55b73d70f7f95c7cfb13aeee98122d162ec4e94026916075b84b34f8f1e5b776

Analysis

max time kernel
134s
max time network
127s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
26/08/2024, 07:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c28a4d8b6bc88289dcc07a54a60f3ded_JaffaCakes118.html
Size

1KB
MD5

c28a4d8b6bc88289dcc07a54a60f3ded
SHA1

7ef5098cc65d698d21e8f4ec3ac2abf594120378
SHA256

55b73d70f7f95c7cfb13aeee98122d162ec4e94026916075b84b34f8f1e5b776
SHA512

8ba65d2d7c478a7bb50f41cbb98341330df7c560f7f1e56e7adf54c5203baf5fcd48e1806f002f4ad918f425a1d88f319e452ac61781e13280cec66410c75e82

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000004be7e483f83bdbade63dc66a26c660b0346e118ed7a279b6a7eb97a57ccf973f000000000e8000000002000020000000c3ff4a3e7b144986b362f4580ff64bb06d844228ef37caa419b2ab2aef746ede20000000c7f4303f1b9f964ba59ccbda4b0860816081aad0002c6c04d732197d51c66ff840000000334f445dcf653a05ed038edd292c791b250b8cb56adc01083f3ec156b23dba2fda892e4eb470ea49707bcc8e01c706b8bacb0aa62375c834961607c3fd4f1b60	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430819342"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000543c529b9cc6290f108e68e37436a0536b3ed650de6242e78add61f38df973f0000000000e800000000200002000000085eafc81f8df6d964deb27b943e61bc2b7554293045fb0c84cb9baf121aee70f90000000e73247caa095f9e6cad83e59a760eb9c14b52bdd1f98dfeb0e9723025e4eb69d134b17e86c5a1211f342685ecc8da2a825e863feb978f1daff18b29c7137fd779691c674f33f7141f7ce316cddc005e1bb04a59ac9db8b3c72c6d1af7c92f985901f193fac5914e34105c66af1e2c6284d47f97395c9a8eab4db88aced32912444678c2f7b7271d892045fd3077fd2d9400000008ac8e13e7ee194742807e4365978185f7084ff487e4387111307408f6f43ab9599322df9f2dcc66da9edc9be23002f24fc282aa362a4490668ba0a08233711f1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2CA6AFB1-637D-11EF-AB1A-5A9C960EEF88} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0770c028af7da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2932	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2932	iexplore.exe
2932	iexplore.exe
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2652	2932	iexplore.exe	31
PID 2932 wrote to memory of 2652	2932	iexplore.exe	31
PID 2932 wrote to memory of 2652	2932	iexplore.exe	31
PID 2932 wrote to memory of 2652	2932	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c28a4d8b6bc88289dcc07a54a60f3ded_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a57cb6b634953f67c513d64028dd9cf

SHA1
50ecc22a1fe1345170425726597de1870ef6f338

SHA256
8c6549fd877fcca1130f0c3410d042d1201a2247c47f458fe9afc944d76daf8b

SHA512
655943bd917ef87a8b5e4ed5eb0934016c62889e2eeeca6a0fa03fb94a603e889c7e82b3543db44331fc9f5f200f05c60224e449b044a66d65396eedb0f55917

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5e0459720031daeeeb3533608a47c8c

SHA1
e371f82df53f4f5a5b4b524afa2c429fb50ff843

SHA256
3b9032b31da3fef39cf2dfcbae6d97b1ca4262d2c2cd4f062eccde2786bd4533

SHA512
513286e0583c044519de2c76abd7ab52bf29ba70fc75272798526d8f70412c0bbdee0e45830d55b824ad3f467f212cea92d6795bcfee9bb00e6a20d87231753f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d3799fbe17c0a100b6712ffece13c9e

SHA1
2be5110784de61608e610ee265de2702d436cde1

SHA256
5950b1d1c721f18ee53de67fd9d1750fd616edaf8df59d49e83997faa55316ba

SHA512
2f0a01d6bc5b14566ea81e8ce3e2e2bcf3ce598f8fcfd0864ee8f5a528b673f61e6f6e4b53937eec7f7181496cbbb9af2cdc65611571bbc416cc37376720bfa3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d4413aecb188acda314f6a71bb9fe9d

SHA1
be4603b0bc69177db1b46e05711831715f1b5a5d

SHA256
8fa78d6b54154bc0394cefd8f73f300a3563b731ce1fe331b567d21da113b712

SHA512
7870b50e1159db6e7b77adc4257e82bcfed79bd91ab059d503a0ba83fe85c2d2b237c11e2867906455d540c40d647d09da94cb55cd6caae844a8e37ffb5bf74c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca7274cc93eaadcbdd8ebf05714c0834

SHA1
3fbe8c796efbe78038d5b0b4ba51bd589f124b97

SHA256
98a225e9eec0d8e91480b22c72554a61e8f15a72b9dbc07ac2b43f429e72a5c1

SHA512
815f38a19dd4487f995ccfd1f7f60aad116c62c3b45d9266b3e9615f3f34a2aefeeac98748e7d3219ccee68401e7afe0af18c3942c9bad1319d40a10cbc11e65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e29f7abf5d467721a02abee0a2d043bd

SHA1
f7e0aee6c5ad6171d1a79bf7a4165a1f0068ce49

SHA256
17ef208f74b54629237a2b41aa3906d593524c29cd056d855280dac2c99cfd3d

SHA512
12b275a51201a366159dd0170e319c5b46e321a448a48190c900c617927cade2bf894b3ea9a2071d5531b698ab113f190d1d38252b0fa2c726f178ad3b94b485

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5cf9cbb6e9a5404a26f2e0b48768a70

SHA1
bc26e937b1ed92bf18e31d5df935cf3c91a9c703

SHA256
19d7f7395e93ca1762fb402d322af63107f5e2d0f4173f37a5329f3b96fe584c

SHA512
67c4d71fcb61ecb35ebd1a9b3cd9a7942ca9dec633af948ab31ca0dc4fe22c0a3970e7054b27cdc804f76a82615b34236810afe69cb73d37e49c00a6d4b3cdd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c76d1d286af060da1fc48b7d8e322d43

SHA1
75fde23ad096697f287bb8f979dae9a3e2671d30

SHA256
2b3b7372a89d639902ec75c646a17cf2c851b9b1333d4cf9fba940d11488544c

SHA512
a8971f302d44a3432464b53cd1e5b6b5e8b9b6ceee1c8a4b1ce9a5c7df36e99e5dcf54e9a5e351f513adf618081e33702bb251a4b2ec43b78ca897ebf01b6757

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
217004ac93a506b03e320891f7bf6350

SHA1
9f8a73bb34a8dc4682e46038ef8ccca35e97d9a8

SHA256
97408c81b200d34a7147a6de8df7120dc83cd4adc762a9a9ddaac82a8f3bedc2

SHA512
2b6669d8bac83c491f20327cb71b9771949080b57eaa81c72c81e1227588d86010afaa1e8ae6fe67c6bf8c45bb70ab0c6f2d26186d3faaf30d2ec6da2fe59ecc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
304b3da0138016c4bfd12d92303ffdea

SHA1
99900ca26f21895fc32dfe94dd4dd9d97a4a6a10

SHA256
4a6ab543b9869966f5d282c1563e7bfcdf92746dc15b426d78e8c0fcf79a4fd6

SHA512
d1a150b26dd677ee7fb5744a6a53321194c9dbf13c43f31831808437bed9cf32daf6b89b9f64480cdeaf2073e3071797ad206f610f639a8bd1e82f4307946291

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3da1c599b2eb813c7d3a7ea451e10702

SHA1
3cbd2e7d2845ec74fcee40152dc8e545ddad3bd2

SHA256
045d7865117ef97f14c6d119ae234966c12589bad34385e8c1be92640b1bb7d4

SHA512
c89201340b5dadbac083b246641fa935eebd07a5c1f4c253bbf75b9682140464197e1db44be4742eb874c4b466db0d1c37105000ef9caabe7e0665f58d8beeca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5302b47d0842be2890970c89e8d274c6

SHA1
b635dfddbb78f8e3084a5f7b03430150527a5c46

SHA256
5df3773301787dc36491dc9518c7d0568fd5d6d6f9db6170c3778b81e940b383

SHA512
74d7d3a1c456a5e5577a94a928b79409204c0a9a2ce5d2163666c8b17eaaeb249235379b25c2d0b33a9bd5a860f034fcc2ea69414137600df5a7d62bd0ba6ed5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e59682d1340ac183de4c59eaef535999

SHA1
364eb16e377a6a63eb0ac4640329c67d9fb11eb7

SHA256
36e4cd6b1f2d9e355f4424f679f9a0c917988234385bd4d5b66785b2d20a0d12

SHA512
2b49f944e8e2fbe921125eb10a79fa6e80f229649682e88941e5c4fc850a54964c2b00cb0c1e00521439ed97a259cc4c3e20d4677d40e9320a5f67c22dd389d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf3b1e609d242a749abe3d9942c73d55

SHA1
78d64e7517c58da9e512fb3a676b98eb5fc76267

SHA256
6be1998d63cf1e0122d4c11d6ff8d68c83eccfdd85265e24a538a20788f5151b

SHA512
497cdbed2656ec6c6b9dbed6efa685865eb0260784d8f01c735f9c9251fa8ea2697aeac8506368456660d5e5ef3a4256a2147225591ca9fc695364f55189477c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f93637f453eb880fd77484bc830fd99

SHA1
fbc151257c8d5574fcee6048f4c82e0b66230a8f

SHA256
9fc25f1ffc5111efb3f9df4f4648040aa2d22ab4ff7ad165d4c84e40e1c0ea5a

SHA512
c722224d7d1108a237fa0759bac954d0870bab284f3237bb2f15f7fef04bd5e5a28f2c4be0bef3623bfced5f0ef7423ae5f6603f60baaba7daa2eb325931ae1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7CF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar833.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit