375196ab3d1bb58db4d16788e1e33d4ff34092774fd38fbcdf7ead162e966dba

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29-08-2024 02:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c809551f63d7d7996bf8d4db449aecce_JaffaCakes118.html
Size

3KB
MD5

c809551f63d7d7996bf8d4db449aecce
SHA1

4e72523b22c15e475abe07477b3c66549c375124
SHA256

375196ab3d1bb58db4d16788e1e33d4ff34092774fd38fbcdf7ead162e966dba
SHA512

a9e2c1c73b09ee6b9693cdff28d55e7cff91080e3e60970de917c2a3534302aba73c3b541dd19dc2ce53e395a52146a8325acb81f054ae81a59efdc3bded9ad3

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{935DCB11-65AA-11EF-9F09-428107983482} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd0000000002000000000010660000000100002000000065cc77d7dc527a5060d85271b699c573d90927303a8e7367614a14f2b287f12b000000000e80000000020000200000001fdd749eeb110337d7677a2de62a064496ae0407c2ca62d90151bb737c17504e20000000f4d30bd0371170e334ab2ed32d5cd1c0454c94befb3831e366138ca08d31841540000000c75076fb836bbe78463ea6302c748b377c026331a375f362d57ad47eed0d8b0f044e8443193e8de8b24962dd5d32a4ee3db4775b1c2b15f101717c1a5b8c4442	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431058744"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000e4a6a79a319fa52ad18272d165bf4b19bc973e741778a02cd939d1325494b25d000000000e8000000002000020000000bd4cf6f30f452c0e392cad43dfe4649fe3577c21eb050b64cbcec0e3ffa8bb2a900000009a4e039964bd31ed6c75a2db534dac4f95cffc9c481f46aac3b402394d46986bb5a4db7cfd406acd6ee195146006b1acd4cc0d678f282c66fbd66eb975060ac2203684acd1c02303301c381638d81186fe9efb19b2899a1da9f0fe61968a99d2f577c8527a8d838d0e3442801846851ccf2d791329f0b773a014ce081dd63c96f57a4056229e30dd59bac64b4fde0c9340000000afe5281caa1f523846577704fdb385892dc2e0ca08282c3e32c22a32ddb15f47d75fa8aab0258fbb36e9fb3c39cb1f7eda01ff1eb6372df0552ea95c6c887e8f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f09f866ab7f9da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2232	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2232	iexplore.exe
2232	iexplore.exe
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2808	2232	iexplore.exe	30
PID 2232 wrote to memory of 2808	2232	iexplore.exe	30
PID 2232 wrote to memory of 2808	2232	iexplore.exe	30
PID 2232 wrote to memory of 2808	2232	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c809551f63d7d7996bf8d4db449aecce_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1cdfa0953a9f327f17e0412873491760

SHA1
7b1fe1782921c9920da6cbb0b9b80f168e93d646

SHA256
806478995afdddc672af54eeb1645a497c0c260c3a8cc34bf432c42ce5082e2b

SHA512
1f740a40120300d8be61e097241f4f8480341bd9b6d2ba1d1b08c866d0658352bb65349d4a44e9ea62efad532f309a132ff7c59817ce4b1f7dc5954e5aa5fb17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f3d452c0ebd5d57597c4b764ee720f6

SHA1
1b7acb643839f1637e79d4c0077b51d0a1ce8fc2

SHA256
c476c2617ff5bd02dc625f88f50f4197282826727496a153ebed4a77227de08a

SHA512
768d52755b12aa077685f4ffb52164ec666835ecd61fbc232285556b0c435425b60fb132e352173b5e8171cf098793a42749b34cd34bb8786981f8a9139e24e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac1c8f58915b044cbfddc187151727a7

SHA1
058edc5a69000693fcfac8a7791eb31077d74324

SHA256
f4128ca731713940925708de0b66880cfbf2f6291d726df0b59bbfa1eaef91cf

SHA512
1be8648aeed38a2a7a3a79d665234c82055524176f21127aed1b3956856fb4d543feb5c0aeac039767d21a85a89383514ec0beca437709d1882b5ade09f94391

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55e029607321f9d7419aa743184ea6ed

SHA1
f762f90d7357082f9dbc4da4157db59e32ba5437

SHA256
1b5730bf3d786650e3e865902ca5c4e8950562e922c536b4f3441081fdf7553c

SHA512
8550e8247c05d43d3580d137d3b9a425364a7d7f7fcdecf900da54808e00690e65b31a6a52c6cf5e53ce5f835838708c4f09c7b1aa4d3607abb83473536e77ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7dfa4d90a480c08c6fb6dfb9d064e361

SHA1
e3d0936c967db933a277ee2b9831215a222b8fdf

SHA256
aab715014a56873d3109e7285f955e0fe7251bb0e566f95ad4530cb172782f96

SHA512
d0b9d28accfbc1f623ba49713a92efb95d70ab2f569d849b1598c249f2441e661e549bf6aecf8db0689efe8e75acbfcdca766a2d7bba7177364c4283f3e57728

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
319194577e7293810ea7b050df0dfaee

SHA1
af37f2d7dde1e611af959832af0db8a9114ce9c1

SHA256
6d1af311e9c77cc682d1191d1bf89e7cc1a0abb34a1eaf4122a7280f53a14ced

SHA512
fa40c5c9f79cb3441ffcf5c6f39a34a52638838b9ef702f517dca8a6fd6a17754550509d414635013180b0775ed0cf0290ae940c4365181ca3d56af02969c20f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2a77fe8c73d4828e272275c9b18830e

SHA1
bc6acae1d2b9d03982cb6b847b9dd2e4860f945f

SHA256
b6e356a65fc0fb889e19d8abc8d2bdd483ef7365f37693016d4231cdaaa58578

SHA512
95ad450a6ad89a17c880e3ccd02c4f20025772bb61750fd557c2c73846d2d510c86f4a491ca7c479c1eed918348f1a734d3aedba4bb4f3ddfd624b2dbb070ad1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77d67dafae4266cec41c735783444961

SHA1
5e0a6c820cbf926cee30814e862ac006d653b7dd

SHA256
240fb4886c8c3733d6fa31739622a36e24a306d44c3e828849ca004f1a61cc31

SHA512
288a7c3dfcad20e8aa53d00bf32f87ba1c86e6de4c3b0096b1f54d458e676f7d9153eb00a5610c944d81deeea84ac149f92c04e17a9b2cd51a897533e5eee16a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56b88264fe15f425cd98e686409dd5d8

SHA1
0343fe2b9a68c54468cd3be43c757337baaccae5

SHA256
8c524c4ac263ce28013ecbac1edb9de8d143bc28262c55f818b002da779089e5

SHA512
de2924887512b6dcaf1421f2e2d2654bd4f5a76932106e450efcadaeaa9fd43b452e2182355def032d12c16f6f75386779454a0cb2c836859c7d3f38cc842bf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22f896a4a1a8c83558d8107fd23ba08d

SHA1
cbfa16c67e73324368d53f6ae19ce93e41d6acea

SHA256
0d171e1d41f76a36806373e85afe96cfbee4a1ac399767de4f99d8c22c38b647

SHA512
9b889c03ac1ae813824559a51317db7edcdc8ad9d73afbc04b43b586c17cd12c8667dce7ee661ebcfc97f89f4cf53dd82e8efa071af2330ad8d25cd8a1149ec4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c50403dd4a1da8da8af5ab1c7b734608

SHA1
add31b6ad9f8a65889bcaf20a9169cf76fe07538

SHA256
65276b0dd8ad14791f7b8043e31e191eab9fb967f03738a9ca9443566175f90e

SHA512
be11556d6e71d279b268e9b76057bb3ded92a0a552aa1c0d94b1bdee9fc5eebb1e78d251b6b0e561303c1dd65e80d3ac9813c0af86273bed0bbd7358833a1826

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b99c76f1c53b2bcd37c15b7e21a58c7

SHA1
f401c69f7ee7d23ebdf5d4e967027f7cf8b5a488

SHA256
f2d67fdbc2745da7badb8de3ebcc0996415562bec38ad7d7d330231cf7fdbb91

SHA512
b308da42dcdc786c15a4eef7ff060387bac5601656436303e80ae2ef8b90ef12e871a2d793035e019acd6046fb26e95c2b9e7ca4bed8b915a55899e6f936c99a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3DAF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3E1F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit