c6718988c821cc4c9e2a91ba9e9bf861bbb2ce58eebbd08ddaca346a0569ba2a

Analysis

max time kernel
117s
max time network
132s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
28-08-2024 19:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7843e00e3f3f2baf703b0268b6c49f8_JaffaCakes118.html
Size

461KB
MD5

c7843e00e3f3f2baf703b0268b6c49f8
SHA1

ece0cfd8d3d91af3c0d8320bdec3bb1dca837df6
SHA256

c6718988c821cc4c9e2a91ba9e9bf861bbb2ce58eebbd08ddaca346a0569ba2a
SHA512

2b20ddb66c0909d262c4b7e1f01fb667ecdf8d723ea6722b4fa47518b7123f1ca28f6f94948f7cfc110dcaf4c49a6860f6c5f971cb5f7174f552de4cabe39203
SSDEEP

6144:SdsMYod+X3oI+YRsMYod+X3oI+YysMYod+X3oI+YLsMYod+X3oI+YQ:o5d+X3v5d+X3m5d+X315d+X3+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0331da681f9da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000d7e499eb8c745fed2c9416b1233cd2a3d85e0a7bdcaba1714fdd7fb0bb9c5b7b000000000e8000000002000020000000cf895460fdb742912db5a77db10d3f905ee52e09c342a79d9ba62eb994f2200b200000004b4dab1acbfacbaa21da18502ead2d1a3c770062c35a9f968d79ce92d1893ca040000000fe5c2f3c2e4807d3295cc19f75ffd327570225f1e5d902251ba0cb8c17f8e22c1d6cb2e735764c16fedad4b44e17f8c188c1d950f42965bb95da02abc978259d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000c475d7d412f80c7ed826257d2767705ac7fe57062de1ba346085744c80cdbcaa000000000e80000000020000200000004e73b694435d80a53a27937f9f75892b2102f80c7c783508d7c4d7741030ad49900000000ab8948159926ead5a6f7a5594e9a89d50516cd6cffc521e36b6c86e6214e2c5c20d0a17d76ffc16e5b422f056958eec607296b19fcb380c7486706e074a0fa68b902787085f9f40d3fd9595c92223e50104cb12713518d2e68b91570797864bcffce82c1abb442e9f3923dfc580cc4c8da870290993d908c7dc5bebfadfb57a1b208645a15137fb81831af8c533529040000000594b81f857ff95e9be9e46df69947470c712de082e01efb669b17aee92ecccee304e73c7fd56c9ff4ed845c92cb2ccdd70f404f04691f7af825d3a62820c2245	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431035654"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CDAA4AE1-6574-11EF-96E9-6E739D7B0BBB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3044	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3044	iexplore.exe
3044	iexplore.exe
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2816	3044	iexplore.exe	30
PID 3044 wrote to memory of 2816	3044	iexplore.exe	30
PID 3044 wrote to memory of 2816	3044	iexplore.exe	30
PID 3044 wrote to memory of 2816	3044	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c7843e00e3f3f2baf703b0268b6c49f8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3044 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c33e962d8e196b3fe9d63ff3fa9757e

SHA1
3a3e98c83613beb3adee7bddc873fa1e842250fd

SHA256
896888ddfff02af1029361eb0b06d1261876a78316c597d62efc9762832c5c22

SHA512
927e8a3ea2d8867f01ed41804d54abb61086dbc27ad39f89cf47943d11ecd2ddaefd2481aa5f3f5085d851078fd9a51869de964a2397f08f4150bd00a5ec6d09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e49461f6595d7d0b14a0c32752cd89c

SHA1
0be7602a0edd10d417726ff8084680892ac13230

SHA256
e29f09db317c73386e72c57e59e4ad873133add26861b483db856827377dde05

SHA512
adb7eff8436fc8d58a40123612c08e049558051adbc10cbaf60c5eee4bfd0bd7a0d5d4a2ab3e201b36997dfc5daa716f759165de5130e63bf176fd971185c5cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae5cfe4ba3248d9a7d162ae8b22e3c6c

SHA1
b06b51bc6fe32bff159be7116502da944c56f6b4

SHA256
8c215a6fb7376528f130acf818080ca0ade44983c41def806c7b05cfe17bfadf

SHA512
79df0972736599ba7f7358daab0f72ce8709263c3d890b15248747f2e2518b9a34e801cd286a9cf1955fd558daed45808a6c202027dbcc68699d718f8bf792fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83727257886c800bc97069e0a2cfb2c6

SHA1
dccd668c6a67e62851ad28dd6d5d466052c74a79

SHA256
807fb22cb14504b6529e68a255bb7149c88dc4612e75454d92967a0a216533be

SHA512
85a33002cf694cc9bdfd7d2ef7c9be69a896721b2a936e15bac701e0a95c5ba969911daa623e9f46b19aeb1225dbdc09abf62e78266817983af3f124f4e92b7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f76e789bafb99e1361b3928f3db0f6f9

SHA1
e0131e85f1217199b71ce5e07054d54622c660ed

SHA256
89e595b537acf213d56a7815f15f0392db7560e3d4f02c7c21b800d3263d554e

SHA512
fedf25cb5eb7a4d5ccf3dbfc0292131b524ab0f075432043fca3ef6f5c5471acdebce71ae8de309a0927a236334c78fa1d5514c5a13344ab4a10bd780ebf91e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1dbe0781ad1782820815f2d54f8a6ba

SHA1
024b7bd18230a01453acee0420945530a2672eb0

SHA256
c9aa8a157ca4fd0b531ce75705e851d7cafc1aa676ac6eb10363f03f6c21e8a0

SHA512
3414087c444ab5088755d745a299579d6463291d0f7c711f74a59246aa2930204ca224bf07269ec575a6b9d9034c5afa06f4be970939defb6349131a9ab33128

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03031fac6e218cdf71f5918fbf5da341

SHA1
950b205a293822dcfc0070e922ce93e2f8bd1591

SHA256
deb217efc28d9892c16bbbbfb73551b8e0f27c5720b0697d5f46b2ebf3e48af7

SHA512
bfdd1c96efbb2bdd820f0f8457ef6398bfd8bdd00543d0e684ba2d5d2e500af44cd8c2e337f1a4513fd1dcf7cbf1f4c64be9ead657b2ba3e2a37cd50fdb7996b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb8378561fd13d97d855d5f54a272955

SHA1
2f05de8651f1100b41b454d8c74b349dc6477815

SHA256
1aa89facad2aca287be641570531614f6eae12a74d21902a4e3ee175a086cd26

SHA512
b6b33ccf53b966224ed8ff3c5cab47778f50660db77a3bedc6309d354c8a2c272f397ffd18dbbd178dc1aabad9bf8d6b6f98c7cc5fcb15f6d399ec792ee765ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7cfd4f546e79cdbdc86a260164f7761b

SHA1
11089801177b5bbb38be4362986a5e67282627db

SHA256
9cbf1cbc7f831690e8517b62bd4f3f1a643059ed9717b4e48783fab37f72e2d1

SHA512
9a1802ddaf73ae4fed3db35ac0a507f698d0677c0cc29ca8ae5e5a604d4150507f6cc842f4531aae5bd627bddf4ac7caedbe5c02bfcebba3facb4a9bc9181b8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cfca7ca4b2ee2831c77289011e2e2474

SHA1
2073a9a75fc4c3751a91947fbf4a7845c5dfeafa

SHA256
23549f0d5bc512f7ae61bfac73ad1aa00176a6bb4f332fb7f0d311207fe7fc71

SHA512
72ecab5328e07b20067747fc3a3381e76e9bfc6dcc3fc2726e3809d894c88a440617a6026a360a0392b3dcc37f5ebbbaad3df15fdc3645fd5eba31cc90d36dd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96c32f47a1503227b3d1667d9537f04d

SHA1
b6b2eb89aa9fa9f28cd2ad088e21d595e7ab9c2c

SHA256
c073f45bcd52bac56d72ecb9b4271e5707d599988035a074b4773249ef00852c

SHA512
ea668f663e59ef0836b6e47a2b84f11f9be1f4a6af14a41fbd8cb97f2eee5a79c5860c1444ffd7aa40fa06b28108fab12411e7b9c646fb822a34509d531ad08d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
087adf3a7463daf12d7a23a4d5207f98

SHA1
79276601d6fb2a0d4777c4783054b1f29af123a2

SHA256
8f9f1d7ed8645dfc3ec84f66118140ceaf9474078c2c6feb2edab27e60e7bf2d

SHA512
e26f3676565eb2129a9c53e1c570d53cfdd0aadd9f8166801f1e521a62e36e0581b0179d12adc7125c39b7d4383b0a5bd866f2233baeea540a6ef1792afd1318

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9794ef21be574875c6e8655241a1660

SHA1
34be5224a9c12540dcbf2e8f3553b52077d5a2fb

SHA256
c7e3e81b35b7f6622e46d08004e682c240de7bca17d4fa5131bf925d0539d354

SHA512
4fcb2914587b05647ec499a06586322d4c98ada2ae59813a6135ce95ac6e62cb43f90a7dcbdc42ea3f2316bb777c3443378239d5e3520ae8f65551fba8029c4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebff97db77614c51decccf3010fae90e

SHA1
14fd76a59fa0d602588a7b2e3fd8031e0054288a

SHA256
55fc1b96af30c1e755994913d39dee20cf836eb85dc70ad097fd6fde754a6ac3

SHA512
ec610c44edac326a4a7eaed89ca4664d2c63725c065ec39ee756997ba235a9fac589cf6df793fec3fe2eccee7c667c183c1397dadeb946a79bdf69c7347dc86c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ac24f9e986040953028effa728073e6

SHA1
565611cf881493c1eec68047cc036e7d496b4c8f

SHA256
9ffe17578e745a3843f884a18050a8e4014a9260aa3fcecab5f30912b6ad9084

SHA512
d7669ce14f66a048fb6f06be1702079fa25ad18c13bddb595286873315da741836e4e942db61449df015182168a2f6c0873bad6d634b88279fa90a75218e6307

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAAE2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAB44.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit