4417dad45772d4e2124e2510a4b6591e73fea5b6ca25168c3452cf926e991a92

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 04:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c835944d152e07c54a059ab17e9b7840_JaffaCakes118.html
Size

180KB
MD5

c835944d152e07c54a059ab17e9b7840
SHA1

92335f70f5f7b0de7d83d36d5ab785a917bc3449
SHA256

4417dad45772d4e2124e2510a4b6591e73fea5b6ca25168c3452cf926e991a92
SHA512

4efedd4722f851637e80877e3aa781a1450999803b581d3bf209c228a73192d47c676e31ca2687c80dbd4c18ce1d5c40394cdc768d579f50198ee3db1eb1b251
SSDEEP

3072:SICpyfkMY+BES09JXAnyrZalI+Y5N86QwUdedbFilfO5YFiM:SOsMYod+X3oI+Yn86/U9jFiM

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1B4640E1-65BD-11EF-B4D0-D238DC34531D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00dea80acaf9da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000f0899d3671aea91f52ddaabf744c4834b3b783f2836bd3b021957051aef9d6b8000000000e80000000020000200000005035ebb88cce18c8abeacb076fcf3889b567bea08b38d596d0200ec4a9ee1aa5200000002e4d13f46ea4aeee8e55ac72d68f4c2c64c0352f44432e4de550bcefa6583d7140000000aceeebf9e92dd07f3fa6cfc00ea0e1d8ad1a58844af2a72be70d130d2376c0c421e56e0982b738ff45bb22216c5de0c5728b6da1699a02d187344d468c079c02	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431066702"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000004b41bf4734e1df7836a73ad3a9b4d1f053607a3273ce07843bd7cf9f2eef9a36000000000e80000000020000200000000d2afe9290e558d1a395aa3b43766f75954774c57f0fc6ca8ff639a815ee911a900000000d60df09b783e45763289215c263d3ed5edb516051c4eed0b645d7517887b89f91183d61901e951ebd56c57fce9f4c61ede350ea799058bfc0f791cb870132f81dc49dbc9ff82fae0f7d0ba73ff3ef48df56565b9427c5b631c5e5403dae2d58e08c6503e9c55dbf431c1aee52c86ddad2fefe88fba3b50bc829b7812a507852a0a49b9bb626e7ce5e03de8ad87c86f240000000a46bb9f58708015ce68bd01236629143c30d84485e8b2e5bad66702f6a636fd45ef82983a8efe4eaa64d237dc26178625c13e2012c259ef3861bc31523a54873	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3068	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3068	iexplore.exe
3068	iexplore.exe
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2080	3068	iexplore.exe	31
PID 3068 wrote to memory of 2080	3068	iexplore.exe	31
PID 3068 wrote to memory of 2080	3068	iexplore.exe	31
PID 3068 wrote to memory of 2080	3068	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c835944d152e07c54a059ab17e9b7840_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28610baab37d94c41e9f206d8d186229

SHA1
59acd621dc8474da371b4ac229eacc92d1a38664

SHA256
d7fec23b29a99edfbd2cbe2f03439256bc308da13f9698534497d52c8cfa09c1

SHA512
822729db77b6b9831f03db1d155606c74dccb4965be70a5024dc753ee4da8a5c6fb68a6bf53a751f87d3db33dc8ae11a8b2b3e2eb986a7b58006bff51a88e515

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef539e7185b2abc8e8766e3ba752d1da

SHA1
a8a462667a1c74cd2ce521bc7274040c5ee92589

SHA256
b37c835fc743e6aa894cc6f1578d8ac4b877c9b0e5c7c387ebe184dd7f7bf32e

SHA512
23d04f83e5d61d327f9ec09abb62ac24e0c6623408351d063210da67a08e37630824d3b6c6b35f37ddfb3e3025efb88d7a6cacfb35b4830e8e01e7bace80e200

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc81088549132c807bba3d27412fca6c

SHA1
fe11c1765b8da83fd604d439bb3b1529d7569d33

SHA256
c5118d2f6466d5d711bfc53bd6804bc1f74ee87a1ed62ba85d9339640d3adbe2

SHA512
dedac98512e18da4a2c5b471d712639e97ad40e16c237cb5834d59423adf2399b82e7e33f6f634b8fd7cd2f3be6ee9483c1d48a145dac14b768a7e94cc39b9b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
158af26e73b1d711484d672039f7382c

SHA1
89a7f4d0ce16490d5d842c76e3abddff23300727

SHA256
e765b7d9bc991f0ada7fb077e0f8d1b313c9beaaf5a1d5727344b7cf219d10a5

SHA512
b1e65ec13c20a84ce7f4bfe7a4a9178f2f6ec8faa9fd118b4e46249d25b7cc820cc2247d3ddc4bf767d09a419bc56ae1651a3f2c28b5462937936e4eb4e27e4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae79e0703ebd62aff467dd9ae7fe4085

SHA1
a87fea581b83ed73245b06aa860f86e84e378867

SHA256
8939bf75b0f05bcfe97df8e3e40716176d2a63d20e12b02e2a61252d552c6170

SHA512
b53f20db77612182ec6a8789ddc6da8dd94d13ff48da9e1b5ede34fc57f98bd293811bb7572c3a63e970fd33bc4ee2bf8f6559cb03aa0adda4d73c9a5203dc50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7c0cadf47a720f808696a80eebdfd67

SHA1
b4d9266f0a4a155f54681b1cae0abe6d5db587ea

SHA256
78ee2c28e5d565715d7ed76b164279f2ec9806847df62e82eb0f04f0d2648380

SHA512
25daa647f09ad8e258d05603a2c795ec1bfc64fb26c48dd91b20170508590f0adbf91998b3e918d6bc57cc40bf0fff5ae342235e757ee68b491cd7b33dea3041

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
990f3ff7252656bf9f24b2ac87ff7bde

SHA1
9c17f1f96382abd2074a5a41a8c638dbbc63aa0d

SHA256
df4f235bc7063ac0c87fb28d4e0cf23f37a1e675b391b808b9978d9a2a3ae97b

SHA512
42bc8245cf8e869bab2273f1a39dbfbc894ea5ccea07e1a74bd076fa6819200525d293d8a5340959a4019a95da23aa28c944da5fc2e838207f7b0c55bed326d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c875f0447a6f27f3fc6686b2cea458c0

SHA1
6715a291dc8268e2d3f820d6b0405d4e91be09ef

SHA256
852f600057419992af11c967aaba56ec5fd6ccfa43264d40c4eb81e68edaf30e

SHA512
27a2e5ece6f800d0ec10b4cbd15e0db655d03087036bbb6883ea9775761a08e21caba785946a85d0192652f347f615cb993d85b34746e0cb6addf43089d7f2e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
779c576586a624f3bb419b9e97e7c382

SHA1
3031bc9c778c535ca416a93dd88b642a8f21397f

SHA256
f4aeac9c5d617899c07e299c9c9a42add7ebaabd167e5daa9fa6416ab9117bd6

SHA512
ce7f0f32847d5ad641111d84df6761769d6144ca5cb8028f86713d26c9fce3e12aed28254d509cd8b87ec73162e5cc9920456b6fa7df2ec33146bd8a97f68ca1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c79f42533c42b95e506dc9466ba63238

SHA1
3740a703afcf14038f2071c2c03e1d35f72cdab0

SHA256
c9eaf4a859316efff506a015a1f70d4f7527781e0e8aa534ddb794dea56e22e1

SHA512
1c647fea9d5b9c618d0740db1504c10f90ce16b6296f31370e6e9d39f115b2cbf5b6b2c3ca1e22ad1ec646c7c1132b5bafcf53ad66e039f8950cc5c855ff777d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6952f2d5b8a5c7ae9a103fc00c7db36a

SHA1
dc4dd1c006c2a548ae56555fc8e741309978a403

SHA256
192982afee45e8ea4b66a2fc28ddd757517b9ff4d0f911eed74889a6e4833792

SHA512
03ba95b4987c6db60e73bfb1518f4c383b54d30247e3d385ee1f30bcf9a75f1273c5f4fee326b5497abb8bbcadab6a636048c1afae965610097b51b17a0d134c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAFA3.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB061.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit