335ab282e8727cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab322B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3E5E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit