a88d4647afdffe9702642197d4cb0ce0362f49c65dc39dbd4951a172c489c16f

Analysis

max time kernel
120s
max time network
142s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29-08-2024 01:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7ff3791bb661e7cb5a05f90d087cef9_JaffaCakes118.html
Size

460KB
MD5

c7ff3791bb661e7cb5a05f90d087cef9
SHA1

3989d73d4d7c726f6454d341095aa4f271293c18
SHA256

a88d4647afdffe9702642197d4cb0ce0362f49c65dc39dbd4951a172c489c16f
SHA512

8272aaf52fcd9d37620d5ddd9061a71b8bbda64d2e01789cf46719f218a4efcbb9dada74380d5c489f2824a839f1fa5d092e224051915711f612c60bf2a11444
SSDEEP

6144:SDsMYod+X3oI+YTsMYod+X3oI+YIsMYod+X3oI+YLsMYod+X3oI+YQ:Y5d+X355d+X3U5d+X315d+X3+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f035510000000002000000000010660000000100002000000059327c8aa1521d542f5857a51b85cd591e8d877567f400a2c9ac5d8e66237ca4000000000e8000000002000020000000d30a18c313686c88c7521baf1cbe06a31d49b8d58c0e822eaf9593968e858da82000000029c1bc4af323a9b5825540fb6f8f8088f85617b247ba35578fce0bf652868c1f40000000829e19978947d490a7e20300c1d4743661690bb1ef62bf1e8b30f32ec435d0fe0908114aa57ba9d5fe2d9f668a1b4682673e23276f2af6df205e8fa704576713	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 106aaad9b2f9da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000756ffeb67a8e67b3a8fd8345c2d7ccab8d5b9b62a34cf5b1e7b70d51a2a6cdf0000000000e8000000002000020000000c95ee8f27ac72308a4a2bd362cc39904605f996cfd9f6e83150a2d6de4b66f47900000007c4e1fd19d8117001a8c6c50a96ad3ef68f0f1956186727b8576ee772e6b9c30d3d966688a85af8fddb586bad0d2e34589916afee1746ca26886ea4eaebe241a697ca66bbcfb10a270e0151a8762306ebe3f8cde04cfd75fa20c5f25799e10c94a0816dd8da2d51fd539ad830a619eeb465b000b7224707cd3e8756f5dc850669d94f61fff98c23d82ab652fa183958d40000000b0cbf0acbf68afb42e549a802861e9549aff7462559d828cba5b9fba8465bb4422a879fb3a87382f4cd637956e675f9c905a68687d723f5dddda957581d8746b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FF8C1351-65A5-11EF-BDFE-E649859EC46C} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431056789"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1692	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1692	iexplore.exe
1692	iexplore.exe
2072	IEXPLORE.EXE
2072	IEXPLORE.EXE
2072	IEXPLORE.EXE
2072	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 2072	1692	iexplore.exe	30
PID 1692 wrote to memory of 2072	1692	iexplore.exe	30
PID 1692 wrote to memory of 2072	1692	iexplore.exe	30
PID 1692 wrote to memory of 2072	1692	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c7ff3791bb661e7cb5a05f90d087cef9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1692 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b14f30c6bad7a70fa37456e829e2f3b6

SHA1
dd2c8ac3bc42d595589c55c13ac2ef8e2305e6ae

SHA256
69c7725639d675cda04458ba089ca1bae9dc46220210e5af1d6323e4244844bc

SHA512
ad7f9f6a3847aad585377575d210c6d0ec4680c1c0efea75025d6f2821d7c42e410aae007e7c7941c7a3c4dd435c61a701396eee430c4c9c2b354e48916e7b94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84d4850c4802e032e0f62673a8b95aac

SHA1
38e58513e752cf8baa2cd24c0d5a45c12d27aa3e

SHA256
328471f0d4a7ef449d0d128ec6064b0c24a238c35c8c6a60fae1dabf36ad356c

SHA512
5a5197a71b5c82e1bc59f50e89b72633fdc6dea08ebb967a863409b2f8555df06281ae5e116e65ecd094f78f85d13b6079975c73578a25c1818402acbcf8894b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ec328350a905780853f74d17f0ce65f

SHA1
ae9e2e3f18a32121a71c08ca51ba5a9a34a17783

SHA256
b535e17df5f33051c48a7ce5cb3d6a7a2bed74b06aa0d97625e3929286f1049c

SHA512
c5b99cabc3781e2bb0281db35a0976680b3eee58c3670eb4d927e2525c0e3c1321dc5ca787f92fa468ab00bf2b9bf02256614ea0523c2ebe330b79bdbb16cdc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
321fc2a9f618d17ecac0aae6feaf732e

SHA1
8d192406f3aa6f8794cb29115fac18d9091790f9

SHA256
20d88def7e86b80b62d0a9b88bbd11b8abe8f49a69157ee265b64f80e25322b8

SHA512
f99cd0918f8c85705a5b5923f28355326da704b895efb7834ac900b2d5a167e497901be9fadf852ec82dc6704e3db7264a9c8e43639a9d280ea18b2fc4069dd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be1e85e03aff99bce065f8ebb4c7b047

SHA1
e30f90b615490b0afa1119fde0099fd8a58201e0

SHA256
a3a729e6d7170d640acd57b1b5d2ee1eca04cd0be3eb83c889e73b23a63eb9c8

SHA512
40bd78a099d972fd52fb8c9244f2fcb3bad014d3a515ef5927e187c82016cb6dd4f07040e30d8920a9b37b200804e3662071ffc730cfd6d9a772ca391822923e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b687ff43d6347b86da8f56937edac66

SHA1
264a6b43b090f236abf6521245b8dba542ffa747

SHA256
26bb7e0df7f34b6621fc2577860923b9424e9865b78d2ac0fb83e15635654d1e

SHA512
26b70a0078d4aa8ef6fd6ac225170af590d6faf4866b2dbf6b65dc6b8a3200830ed5b286dc8af7b3ebf7219a4ac7faed725f8f0686fe866df351a5946bcd590a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4c3f3af8c90600f766b1d7f1f375adb

SHA1
31fcc0067a2dcc433796309474629fbee1f4c1d8

SHA256
ef7956cd1ec76529ba213b0aabc496d3d5d4ba93fb4fa3b64a4bac8c611e5bda

SHA512
5a6e33d581f8b1ab214540fb90770a5ee9a1b82bc9b8b99de0fc057c6820f20de1584246e89ab2854427b4d4311c57930ab56208e16daec0aefd572183c968dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4fb67737b44bf8a806363209763e781d

SHA1
bc4e1bf5bd2ca1c18c962f3373b61a776835ebbd

SHA256
44d4136fc93a8cfa50d6bd88f15805ad6e74784007a8dc53fcf12a6dfa3297fd

SHA512
00070b9fd4ffd9436dca20b2fe4f44234cfffda23572d55698a1950aca8cbeb487324d104ab76a301fdbc88406dfe5a99a0753e766b307b984287f113786a271

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88cfdaf6d5b68192b81f904470b6fa0d

SHA1
86e3821a5465925654db5f5dfa93eae2c0ce601a

SHA256
cb7e87b8b7fc15ef2df5ac5a8e4cc69027dc743297a339650f866c9670c643fd

SHA512
cd30f4a68de664858f37fd70a38205d7d2040aea18efba623b05dd6bf0b85df16abd0fb74301ae44ee67b3b79fcb2a5109b3610f7a25c1a202e4c9ee233896cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b23f1fd1d904e891110c6f3eec8cc0f

SHA1
27eaf842ca13a876592994d78acb70b2e0233477

SHA256
d5301434c1c83c5eb52036d3bae349368e7d15ece76165a3542190c27b10a19f

SHA512
b8f78baaf3e42cdc30c53aa7bd7d3f57b1ccb8865165062a220bc59f76b16d367fe30aae011dc7090b2d02bc39ee2207b362fcd626ef1ba518ce852e0d8a8394

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8a05e4cbeb47b6ac4b011a52e993e22

SHA1
52b1224d7150650fc895f86544ad2185fcb0006c

SHA256
06549352a7f1fbd6145d0459c28fac61f1cc89272e06d71016bb94ebd70ed771

SHA512
9d3c268284ebeccb32ca17d1ba210d7e0061ac62a519340723c0b1f73d4ca06c5df0c8ac63b9abfc9b88c02e7d4f20fa875791ecfa0018289408ecc38e3ac810

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c9d8fe7d3bd15da42066f9758768398

SHA1
4d239d6dbd7cb482485571e7cff51473603639eb

SHA256
9db457bd1447e6d8f889fa76620eb2ea8420d0433e2a9511b92d58595318a461

SHA512
23e7959dfac2409bf7d2e9930f1baa4becb829b8f61ab6c24763dd3fd8a1881bdc0add8fbe391b1589d84aa8239f41a2ab7247193037bd0aa324dfd4fe8c7d23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cff24b78d1370a6cdaaeb77a6332ca23

SHA1
41d47b56a38e901073b798e420cf5d911e8cec80

SHA256
1049e8d0bead397c30578423f83470e591addd7e9c04aa8dab6ab5b5e4ac4bf5

SHA512
64de48b387107a5e28d100922e6b04be56d2999afda2fde27c05b2a1ec4fd956fba3bb02c9918deb9d726ab506d393a6d74fd68a9a754f9c7f16d371eb2a425f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d0bc99c3dd5d795e81eb0137a43c3a2

SHA1
e9843956f98ae07a9514475b28fa5294d3a5a200

SHA256
ba72d3fdbb91579fb917a2d13d2696f78aa2577a01700d9ff98e92e3a4eb1764

SHA512
710c201d5edccc57d9f4495836cc09a19b348c3deca566022840ee1a6f0aae3812e5ea35f2867193bace10dfb06a571f144f7323b716ade2ae28c78ae56b8daf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5029d5d32b2ec0359259d7f23c5941a0

SHA1
d43d00d4b417bd0c18ca9130904f5a9ac610603a

SHA256
3c3c4529be1cdb7b6d611843eaa6f7472f37fe49b271874b2cb73d1f299c1b1c

SHA512
3b8e0eb93dc0b49a12de116ef203d55eaae2d9f5d33c10643ffb09d152840ed1f88498455fd0c26513eb266aeec389e4698d1c87c79b7636eb3cd8c85b4dfb82

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5ED.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar69C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit