b9d1afd268c7e764a982892939aeb1f24353a328ebed7b0194ec55a1aa4fe676

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
28/08/2024, 21:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7a90b040c46020e133a603d1cee1150_JaffaCakes118.html
Size

44KB
MD5

c7a90b040c46020e133a603d1cee1150
SHA1

e5a37d22fd55c2129501dcd4be0a1a2716417f6a
SHA256

b9d1afd268c7e764a982892939aeb1f24353a328ebed7b0194ec55a1aa4fe676
SHA512

f6403489ef77799a455637f4fb619abd11e94a97310ee5bcc32ee356a0c54ab8b0feb8bff264308aa61b8e1d4607b9b0f3f0bfc695422a70d75ad7584766b521
SSDEEP

384:4uhrnVB8USVVWxODbZTmvVF6lbEOE763Ib6Rija/8Yw0bDvVQ0dJSrQShDs+skgN:RroLEWhCn50vv1Ji8kz5CFUmBjkJYh

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{26323081-6582-11EF-9403-6ED7993C8D5B} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000002eb3cbb0187fa0b8ef2d918765fce3febd8ebc46a65c4ac794cbb32c132b3fb2000000000e80000000020000200000006c8ffd7e2ed091314e41a5a709cdb825fef54757d4117992f9dfcfbd7b857f4890000000608da905880280ac6fe9e7e224743fd06595dd904af13c21bc26f639440a7e007c6ee447e25fceea798d96c567e82b30de16a0e2f25baae6b0130277295cefd7a6e2f75f45556398f411b2880f59e23f633c6681b674bbb4f932c639b6d3d97427ae057b14ed818f28aaf4f90b69c83b7fcc8789a5d2425c3e65fd6b080f01fd1d569c3294daeb942f0778194312caaa400000003ab8b834e59fd36836d8802763699efd3451e432538e6c110d38f31f5c6e07122e7bc212fbf2bb6d4b8eb3edf1ffa2779f2ddea2ec3a95c6416e890995e56f4c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431041381"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f0000000002000000000010660000000100002000000036115b324439f5ef8981840c79f38d61995afa9b40021c73eeb3b0e34d32463e000000000e8000000002000020000000a806e497c065b5962b5f52b30248b55f61dcd3c48326455810ae532433f54cdc20000000083f208d952eec4f809ec6f0ff01555109ab5f902e7bf3003d967b949150087f400000002aa6adfdf4ed0c16c177bebff68dc3f098d65142706638f1c0c6c74fce09460b1cd60685482eae07ce295383c2805b284484d52814d8f281e2c390a62f09d326	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4043a9fa8ef9da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2384	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2384	iexplore.exe
2384	iexplore.exe
568	IEXPLORE.EXE
568	IEXPLORE.EXE
568	IEXPLORE.EXE
568	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 568	2384	iexplore.exe	30
PID 2384 wrote to memory of 568	2384	iexplore.exe	30
PID 2384 wrote to memory of 568	2384	iexplore.exe	30
PID 2384 wrote to memory of 568	2384	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c7a90b040c46020e133a603d1cee1150_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2384 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5697988350a43c54e5885e5753f7f6e

SHA1
c0653f50c721979e96e50ea28f7b7179c5772f78

SHA256
3b8b8e0de94055502ee8988d9eae2aa95802e717c24adb480e896ddfcb3cb186

SHA512
3aa7a68f49437b3a04c1a2759f7860333d1650fe0a13969c7d7fcec02c1b82fdac24c8b86a228acb855b51ffad5486d2e05e19571c3dffeb7bdfe3c88eabcbe8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5f6c83fabafbc9f9ca46c7ea345ab10

SHA1
20ee9115f01e6f117c87b95c2ecaf2fda134e88c

SHA256
0b7f4defb461ab6d13424611fdd3f60cd56c525349c084e9ff49f1ff748088db

SHA512
e4747b152cb9c35f3222385f551d3ab10fc6fa5d4fa51c702b3d5b7024238d477611e8f87c7760bd51a65155f08b1744bae1576c7865976b0113b8120d2b4976

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd0bb1cd617e703731689c810aee0b06

SHA1
56da0c12a1024db5a7a05ecf2d6ce44884deac77

SHA256
7b4699ccabdf742b0e13e5e2e55115343b01c798f8e85136ddf9403efd321509

SHA512
35b890336095185cc6b4fa7383fb4e09a6bbf910d0befbcaa4f7c682324c2dfdcf81468788c38479a38d5f929459d0c1bca1864767b24b8d9b254b0356378baf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35937eb955d96e3d1c44f8430db93d39

SHA1
698eb2d9f11cd252775e8cbe19de56a3c030b51c

SHA256
176fc1c94d15884aedd5ea81d6b5d15d7fd4e3d53da6d2a6c6587c5857fc9646

SHA512
592d6dfdc2479e11c3272ab52ae2501b190d2e625b85aa97a067bfc5ee098a4fb4a08794edb3698d4f6b3bb0d6b6e51f8119ef9bf47b9e25f7cefeefedd29790

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86c550453d072d03f9a0700cfa5ef4af

SHA1
e3b8d915dbeda0a131ee9cc9dec54c4b7bd4704e

SHA256
8c96d179d46501d4dbaeacbf6a20e98855694e00af1968360ad4f3bb047e5452

SHA512
2e0644035fea08579867b720407c527b61efd61f109e99f395dacb7696479c24bccbcd8bb5813be0794c5fc63703a7da54377ebc3bb071f7b2e40e714ea14b7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03effbdb5449df33b7684dc0a342466b

SHA1
e905d51b635c673a56220d4cc997fa7910058198

SHA256
2ddec3b0515eba9a3b8be52cdf2e25aa326687b1e0c5ad3b5c84810d0489bf51

SHA512
4d5f4c7a9a2c179c90c4037ca4463fe442e31193916404e4e8242bb8bc1d47dfe34a04a8dbb45b263cbc0277628f7725cd90fb17a811bbf59ff27d894122f520

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c7d53448c0f3add04ee3529c85c628b

SHA1
9f2373a68958b346c3f641400953e037770bfc43

SHA256
fcdc6d328634c874954b06e7a9f871309e5f14128541a7456b2c5d3de376cfee

SHA512
07ccb2178dc41e5291c85e3bc04c44f0839cbf04993a1448a418006eb32c04b052e7a5f725a8771f4238b3c1f56e0932ebbce0cc1c5850c2eb20883aeb7b893a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c893b16c01199dc5f2febc1289ee945e

SHA1
d4205120d1861793992dca7078c432b047aa5107

SHA256
e264934baa2c03c23f0b7fb674ee064296e76ef43f3ff0a3a78216da876f97ad

SHA512
25df5835cd6132fdeaa9bdb40e22fe9f95e5f07ecdbe6d9e8d888dcecc7158e70982eae85bb0ecb80e89d2accc2c795d71167b8899076a5bc1aeda8d4fb51412

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d10878a1aecafd7a251248f52b8c2e80

SHA1
663dcffc52f6c3a462eb40b3d1d6e27f2f26fb51

SHA256
db8d33a78f0b1d28ff9e22dba8b6681471b350301756f9c839546e4189ffe586

SHA512
d94ef0c9b738b61d80f2b525441d307986cf2af8ddcf89674cee89b2168ef227fb7b9710af0f0f95c989e6177b661a5f0154bf51accd090d443a5f9512487532

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c7e0c5122d93f4aaba650eb6a8339c99

SHA1
21ce3dca2297d44a0e8aa9cdaf4fc87ed186cf88

SHA256
b6c7f907d5e9f564864c2ef8543c9ac3436d621bdf53e6220e023f0f13445390

SHA512
79cfd5a289e4c537af6dfc6a33340f2eda7c49064b40866aac3aa424379d5666921ab90ad07e3e10ae5b689004fc7086b8038f1fdc40330d3e70f8ad6ba12b00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f381740628a07a846bf427c03c72d2ba

SHA1
6ea32978086078aa4275f6cb680580275bfd4bd7

SHA256
0c80b85f1dd0d4aea1ad11b6ed8e816be0c2fa45d11e0e21c56c687f235d2135

SHA512
d29ba50aa94f8ec60c61fc4ac7076a6c110c567bd6ab01aadc9e87581fadb6a0725c609e737a0fa73af38ad0e99d30ef6b7f48819198fc6dcc62d1ee45ab02d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
052e04d0bf36414fc66d8dc471115ac8

SHA1
39b1aac49aa66338cd83fff70284e603bc6825e0

SHA256
19752d58a57c375117517cc24dbcc927733e4eff924cf165557c166c5d0903a5

SHA512
8752d676395468c2f45f54c786d53a04955397a613343129e309bd44b9156d3b705768cf96e66faceb51a26a40af0e15bff3e4cd30ba1ab578dc7b184fb4de8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb6271bb631cb3a77f7aa70af0ed1cfe

SHA1
4c5c78fd717f0dcc462bde9e311f3a20a97d4bfd

SHA256
8c18384bbef2de33babb74a8bc5ee8c25cd6d94eeca904f76c4bb6999b9cccb9

SHA512
95ed8367c3dfa7cb4eac3b71aeade90202e4c66bccefa063262bdbccbdfd752502848906d61f5abb0033f823bebc1ca48da489d6403786fc946fcd408497750f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a69c4bceea563375dff15c9e6771c16

SHA1
cbafea86905517adb56763134e1d4ed27dd8c063

SHA256
a92f756a3c046bc91e5ceafd8a2b52af0e513b957997f88a8b37ff16fff51216

SHA512
e7c8d84d296204a736e6ffba212c3cf5b81b9a2649afd109764895195045f061d3556fcd12e9c47e5f2132ad61ed75c82a9564687303ce2737b9c1a3a82f5527

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dce3d13313923a54e78a1bec29c906b2

SHA1
0b6391355760d45d754bc7c7140bef82c45ade64

SHA256
6ec822dc3b3d3d1c5b7f1e069bc3c3db7351e65f3a48411051268aef08116f7b

SHA512
823cc738359567f8034f1377100f47c832ed53bee43b1f4c4041719ea7a5d27caf72e23dc83e68a6e4d03c6fd72f834d16f9fd2f65942c006c93b3bae9516111

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dac17356e9f7d49250cf29802e96d8c8

SHA1
536aa43defd195482457c81ee794325c57b991d8

SHA256
490a746f9dfddce43267e3e19d5ea67f1baeb4caa1d3b9f2bffcf029ec062b82

SHA512
03a240bc9f74cbdb5bd8a92f1e0ebd1114be00da06b6d724b48a5ceef16fb6e731858cb60d776e3f30ea7d8ab8c3ad7cc20fae3e469bcfa3c74401c9a5d92c80

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCDAD.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCE5D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit