e15bf7d16ff41055dbfdf09207c06b88649bfb119b5586c9a256f995b3b3b6ff

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 02:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8180675eb89464fbf2fb67333c51298_JaffaCakes118.html
Size

1KB
MD5

c8180675eb89464fbf2fb67333c51298
SHA1

5f2b86644a4265c901104e8786fab3f66dae5f4f
SHA256

e15bf7d16ff41055dbfdf09207c06b88649bfb119b5586c9a256f995b3b3b6ff
SHA512

1b82ee2662557445068acffe1d6fad6d9a79920907ceb57874710eb7c9ba14376b5ec4c08b7d597c0ab7961bd3b33878046c236623c489df7f40e4e4e97b2a47

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d99090000000002000000000010660000000100002000000012029e2bc8e3f75b27de75ef084d48d09cf50703b347abf50dabcd2ed803e4d9000000000e80000000020000200000000358659513e1c3e866083e52dc66bee1a90e06288541083ecb4f96b8549e2a019000000044d162a91ab25041f23d43863e2499ba769d79d7ab5bee137190f5a36156b50649f68f142fffef2a17b3e121d6720b2672832bce335c00044e09a0069d48ec5fc9e708affb4fe17bbfaaab32729a566ae4c2be4d8d11a579b26c0588c75ba5b3746fe2072c82c7b5e2183bc688e463064cff9ec7c16d2d4c04f389cd382be9ce860c3e9f34e54122efab233b05b3902a400000005b995c91c329ffc7717e0c54e318dd35f6c5739c244bd3f448e0a58c6e607845974dee556a94fb57224ef89c769827cacab78e08d7347a29ca3c04cd3b145930	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431061254"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 507d3942bdf9da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6B6EED41-65B0-11EF-B6C3-72D3501DAA0F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000229e7ce148e255e3f9b8ec339e53738e2032c66321d041a13b9d8925fcb75b52000000000e8000000002000020000000e8814d4a4d5ad9ce7ced88594bb88ee002dd26ba918e3208a0fb6902b1bd2f8320000000663a0de299a7ba91406fe882a910f7799a0b1407e3d6e535b932e33275da6a2d4000000062355c0f6ec7f072ecf93814f718b1cee6a386a70208f0117f76877ebcd31a84d72cf9dabd8230d9b17de4b32dc29d086ab806e34dc86d66157c3c2a752af6b0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3056	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3056	iexplore.exe
3056	iexplore.exe
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE
2672	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2672	3056	iexplore.exe	31
PID 3056 wrote to memory of 2672	3056	iexplore.exe	31
PID 3056 wrote to memory of 2672	3056	iexplore.exe	31
PID 3056 wrote to memory of 2672	3056	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c8180675eb89464fbf2fb67333c51298_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3056 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a081cb9e072990ce35dd91f45e844f71

SHA1
3f24797b5f995d53b51e3de75dccbf27d45391be

SHA256
b03d7e77784b56cb2adc2367f7284339482de886fccae4eb70ba33c2c23ffa08

SHA512
cc3970b55ed667344dfe25a6308acf0777d3d9ca04a3846b2fe5265642c6dda3f70af5fb1c022641de98b2a3c043b6f57841ae56ee38dba6827cf9999c6d460f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c530bd641b09639071234d56685f80d4

SHA1
cf0811a6d550cc22ec5e6b51e58e645c8eea5eed

SHA256
b8b486388d85e7ed4fb79cecfe9bf8c66df12423098b6b1e000cec673f90cfb8

SHA512
771f0965cd9d169eb336e3ba8abae6331404157f3a7cad164bdc925412b7aeef9ee44a7aec30b764f367a9808a5589bda9835c52ccade73950a7d4087a583f10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fe1530745cdbfc0919a4a8b59d98053

SHA1
d02ebf5482dfadea07de77670b383a3a3f5c9d9f

SHA256
07ade243a460e64a4b6cfc190fe31727defa1437e50d359b572b28a67c505ef2

SHA512
1d117f8e41be7b22fcb58e478a72b351c5c111b44bd5114efeb9abb82b54dac993eb154701385ba8fbc709f8e6957f784ec58ef2d07193983de2adef3bafa92a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f767625ff445d5f636a242e22a270ae

SHA1
d209000675ff0e3d4b98186526fdec0b6e9ff915

SHA256
683f3724eb4a49c1d96777be5617f1eac70d068d996bdbc4c3754d527bce571c

SHA512
c040d5052ca91ad6c79bf14bb1e79cf3807f09a5b30dd4f86c7fea6e5e988108bbb82b2807b252e59fcdcaca5efad6448561be45a57aa757343a279a2a230914

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0243084cf1676c2e7ed03a5f5bd05696

SHA1
092df913f8f472b58b10dd6265d9812a8f1eacad

SHA256
36a82995570ef5c58cab821d4e3c3e49bd0623845b7a2a16f3fa0aa3833e1a53

SHA512
4bd69db36f46cd64c70ba4b69d19b0be8d5e7fdabb7301c240e118119ce78594d4fdbc0bc294a8a97783097d0094df6efe6b6846eb0b78ef2f897e222f69e4f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d3ddd3f87d871e7c7fb7e6383566999

SHA1
4077f4e6cbdd81b35ae03bb7c3b66eb99cb067b3

SHA256
8e46dc00b4e9fc8a7c7a84ad806129ec59e0bb8a0f41c113009edd937b6b0bba

SHA512
733688675856bc67894316ff039598786ede05447b10d04ff41309a70aecdbd0816009fc59d9d695611c6f4fcb0fffb416fb7a16486c89b9c122c1c04f98b308

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6baf856f8313713759929067cf11e161

SHA1
48b4f55cf5145b2993823ec689546dc471c9835f

SHA256
4418798d11a21ac13f3a1e20b9a28309a185ce13483d6fdad144c9c2af386d2c

SHA512
0e59766b3977cc157a4f632d0afacadefe1a463c3e3e761a74bea78afdc9c1753091601400aebf4735bb3b12feef0d2e1dac5a9c019e97b6c12854c280bdc2a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd436ad479312eb28d9bca87854f0852

SHA1
f69c9ec18598cd687e97f01b5516a4b4d20f03d4

SHA256
23478106488b2b800df442b40ded829aacc88e25f3d27ffab7f91ea93e446e84

SHA512
90bda95afeac1cb7bfd28bdf239b42611a8ea2a078471d0e56a9e5452a5d5d5234cecd74d163d18eb7e6ff4fd0e5269ca76d9db496e7fe11550c8a87e819b298

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5651665a503da7ed5621c85ef159325

SHA1
cde55fcedf588bff536c13d1aa25f4c25fb5cf7f

SHA256
9b17438cfe4764cc14e4091e91264783107dd0e10eee355b7ec602f5fce0442f

SHA512
1dcc485a3a90e95f21e73c1853f4e058688716ff92cf3806c97067994918c1caf14a23b3b42cc23f6a3a1c4fe9b700a67f489a9c2da5eee9ba4097d448d7fb94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c5a1cb414c851097e15ea863f77dcac

SHA1
e2d2de14f14208d6a9e1201db42d5331eff571f0

SHA256
af7c1840d7346cbff05ca13128a0bf94acf5428973bb38935899653d937f15df

SHA512
e35f5970524b06e9006aacda9fd442c40de69205ce20fe4c3ab634e62cda3a040481235c519db137b35dc0598705729f96beab10ada76f272c5ee9215af4d995

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c4fc6e4902d742c698205c4960938e9

SHA1
4f955cfcf0f5be9c4e77f85ffd81a28a3dcdacaf

SHA256
6de056b77d806a92379579417901315d77740606194477331f1b75bfc3e38721

SHA512
9bdd0b0ce9b39c319fd9243a57a52e16d26c308d43b595e8f620a5ce1d27f4a16948728d2532ba5e1de36ecc2f0fc0dd8ba0a5bbf1ec532df7f179052c65b7d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF856.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar104C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit