cf6639e0c48b645fd7c2ffc588d64a9e184340dfb2a645c8aa530485b1a7228b

Analysis

max time kernel
136s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 08:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8789264cfebf9c401e7c25abaed964f_JaffaCakes118.html
Size

56KB
MD5

c8789264cfebf9c401e7c25abaed964f
SHA1

07451dae5c2425dc0c38fe518dccf609440f90c8
SHA256

cf6639e0c48b645fd7c2ffc588d64a9e184340dfb2a645c8aa530485b1a7228b
SHA512

6038faa9c02100255d84e946b8b12619e52515469bb2faac8979db57def0c0b9ed33dd659a35b69f542549e5f6ca0c8742694f272dc0d98eb8db082f70fc321d
SSDEEP

768:SK5OhnwX3HELRRh4/XNv+f6VicAXVjSpLJv2ZOY:SWsnAWRh4/XNy6Vic6Sppkz

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000d2aa0149102aa9478dab40b5661b006034a025c960cbafd8a742b6601a90a935000000000e800000000200002000000083eafb83c25cab171acfdfca53114aa5f73f2a4328e18e18236cf61d1a1dd96220000000f9171f1f634b09240b72c053aef371108d1e611f72cb83ca9a6cd9448ded476f40000000b9d86761149d876431e75145c532383b5cd44cacb1ba2e10898e997b0e7ef2b876cd51fc5d09ae3dfcc8bd8e7ed540b98ed4c73b8722a3b5e00c6a8141cc2f0b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c7000000000200000000001066000000010000200000003f67e387b25831d9a245fd4f0eb81724217ec5fdbbbdda0840e229d0733c3856000000000e8000000002000020000000cf60c4a483f13b1e2d160b156569ca276738b717518785ade73a2c93b09e4e27900000000df9443958aaebc94a63d7832f05a4d04fd8c68968c0d7c1621cc51c3d646f0f29cff3e470f87486b8742b2f08919200449a266f4a90805e7372e3deb646dd79b8cc02b122e725cdb0c536c8e962d8482e091522aa0e8acb4dc770d75d2e69954af2016de501f495ac6158f07f71ff19de38cbaf151d09aa055651b70459b456c51a7f66daaa00f9754ce665bb99e0c8400000004d5f7653921ceae04084efb9241561a5a12c9640b9a10fa63293b9dc3b3ed6861b75a5cff3327138f3c88fceeac1f1d6907557e038c3de341f450dd970503f41	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b070a283ecf9da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{700002C1-65DF-11EF-A669-4E18907FF899} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431081448"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2752	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2752	iexplore.exe
2752	iexplore.exe
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 2824	2752	iexplore.exe	30
PID 2752 wrote to memory of 2824	2752	iexplore.exe	30
PID 2752 wrote to memory of 2824	2752	iexplore.exe	30
PID 2752 wrote to memory of 2824	2752	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c8789264cfebf9c401e7c25abaed964f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2752 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e26f7cfac41f735e32bb8eeba20cdda5

SHA1
df6150d1a6850e40a3233761dd3b2edd8f877aab

SHA256
fae42832f9fba967776baa16360b752b11fd1cc6bacd25c847cd1ecc3021a5e3

SHA512
f49be52e9635a855291f23d55b63fb612fa7abdd620bf682ab49afb41657c061446184702b66e720c79f69c4db42c55f1eb05667abbb6b4a574fb02bba3f24c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95009d7ee716450154662a2d6bdf712f

SHA1
c408b928073222b6da6eed90bf62de7d279e1207

SHA256
2b79d9a9f0ee747261428a92ba7131e327567f55c78863625b4e9967158e1c84

SHA512
18383ec93a8fa40a9f77186cf7aa9a75ce3757f7af52c129c66c9b564423c9c72b983344c8a3d41430ee2a4287b42bb41c3b25433c7e1bb51e5c122d7fd5dfe7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c9c7d4b60383b80912b478579206537

SHA1
78c26c9923c6e42f4aa5e908b62c80de24125390

SHA256
f285afe4befe3a515a9a725b944648a8708ae75b8221b6f2a377382596d65434

SHA512
8e92d56d066fa2b3b2e1553cd97e90b27701eee61f909fcb7196ce064e59171c61a39c0f7b34a4500291daa8bccce8978e4b9df932df43683bf925738f24ac6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ece269a4cb54f4082ef28ba06d1ba37

SHA1
14bd2e3c2e0666c962c103c9a827aeaec73b4b58

SHA256
dd3b2e56db338f9e4231305e9b0c56e72d71ff0290354a2b34478372f4dc6d3a

SHA512
4e9d666416398c4f14fdd5456a272f1f1969b3fcc9cd03a11bab6cdf4de04788fd819a842f99ddae520df7e4df6628040488cdc27a171ee8d0e4fce86e94b4f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66dd2bfa1e1c30a3247dbbd54b53445c

SHA1
005483080d2c6c88ca486e2c6be1d7a62d7f29ae

SHA256
5d7df84858f1822f63b7779d78b853e51a667341bd5dcaa608b0e6ba4c595da0

SHA512
363150f091a86d718e21a31fb868d9c33972c7924768bafcaba69a9cfdaa0c893a133007b2c6c0c49234a3fa340546ae6520813ea8d55bbdf036a677aa35dede

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dda244643e184a1746f52d1602e4a919

SHA1
001dc3484ec8e1e3ba3d6daf60af4f713afcdfe4

SHA256
817a61c5960fa0a1852a7b55b8031fc95c761daf804209e604a6099ebb5df266

SHA512
880c57127989bf4ad30170ecdf1c4caaf011f8a31d1ba1380d92c666344add4505aad800ed9efc1d48fc3091adc2288d99d3ae33fd2c52cafcce407224cf316f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
172d172901738e4afdc62f6e008fd9d9

SHA1
55df2f8effc68cb7c622070d8a3a8a1e4c3f2857

SHA256
5fd5f37e4590c4b10926254933608c6699900dba4f7f32967fe6f10be9179cbe

SHA512
ad38920449a42c627aee522d7855b862d530b6000d64d80f8b7d69d5da878df34aedcab307cf581b54c6ad33b950b1ca571578bdf97d83aebf6be35542d9b443

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5059baed68be74958a827590e2cfd373

SHA1
bcfe2ea71fc65d7e9128fa52a4149d3325777d26

SHA256
ddf0356231e7cfc3d8d2461eb6ee205b20145ca812e03f14f54490f0b228b608

SHA512
2741b8077f26f3ffc57c5337b9e9649cd4649273c60bc059d9851464d44038c9b9ae6ac04f935ec6151ae6bba8d8a4a343e0dbb69bbefb4ceb1914ad40d27881

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
610e5b39d912b898ed70aa8085647a4b

SHA1
b9a628aa411ae720ce6bfe38771f4bec8518f45a

SHA256
7144967c1aaae2f8c9ce54bf3b145dd3bea3911d76fcccd09a96f49785ecab90

SHA512
cff90528c0ab0798493a0c673910c64fbfa39695296cebd84878218b7ae388733ecffabaf0e0d3df911a69dc7176b39c68cc053de9f021a0790667d7c84f78f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41386552372da3b63456f3e0f8f6e5b9

SHA1
75778d9d2573f944a965e9be6bf8a33e0f13392f

SHA256
ebbb8c829542697321de302d9c446a2c215b0f6e7459ac441f2541577ca0388a

SHA512
30fc48a4910dcc7ad8a6c33172684829b94392774c0ea08a0a19a28a713f2d00680ec84c04c18990c0322834f46ceddc4853f85cf62537cb2151ecc44293f1b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77c436777338966a3d3c4a8b1bf68efb

SHA1
2e390d4c36293a42341d8684b2725f9a876836d5

SHA256
8a36ec8d97e341e76600fcff2c396bd4ac0a5370d3eff0503a7d0aeaf1a6ceaf

SHA512
3c15983aa4fc4af2af25ecdd09dd320c907342b81ebc7b5839258ff815f95dfb0f23b12bef99f6fb19c0d67cebab198e0de3dcf3adc6d92d3d68553c0314863e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e97a044c83ca57cd3e92e8a22c84e7f5

SHA1
4c3a0aad1897f6c9053fc9127104a00e88031b5f

SHA256
734ec893b19bbbd0d36b0d1e792794b1cb48b9fa0714933e712efceb310ed4c2

SHA512
8d3da6d9689f0c2eb7eef7a7535067e2a4132f17f4073086a3061632a502beeac85ce75e70721882ad5be676ec555bc7dc559bc8a9bb36eda75624440d5fc870

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8496f9f8d0ead8f8a1c35afa6489ae64

SHA1
fbe2afe8e597e07bd51594017a4c4df18266d423

SHA256
f4fba06cf4befdc94f68b6a02d78a0b22013734be46de9a15642c07928e0802d

SHA512
f8ae5682ef37201839472cc09d888bb4c098394ef13d6fc6a63f22c72ed4dcc962f9a7f29231e40d3a1662d14ae2fbb75d35ae5082f1355bcfb4b544974b2d84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e613dd3b556de671d6d0123746105507

SHA1
ceba0d1ca3b80370d546679aee1486b72f72ca11

SHA256
2a9930fea51d137ca190cccee1d6e7ea638007fd2102969e595c10c5724af108

SHA512
1d4643c84dc87e81340d54db2ed709ccb0a8b49667c39dd4d6c759a58e8789e40f448cd9872b4c9d201d5873fa0e654a44d92987e0ef24bbf5b34c15a6fc58c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d4b364e1dcb352c6e90491f627012c8

SHA1
54368cb5d40bb3b03d885f36b2594a2e1a159a5e

SHA256
a79bc15ab76f843b6e91809e4815aa7009835689b0fd141cf97cf55194566537

SHA512
b9e0e37ce4716c1ca2a871c41f38edd36b75890b326b8f94eb9776fc217ae50ab47d28f08731285c1cb13f1e88936b27102c1fa5157f04016fc40d376c0a02e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab69FB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6A7B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit