e93d3eddaadfa42549ce782246d83ab2c7e441a76c6330906d30d69417ddec61

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29-08-2024 02:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c80d737e73bea05d78fd63161c546fa6_JaffaCakes118.html
Size

21KB
MD5

c80d737e73bea05d78fd63161c546fa6
SHA1

815213052c2f711fffc6671479c4b7fcb4cb9c1b
SHA256

e93d3eddaadfa42549ce782246d83ab2c7e441a76c6330906d30d69417ddec61
SHA512

1074bd0a50774aaef2ea4a31de14cb1a26fcd9442c9f27404ad22edb7a1ca62ab606e7eafe1ffae8f6607dab958cd1c84ff19c4695eb71d59db5422056fdde50
SSDEEP

192:Hqvl596UDyvWDuYsEEJ9fo2UQB7M09Vea98SdNVMjP0kuQ:Kd59ku+EEJe2RoaiRP0kuQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431059510"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000ff3c8b8cc3359788570974c4f05519410f6fbcbdd88d3a3e11ad9184d229a3a6000000000e8000000002000020000000b491619554277f122382a52e0988bbe376d6424643d26114101e98b01448325990000000ba3c9fa89ec6b3f64d3251a8dbd0e7624f8a1ef509a39aa7ed2dc802bad4e80cf7bd337a6cdc16975d35174e50647293ca2027c0db536c635cf48682ab67a39bcab98e5d1aaea6ab9558b161cf1fa1df69692121afea366a0dc74eb40efa649217b7684dc47f6fc812d0dabc56a27ba70f6b970c7efd916842b3d1fa493076478e7bca4fbdbc92877b58bd7a8e6fb3c840000000ce6ee78387c323e75a338dc257fb86dab03ee3ddb25f0dc2655dbabecc6339b57fa3e4f0086fc399bdd608e473c1c71dbbb638d124c57fea5456e95350d54cdf	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000cf70864cd6176a9504e11216a906c77c0e744da85903cc9a9630a11472b8d2fe000000000e800000000200002000000085ed0007b5ba300afd3729c3798b851eaf37e725270cf8c5655c39e46cb31e6020000000c229d365d3ef52af3b6dc9116e7bc814d4c8c97726f42217d5b4533fe6bd509840000000f61cbebbf06199eb4f6e31a2a840d61e2c186c450272f1cd6617a58add23143007eb6574e8f5c70f275bdc57b91beef0b035d804fd3ea452de54ea394b8bf194	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7074112fb9f9da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{58EE5791-65AC-11EF-B161-F296DB73ED53} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3056	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3056	iexplore.exe
3056	iexplore.exe
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2832	3056	iexplore.exe	30
PID 3056 wrote to memory of 2832	3056	iexplore.exe	30
PID 3056 wrote to memory of 2832	3056	iexplore.exe	30
PID 3056 wrote to memory of 2832	3056	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c80d737e73bea05d78fd63161c546fa6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3056 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e791de62f65c6470ebf2659743fc2f6c

SHA1
2b0720f74001d1dfe7fb2add7456263c46373b3a

SHA256
3a68949a08c681b15bf4f093a7983f41ec63d46186b69192b602046f355494e0

SHA512
94029acf726c5fd41992c57307edc66d003200f46c843810a3f8adb74382810d5ea6f3b146f5ca4b96787b37c615e646d5386ca52028685852795c75f2f4f8b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a7d0d066d465f19121f7093c97c2e4a0

SHA1
a627d252e54a7f5e465672851960779617f8ae40

SHA256
956d94ae239ab7dcac0f45f072f8e2d230e5b4ad17c090d6072963f7d66461e2

SHA512
a92e8e5b00a4be90dfa3deff49ff7620544e82e554d79a6a8dc8c43575d156f40ebfa85c21b729e5594680a5b4525842eec1da5866b5c4b6d40d5ac51e2414ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d574a45b949ec7bbea07db0211c63c82

SHA1
edc6ff6dd1eb325f4c55eab23c6324b0106f7117

SHA256
ae2f85819b032f7c485c7ad6677053d662540d0ad69b43a90a1f7d393cf4d9ab

SHA512
010cc211245c228ae203ac231b79f129c7f9d7df2fb7a682726b6e0d17e5ccee228635b28d8eb8918692e13cd95ce3720c4d3ed6e702dfc66259f8e8f0e28eda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e627a03066867b355ac739f1e6f09127

SHA1
fb12f0051357c62679371b9ad7064846982e876a

SHA256
80ef9d140c901e7b93dfd7352dbcda8231ab2005da68db29ee5f92ad5f79f1c8

SHA512
c081a5bfcdfdbdf95e431cbc0928b23a86413c545b70f43de0f34bff6288c652ed9a9d749d84fe720dea7f45cf910245ce29b1eb1590aefa337a9d60b14db3c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
331d69e8fd688cd848f83cedadfbe5a3

SHA1
25c4ff4997f46d6aaaa87a78ad226e8dcd12ab7d

SHA256
0414c9a173bd934d13334791546dbdb1432c8de8ad275a445abb54070c7e4628

SHA512
4d66173a0805752f550e4c302a95407bbaaa9d4cf820ef5d9181c0625dc1a7c1abe0bc78524ffdc3ec03537d09ed9a32e3d9b502b21bf2c3219169c2007a8d73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
58089f4ac4c85f6f70bb3748de3425e8

SHA1
d3868f52de892825132c36130375c81a2e58ca13

SHA256
ea237ca20b64a37705e435af07c5891f1bbfb60ea84f287c08fb444c047164b2

SHA512
81f2b785b4fe0e661a7d89927803b02ea50507e714dd375604c950c1bd7a82c8adba10f92ff816b6a25946b7ff515e454b9004c36db93797f7c3233c4a2f5d43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d42280257a2888ca593befa6614a4706

SHA1
17de988f78871e55e68cff026dd19e18668c4109

SHA256
862ecef4b6df9f3190c2a68062be2db1afeee401061583eb16297ae1195ec093

SHA512
b1811aa61886b51021749dcdc87109a6d6e7c82e3600edbd059dea28996a5da829ede6b5729a6328dcd9324b4c5e529887950164e1badc48800aa0af5d00d580

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
85d67f449ea4ff6d0ee20ac7f20b8e97

SHA1
cd6ed576341ba7137b5508a9ced0739d306c3993

SHA256
aa7c166051a0038b4797fb5c0b500f26752f8af45f35c08fa12190faf2f8f46b

SHA512
bb870dab63637423c128bc46c6d377ef83f82ae34ea63d8664f61a5ecdee4cfeec3170a709478d0512b6eb067754183fc6e8660cec987d6557ed6aea63168bbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f187eae8f810b381eda97c70667e4a91

SHA1
86da15cb1aefa91c8375650c38f9abfc1bfcae4f

SHA256
6ea91f16c26595cc52c4b8657c2b1f1d76e66b1af849d8a0eb6fe514585c3fd1

SHA512
f0ee2c0ba355aba29f68906bbb0dcdcd5af3b2c330ed80a7d6876f183bfa2ed80b7ef88fa8b06dda9f76e4b08d5c02953194a209b7c1801e1ea95c7cdad3bff7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8b98523807360f0b36534d0995008ead

SHA1
65db7aa44a1a9b0c5ff1ed84a0f23bc8f65a5ce9

SHA256
4585bc6ea93454bbe1f28ed3de7bfbb4c96290abe0b5324fb46a8cdf13fff4f4

SHA512
f9934be32c8c8779276c36ef2a2b75188b840ac3ee76b0ed25760bd7ff0e1d44131732ab9475ace706df82a20cafcc60045628c8f3051dff722d299b3913d41a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c97ef203c7c4d1a00e5fe6577e9ca37a

SHA1
b4ffbd3f483a5cce8c024be45970557920ad6545

SHA256
40b591d5d69bcc6900103c22db352575d49c876b4c90ee541e59f85da7c64ac3

SHA512
0449cff355fa48d72a10f6877fad54a69a586452802436f22328b50997799e7357163ddc0be24842dd2e43dfefaa24f559c1f1dfb26de6455b0076e607a9bf6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d8027fdbed4c520b3fcacbdc074f0442

SHA1
4bee71154af0b6882985726ed50fc2f7fec05b74

SHA256
e8537b563f6096e159ebd084685a45f5210c78a3df942f55b0cc55bb2af8ea01

SHA512
ceaf74f98608e920720fdf811189dbf58ead2c5642995fe9ef95a5f05c0706a41e2dde7ede967508e0c8db276d8ed94f247eacef28c4dd1539f7e2968cea3095

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6423a9653617dbde76e9049d29e0f593

SHA1
d73742e22033c7187ff8f05f9640135666c8d93a

SHA256
0490602923d01051d2d336bfadc0d3b513b362757ca937ffaad00b62d1d61627

SHA512
da738f11cc277a70e1b236ce9653f727f50464f41c230ceefdc0bd2a96c13dd5fb1c1c2268a19243fa6cbb03ff570a71f35e1d2c96330e03c7471616554497d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
97781f9fc2eb34829485d9d7aff2c69a

SHA1
61da9abd615dc03b748e330005f54205912cf185

SHA256
f0a5f564a5ee250745f6ba5ae7fc693d6137b2f55cd33d8bfa5183e622a0fd96

SHA512
3065a39d3feba3c94730061e5e09c05355a13f27692d7ce8561e140c7bcd6f4d455b9c9aaefe28a619c3b3aa489e703fd5af1aea27ff1a68e5114ab4ff30bd33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
de0b2a02dc79ecfd8874f63003819468

SHA1
c57e99228713eee5cb0e93c09b5fe8ae1fe2431c

SHA256
47a83c2787ed9e5a9ab54267a83214913a1fb4602d5a157d4e09ed60a1388721

SHA512
5f7c286e60de2880d22e6d5c23882342bead71140a510aacb63172f597e800499d1069342a4b456067dd7417fe038efac5b302b9610fc41503e5377f3d0a204e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab99D1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9A71.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit