4997d9e7e3804bb9345ce91b6426500c43b042f1a607bc94d9234053cc6679b5

Analysis

max time kernel
118s
max time network
133s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
28/08/2024, 21:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7b775bfd807a370c20494db37da08df_JaffaCakes118.html
Size

6KB
MD5

c7b775bfd807a370c20494db37da08df
SHA1

63794434d1346657b8a42bf5e28d3ed70f92b2f1
SHA256

4997d9e7e3804bb9345ce91b6426500c43b042f1a607bc94d9234053cc6679b5
SHA512

7667bb801d19c8d6f609850b78bdb4869b68997a41f0b170743406926c1604e961dd0ae0dd7ee043c39e3e2f31c208c1b41de8fc6f5e0181ff2ca1b7e1a5ebc2
SSDEEP

192:SUVkfvog8ZH7NH/E5nM1sbGrokz3Cbn1hsDQagjqcUW/Jq:HVWvog8ZH7NH/kW381Taght4

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000858afef629606000e821ca7636eb15d18a29ba219d371943a44f8e9701a0fefb000000000e80000000020000200000001f7e8422a60360146644bf13f2ef819594091170483f99e7baf240e0aa4ba7c1900000003276220fbc20c565fd015e3adaa0c6b1aa860ad636dcdb8266f0a2e153342133d77c79360cbc097008766a8ed17ff9e5f04cf6a1a45300032c8e4e88e37424b499b1fa20c4bc2bb037e3f2c596d1d778c3bb6538e1b68e569f4c52f5d78496b3c0711d2c2db4dcbcdef9b87897eedeed727b52d30bc763dd9e4a562672ecdc723a0583f29ee6bb31d538cad12494014c400000006e03b3becb9b8650d4b9128e13796005152963ea4029d6b748f98fb6650bc487f6fac4d703b886ff212e5813680beb563557440b8d321c323d1b160cc5f2ba7a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000ba161fd27a01ba57509e6a369b1e92dbfef18124b37fe53c5e7eb7ed5ec5f4bb000000000e8000000002000020000000aa4a464317aa48007d3aea16658274cade392631de975c79b884c92f54871c7720000000a7b7b9b55f6a85460061b6baeab011d28e023c482812271194d1e9cd606ab0634000000083d9e4f2db52d87907940dab86b7f59c38a083482e3e16c003b88a19fd5fc9f7e9c53e2d343e8d79d196e7c0363f615c5d0b99b51566654ae6ad23caf40a5fe6	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431044071"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8076123b95f9da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{669437D1-6588-11EF-971E-EA452A02DA21} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2444	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2444	iexplore.exe
2444	iexplore.exe
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2516	2444	iexplore.exe	30
PID 2444 wrote to memory of 2516	2444	iexplore.exe	30
PID 2444 wrote to memory of 2516	2444	iexplore.exe	30
PID 2444 wrote to memory of 2516	2444	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c7b775bfd807a370c20494db37da08df_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2444 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ce072a009e285bf00ad95d9f2d6dbdf

SHA1
dec00fa6e63960ddae5b294c93c8c89f7d97d0fc

SHA256
b4fce7bafde55515d17a8ce54216336999eda1bf18b963fbec8a861e59e6acd9

SHA512
569532d8698533164b51d6b4eb92fac47584932cd79317e81f67a34f3fd28124b8765066b57486fb324f7ab86594595e5753e0c30a2ef256ce52361d1ea0c2b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bbe3b2fe2ed5c0047eceaba3e0e10af

SHA1
f98498ce790914cc70d67022a640613582db1be2

SHA256
334f34f6ce48295b25a37900218faea1cdf3e14c29d51ee174ffbdf98726f3c8

SHA512
9d89d10e8029d5a433090084592b87631f690a3f0f28ddde4277cbac714bdb95e59b850d3ad230da1ef262f6c62cc353d020618d34a413b3f18b6ec899feaf76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
121a3b329a72fccf006637f460bb211b

SHA1
129cfe7f9810941ffb2d781b3ca93a5af8a58dec

SHA256
f254666dc36a3a65e68f1b632f620f76904c540aa975227ab5601ce6fb3e1bac

SHA512
c010106ec983d5429ac7799c3a673e7a8053e87a9b97546596836e0cf88f10c66a7a72c6809563374a1baf3bb088a2f6a05d804aaa7c4203b34ab7028fb1aa3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6851904d9c128442593a244fb1e35ec

SHA1
14f50a406f3287a391de3b440b25593de5b6aab1

SHA256
625ff1f1495d09ab6fe913ca02c4d8f649a44219f74ea7acec82c0e8083f0177

SHA512
5a58ca8e46d7efb534e6ff09098b5fd74cd326cca1c0dc6bbb116b2c2a031c2b9c7d8b32dd8df513a2fcb001ed818dec83769640814225e288a82eec59f1d506

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6c58548abe343908e85bcf21411c2af

SHA1
7cec26b665270b04867d438e1155bed553dd3243

SHA256
973e6e1bd1078369085ff14b0ba8f80bf205c78aaf0aae42c0abbcc80eca804c

SHA512
2a839ce25741d78a97cf7c0bee7d3a266e1e983d071e60b134ca04d3e97f0ae4af6a34016717d63f71d780abd9da152da42bc18eda35dbcfc6febbc6966e2baf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9158725f6a9027124a740cafdf318be9

SHA1
0bf6ac8c2697b286aad5464f7836edcf98aa8ebc

SHA256
a3de8d16e73cf0a37b85e2bcc06c046f6dcc7a538e6257daef1061944ec50f80

SHA512
d2cacf0d01e664798c6fc3c618c0a683876c35f0eb78db6dd5bbfab287cf545aa3f56d029c1f0642b168f2bbb458da15d526267036433b4a15a13af335ea3319

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2185aa1ef24c492f33008393fa0a5ac

SHA1
065a8e327273a665c6b8fcb16dba7ad102d2a9e8

SHA256
9aca556ea39fb52e4664ef68637f761440b00dc784ff2d3b034153cc423b82f3

SHA512
891826f569bf2c6bda775a9cae17012add1939313d5fe431e46796cba0e62090ce0479613129652433407709ea464880203d2c7c3ce124ecb72e3183c61770f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47338000c0cfaa91306ca3efff6177be

SHA1
94aa2d8590526ab9cecd9146193230e92837b77b

SHA256
29fd140edb422d06db54898e1490ae5214ce408321f88b5563a68ab6c90fa0ff

SHA512
05c07eed20c8e7ff8f103600ff8d846469deb33fc33c8ba913252caa525baec514e226aa1f91f5c0d1c85d4637b5264cb9e74f7ff5cb13de48071ccb07076468

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2ed8779656eae20e0a1d30f2889597a

SHA1
9128859cda05b3aa54c4a9c4b57315630fbd42c6

SHA256
f9300812f50cb2456298d0ebfe7cadb38de91b5e461cc04bb8a2c2a757ac99c6

SHA512
6add2f7c0e9243a751e879cb0d6e6265d28c2696546c4dd0ed2d39304296c7c5aa7839a59840951fc094ed11ba15cf06f90527f3f975bbaaeceff143aa4722d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0efcf7346bcdf93d0531442512f47d01

SHA1
082ca809e81b709566c839256c77e14a6183930b

SHA256
41eca0a07beeee35d1381e8f2dce3368320232b9219f7dc37cb8361cb9d4941e

SHA512
bae57552e3a1abd0f57d9c525da1d6e8c54d131ee8578cd8d683173abaf5d2449245270ea669d565c35fa784468a37974e5a3601b2383e64b8bdefec20c37871

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC9A8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD53F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit