e5be84ffcd14b351dacd8d0c2ea7e79d345fb7146c736cff1c4032f6525fa057

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
28/08/2024, 20:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7a3ab8cd8f1f08ba61989940e27c1c4_JaffaCakes118.html
Size

7KB
MD5

c7a3ab8cd8f1f08ba61989940e27c1c4
SHA1

f2937d2de69fd261c1783f643f46061342eb01cb
SHA256

e5be84ffcd14b351dacd8d0c2ea7e79d345fb7146c736cff1c4032f6525fa057
SHA512

e76db17c4f13ffe4b548f7083056472686ba89d66736cabc0c47774f36d7f75f0b01de3d6e59f4a484356c8608e01b822fc0d6a4da3d0d623eed3d2f6f544c2a
SSDEEP

192:lk2IzUUpEXVg7nVhiBfpIgpCh4W0Cxhnl4sM:lk2WUUpEXVg7nVhiBfp7IhZ0CxhnlRM

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431040552"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000ea629422c3536366473d3bcb25f4b971e96cdd81e805b10faadd6f46362fe901000000000e800000000200002000000051344dbf20504d85a44942bca9038545864cd36ae9df09d94544a51308c2262120000000ec58b903ae1c90051106bcd37fba62667b0dea5d5db3701cd2c5464ebe7d3b1e40000000bba4fe086bab60facabacb9b5c77868e4e74707b7c8da8a1d7b58808f5d8a2e4a8443dde3cf13cceffce58af146b47302a85a063ea641d04ab796f54c0d160d7	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50fbc8238df9da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd0000000002000000000010660000000100002000000094d18b02ecb3db507915974dc8e298c563e08ea504a052238006170bce0cfb14000000000e8000000002000020000000fd47f63880f459dedc24c53d24d3bff06099d13f6e4e84371ea5fc680970bb2c9000000078c23e2690f2b1dac4eaa7aee97b8706e2049ef064f24b24ea4bce44c4587aa306a81dd8615220d41ebcd1eff97e6314c487adea4e733ae735c77edf4703eea2ccd30bd38a96fbac98055da040fd6113d9f9f85ccc85153aa76128fdc1c36b59bd2e881617ba9336f585130f661c9058a69f2aec17c7aa3f2be5bbed2cda8dd28cbe615a8c87296b094fa5182867d326400000001f62c464798b8daa2d0bdefb59126c3519d80a4777aea91d16d27a31b627d75bf0fa7a304075375025f22497cb4f32e8052c47c805cc890c4cace2e1e8ba7a21	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{34846D81-6580-11EF-83F9-EE33E2B06AA8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
292	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
292	iexplore.exe
292	iexplore.exe
2408	IEXPLORE.EXE
2408	IEXPLORE.EXE
2408	IEXPLORE.EXE
2408	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 292 wrote to memory of 2408	292	iexplore.exe	30
PID 292 wrote to memory of 2408	292	iexplore.exe	30
PID 292 wrote to memory of 2408	292	iexplore.exe	30
PID 292 wrote to memory of 2408	292	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c7a3ab8cd8f1f08ba61989940e27c1c4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:292
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:292 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2fcfdbdc09288f8daa70e6d3c82e9c5c

SHA1
738f44cd106aeb71646549a0b9e7314ae6eae89a

SHA256
cb466c666abaf8103020722176d1c5c37b459eba26ac3b761176f19d4b175003

SHA512
114c109d265891cf3c4aca397e2ab5d2c777510ac2361f77184965c1be5995b8260c286993fd82cb25684036596da7bc94f333979e3f9d041a6b76f050ad30cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e8e7ee471634376e05ad11735a7bfc3

SHA1
dbc3d9d0a441cbdbe4848cefab52072b0a004550

SHA256
f2394a0a2f9b4bdeebf44c9064d22cebcaf3e71142c6581d3e972dc385a03d2d

SHA512
5ac4662bea4b106ab9db1fba56502c449384167b1236438f62bd7502a20b5e81e46a4be4c8ffc6b965f5846292a64fcb7131b1d82a79050f648be370130b626d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59c6fc3c056eb2f7450845729c0dfe24

SHA1
4765b90d014804d8f9d6071bcd286aff9a0037cd

SHA256
a0e8d962d16127d1738ee81fb02b88568bbc7c1866d8279068ad86b027043538

SHA512
e325714b7bbedba4211ef4c94f649174ae1513d43f8e900b271651496f5931d7998c9f0f0acc95ac7bacad8ece66dd335dfccbea2acd3b3fd8bb4ecbc0cdca9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af8e93e7bda5076e24c7eb57b051b1e8

SHA1
6f3336dd5cc897c4cfcc2727740e2f2908811184

SHA256
f7fa5b2a5652bcf7020bdd020a6fb8f1f59d895b37cf352499ae5ae2d4c118b7

SHA512
b6213b0db7f4b02e8d0739e5c076d899c8c91e8c9e9773f0e50c14ca809455635ce995fad6c8d5612286eab925eba9e72cd120c517b65227661287cbc51e6075

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7298430c52bc55eb23a4c40b542f7e73

SHA1
65e7bfebfbf704a40227748eabd8a35a25c9a9b5

SHA256
796fa8058aedd1a64883dd638726e5b0d68d04cb26dadd73a71fe3f05a56ce77

SHA512
6ec4f9869b8b01caa688e7d65ef4e6f38ac62a28f74dfc2c6de1a759c9d02d358d6ea4722cf0ffc7fa4dc44ce12838547679eec5d5bf27f83cd766c2f4e34ad2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9abcea2b6b4eea9b6b21a5a0c97446c7

SHA1
12c7a14e976aeb49467aa72250475bf1dfa0348f

SHA256
1bc495a7eadfe2c9b4c7c3217a5593350f5181c9295467e305f98ee3e7ddc88a

SHA512
554e2d568768c0c1737c5097b05725ce9d9c36fc190e963b03051fb3ca265f00d9dee82b45da10c3798db9cdbf5ea806401bef97073dee7fe8c5bf7a8ce826b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60d27d4b3cdb86a494122024295493b6

SHA1
30997934562a92a903ed69e5d908bcc4c51a7466

SHA256
0d356f8cc95ad704d6fa23bbe5ad6d68a2dd48cf3720b5210272dc3fd5a7a4db

SHA512
fbba46fda3bd788891647adb94fb42981cc6c162962fc85752251cc2c3fa4c825019afc5a9e41eccdaf694af3c2c01165cdc3aa84d2f0768c2534f41b7f88935

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32ea6402cff183690d921e6413b15166

SHA1
a0fe42fa649848cb0d8633c20209cbc12c7790b4

SHA256
9bcbf3cc01c91b22cb91a03c250f6842fde1d3a7d75cb41a676c1353ec51f749

SHA512
5e285e0f124cbaa9c29eea4f346af853ca2958c4951ec5936bc1e949f2a52dea66189d728a835b528010ed4569a11c6531cf7f387d1bbeeec9818eb89ede8446

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4fc39aba0cd5743803a61ac7a94bbcc

SHA1
b33d040ad4aac9ee508bf8dae2883f5036f1e282

SHA256
4f6f27527c2877f4402b6c5fb06e5f724f9f28ac570c16ed616ce29606f59930

SHA512
567c6f198823165997c8fac6dfd1f4f8fdbfd1fa390805a28d53b7929ae017e503dbb920fa193f8be656997baca0909607339a30fa595cd17feaea5fd8166210

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e66ff9b3f2603d76f8ad44be0d10074

SHA1
3265574053850ae50d71988368e61d2d421d77f9

SHA256
fef0e1d7915709eb590166fe67262bf84af45e5a3c97488714837c48465051e4

SHA512
6b2d55eac46ee57602e704ef70fb4aa70de15d444541429c39afbb205efc5b2c715d45cc524b94f63497acd3523e6fa1e00a0485394a2a4dc287572af91170af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fca944587e30bf497f37e36409b236a0

SHA1
cbb0a36ad9ac3afea4dc5eb1a95e7982c023c935

SHA256
9b4a2af0ceffd4b4d36df3ab04774b2e0f239889ddcf91459d3445628042b488

SHA512
2ffa6aba6027c82cf608b35bb762262ee636aa10aeb1053cd6f483a99ca73449978ad6f9ed4deaec6c03452f07a3d16d71de4b92b2e25ee9c4ea46e3816b243e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aab9080a9336661f933ccd4eefbd9fb8

SHA1
7465d2d2a019d8746b94346a7e25bafd4f59eeb2

SHA256
ee8bbc7bc23aede0816b00eda88cbf5c8717a232b458cafc627f1bd986c8a252

SHA512
3d670d4e59de574069a03640ff0f273b375ab4d4d76491906e33d97bea884fa977eba90c346a44e77d69207a9762770c81184a277872da156eee67a95fc0aa5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff237721103a0b4b3f0aab185ccd30a7

SHA1
915b7d2ec608b4447f5805cb87a9b910f4c04464

SHA256
f169704a3dab351a47d68111f8725d84b96f00ab27d4e6a4fe67dc218b1ef4d6

SHA512
0da3a53a6770bcf1064f60eacf6d8923daaa0ecd97783bacf49c8f00ec39ec3338e6f9d7b47a668c4ec2512c8218c30ccde6245dc66142784abb13da1a28c8a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab57C4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5834.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit