ac428b6225a9d011d82e646daef613cf23501745c26189839bb41ec1c137455c

Analysis

max time kernel
69s
max time network
134s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
28-08-2024 20:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c796ab87481f3450d273932cb2ccdf64_JaffaCakes118.html
Size

33KB
MD5

c796ab87481f3450d273932cb2ccdf64
SHA1

2a337e41171bee183a57fee42679ed0548179aa2
SHA256

ac428b6225a9d011d82e646daef613cf23501745c26189839bb41ec1c137455c
SHA512

20fea37f43664f215a104621aba9da7ba9cc3add7ff1ad5e66ab7e811439ffa04fb0ef472cbc11ede0a1ffad807fd50697af7529b2edb096cbfabdc5e108b39a
SSDEEP

768:2nZsAl+wpXljrEkKpr2Z8LcpR9h2xrNKbxDnNQ9h2xhhIbP:2nZsAlzp1PEkAr2Z8Lcph2xrNKtDnNMl

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431038635"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C03F10A1-657B-11EF-B99E-46A49AEEEEC8} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000836754e997d5baa7a7b720cd07e3189619c3e61f4778b4079c020fb89bfd1f1c000000000e80000000020000200000001e6bd81948798da68e63bfcceb4d961b668d954246d0328e8c90e5ee71ad765b2000000028053ea7a5a88186c46e1c7b877bcd5603bbf2a838970ab3531016a0ad3bad2440000000e2095a0a6e4e5530dfc2035c91c0269b8cfe4d38ffc9b5d2ce024e5d9576aaa08fe7df546ff02af4666b0361facc226cca0914a8b0633f9b9ff26aabd8d31029	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000000a35c13e749d8fc57f37066b637bc47fc20086561748b34711de6e68f2e6096a000000000e80000000020000200000006c68c8a1d1f6e2987335894dd804765f57e5cb3a10c0db0f3c5ce0e438b56525900000004a4a6603257df44c89c0fb42e32529a7a275732f963c095e15b621a0dacbcc09bc3bf4ad0e754f7942734f7c43a3652147cb815da0734e1a22511d184b1571cef0258ffca153b133844b266839fc688b80a2b2a4646640b4291a27bc4884e2b232e9f456630d149f3327c33e19079a08ba38843fa3ddbf2873ded6d33ab294519e89c8c9a6a2e848ff8a7ca9707f723240000000529ce95d6b252cf77428b2d86783e3739f149037f025242300214688f468bc2456eac24206f2656c5234d7b60c19c78b3f5d69b50a4c4d5bfe21e9a5ab4e3fad	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0f742a188f9da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
760	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
760	iexplore.exe
760	iexplore.exe
1484	IEXPLORE.EXE
1484	IEXPLORE.EXE
1484	IEXPLORE.EXE
1484	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 1484	760	iexplore.exe	29
PID 760 wrote to memory of 1484	760	iexplore.exe	29
PID 760 wrote to memory of 1484	760	iexplore.exe	29
PID 760 wrote to memory of 1484	760	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c796ab87481f3450d273932cb2ccdf64_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:760
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:760 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0f68d24a0c1be2c16837127add24608

SHA1
e724772e3ef43c6ad38ddf365f069ce418046f89

SHA256
111b909bddb2e803d762b68ad5331e43195136f33ddc334e69e0969c60cd613f

SHA512
99e63e377548b9cca1d9614936b289a1b1c1b244850a662cef97440ba0dd0eccdb91b68f83aab8ddd0339337f401b8f5ebf224473ac8b431ab982c3d7ea14407

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27bfd3627ef1f471c85cf724a8e640da

SHA1
844979c99dcfb408326fb49b9ce4c8643b628f39

SHA256
197cc3a9d168a9a70dcb586db22d3c8a86c57abe87908308d840dc4aaacc27b1

SHA512
22c2751e6036648946f719e5cc1b8596936f0412ca7e69a6d3dd70ba946cdf49d8ab1294893530235b2c544686f3393e45c358b995fa4f9dffecc77e065422c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb34151c0d824b42971557d762319a68

SHA1
40c8e58c64bf718bbabb3be68481a27c5c94926f

SHA256
16f3767bc92ccef5c717a9c25da6754aef824fa5e2b1a3d516281832106a5061

SHA512
3364697ea3fbc5ed71ac78eac8f7445b775a30d36bf9014a06119789ac7a4195a98f323c2f8f9cb1d9edf341885b9ff02e4eb910b4ff97f31753686bd6739141

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
efd232e4c03e91001dd24216d3ccd2f4

SHA1
b1b1ade7e64393819e5627acecb4c5a4793e8f1f

SHA256
52d134399dcc6cf1d1b99262192c22590ce49dd4c6fe72cb652f3c1c4ad7a91d

SHA512
208dc3e4fdec926f509633a283f2f2e932a83278fa355743d51d5501aad9800276f4e2d219415645f6a851254439afa5f5ef487b69b2ee0661aaf8b90630bf11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c9557821e72278d7c2e66dcfa179a08

SHA1
c8dee9acaf200b1aa5c3b2ba721d4149b1789873

SHA256
192540e62844f90a58b42e3cd971c3bb953957b5c5d2bb843b8e74626e1b2984

SHA512
3056e929a40a7d5d27a85b32cb8461308163de49a5a37cddda99afbe020dce80670ed1809ba2bf758ae804c056510410aafdbdb0a87467e29381bf0d24947bc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0027e90b72400b3eb83ff080ac7da769

SHA1
199e16fc8cce2ba06e2cb86a7f375e8415283c70

SHA256
b5b4f1b57a9afa9507c6bc2fedb836a7c82af907ed17173380103d57da046637

SHA512
a2524c2c757fc84bd3f332ae2d5c01c1b63d0983e1cba4d163b632b122abbc20156d2995a5c8b9a1742c0e4ac7f6d4a835128a006f35c10f59075404ac5af82d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff693aa7172a5369f794d844d4f76751

SHA1
a577163ce15044d4c3010ec6cf21063e80d7436d

SHA256
0ce381af207d05912414a9ed35423ecd1a5bfc7275c41739a835ce27858e1c9e

SHA512
35f6ce216bd88557e8171b5c4efb5d8b3090e4f3d0b794ca95db36f9a12df3d2a12861242ad29f2752a5d007fb03dbb0ba0f0b23c9fdb4040b0df3d1b4fdb933

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3535ce18f7087436be6d05a9fcbb3329

SHA1
1656471f04f4b5903437bd6fc0d1655b7dc29804

SHA256
819f3845f8b12b92e3f56cb7f982c4aa3b46a5ab9f6ebc1506d6b1d77aa8737b

SHA512
20ae846cc5e2746a6a59359e25a23a9388b62db8b247b3b4a263f60fdcd9eff91b4445f5ff19b31053d2d5702789b925e395c5eb49dc41ce519cca0ee352b300

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17acf999db6e3793e0f9a124699f1079

SHA1
de6522409413c249f5d597cdf2a720d42c6c81df

SHA256
38a0b6c5b76501dd382adc95f83dfeb732743d19349e1e1be273cac748d08dcf

SHA512
cd42b2da1e52b8ccabaf74f7b922547c1529fe3c1a11ce795fcb1da97360a581b17c066a019a61d0f7bd27778792a585c1e92e021fc6420d0a30c0cba16df7cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44a8f1a23c89611570ff0508add50ea6

SHA1
c72625e5224aea30fc2fbdd7edd23b229f9962ed

SHA256
a088cfbe4fc8bad79b623b63b2c720fbc72f796e55479a8092adc7e3eef50bcb

SHA512
147b7585e81406b56f1a6fef5f71e916cc666f00384d4be7eab6ac8d7bd9cd9a940f065722fa15e7a1960a42d63df15da9a5b59bba35bd17fb14ab00825a6867

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb72edf19fe3e75168bf52d58d8148de

SHA1
c1bfd5fec56481de6a1b0f80d1058dc844fbb905

SHA256
195ee378737b3aaa4706315b346fdf2445111ad4f13615248c170ad78db50896

SHA512
68b3202bbd02babaed8b7fa721191793c1626138f6675449b4a76ebf1aee837c22b186aecc5cebf68e1e8802efa4d2a5cbcd68aec2d06566bf0226b80c58f798

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a51988b3f88784ff24a126ca75f22e9

SHA1
bb58a781eeb05c162615ff51f55303def91b4fa4

SHA256
61927683ec23e153e4e014dc8c9df2aacb253338aa29d530b4c77075542ebb15

SHA512
e12e096e5033ff8dfd7898becbe24c66ef4430c079984cb1f358c4771ae8f208985b038ae4e5486f388698a79135e8669e0b3568caabdf4ce0e392e06e441400

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8aceebb391f53e8fb803dd46c1ee163c

SHA1
cbf5e3dc375f2cd98ad183f3c9914d24d77585bb

SHA256
bd94ea6df6214ecd04af15dbee0df7e96c4cdfd230ecf72ec4e3703ca7a4cb34

SHA512
f40365179e37195e728db2d6f414eb356e423e7dc022b3d58717964fe497f66cb9138385bb64ee383fbe4df86240d4e4701316edb2665b603fdfcb5a7402ff8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5277fa048b43869988cece3cfbaba165

SHA1
6bda42162fc6b8871c510bd6f369ddc3090be1b3

SHA256
c0c419b6b3694d37af9d5cb63b8d8ff99d140ed40ec34ba34bb60be0888e6fdc

SHA512
3e6b519fa0dc6e611a636df327f24f721615412696d5ef64d0ecaf11088f7a825aac42a2cf57375edd84b2e611f3539aeba2f652223483cbd8ea16633083ee50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd71d11d2dc658e9fa9a2af4abfa11db

SHA1
a305e7d3bec6265e06e1506b18f41c120570b545

SHA256
c2c35db4aa5950889c504b9001e86fe81f4c054fdb99f889bb0ac459dc1344aa

SHA512
3e88e721f6e5382fdc2e3be2fa1880a27df5619f76f4fc4838972e2432be771d1e3c0a4f39f9f34202ff56a8fbee315bf86e9fe01f5d3619a055fb6f53371035

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89d2520ef50fd350bacd59b6622c4b95

SHA1
ddcbc05a797de99ea8c269bec02656c2853ddd4a

SHA256
1ada2edf17704158ead99065a1752f1993865d5dd4693d26f4ec19ff8a9c933f

SHA512
ee6615d45356cbcb9c1c9296b1f4c9d806acc5a4287ba3f473e424df6bd91ad163ffd3a102dfd358dffc8c506d594c89c0a841afacc0b77a48ad86929a507f5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab89EB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8A3C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit