94627c087ce6eb178c54ba530f124a5ca9a932f07469b6383b03dccfa0d625f7

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 10:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c89fecdf14cbe02aa0f8c7f708c06afe_JaffaCakes118.html
Size

292KB
MD5

c89fecdf14cbe02aa0f8c7f708c06afe
SHA1

eb41943da6d0a4a9baaa85fa2215bf8f375c05f1
SHA256

94627c087ce6eb178c54ba530f124a5ca9a932f07469b6383b03dccfa0d625f7
SHA512

18a3679e913d938b4c4b5170c849901cb2a5a6143b3927414d344483a7f363adc405fcefd43d0de21f5f61a1f3fd8b9f4d0a5f7814745004ae413c45ef43e825
SSDEEP

3072:sdSoyuNd7HmsTEZqvyXvuZwle7ILtUqmTlftmRVS7:5oyumsTEZ7/3loILtU3

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000009e44c113a664aeb662ee8f61a2f414c753b7397da47da5766ae4bcf5195f8fa4000000000e800000000200002000000005adcc71afc535bad537cf01e273de2439664a5ca888a947b9144b871dfde97720000000c167aa72408096f3fad0da48a998c2c69dc83d1b26a8c2998508a91d84e18535400000003f3fbff775387fa6e96d5e760f8d7d3a0a296f282173d7b52abc3b5aa16198584f835c7daf30846faabb23def54ebac330d2ac72a1c8147ebc617c868d34d8b9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431088292"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f035510000000002000000000010660000000100002000000060c6f788c4f3e4fd697f8b201d2f58a73b55cc4c90447746c7b93c3436a2bd8a000000000e80000000020000200000005982c3a184bea33b99620f5eac8ebff825b5c4c0a78832a19bfb782f1b4003e09000000002a4c6e3bb81fbdf5dba40ba1c36344cfa384434733f2d1ef1de3226042bb5f08bd26ee9e37477936c2ce716465ed75fe689f20f1a50b94047cc49074d8bdc74905f2a773133c1538fcbbaf282c2278d4bbbe1e39b520351e45174de2e091d85a8a67cf167a520fa8d0a48c5bd6e8c1a5a91f4d7faedc838449e415ae36e5367b833f6627f13ca1f00bbb122cdc5c014400000001c8c17281b3b98c7131d7aefaa22c0afe23b77b001d20d766cf34b03e23edf13527a5bc1f93e22ed4137df490ef4a60808f3d2b4530e1bae6faa06640e8a2b02	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5BC958F1-65EF-11EF-8920-7AF2B84EB3D8} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60544646fcf9da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1932	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1932	iexplore.exe
1932	iexplore.exe
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 2384	1932	iexplore.exe	30
PID 1932 wrote to memory of 2384	1932	iexplore.exe	30
PID 1932 wrote to memory of 2384	1932	iexplore.exe	30
PID 1932 wrote to memory of 2384	1932	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c89fecdf14cbe02aa0f8c7f708c06afe_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1932 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

Filesize
854B

MD5
e935bc5762068caf3e24a2683b1b8a88

SHA1
82b70eb774c0756837fe8d7acbfeec05ecbf5463

SHA256
a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

SHA512
bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
109f08505e0a8e1aefae1ee78fbe4dd8

SHA1
ec823efb7b5455a79e93480f45d17eebef52afdc

SHA256
6ff611a645494d3293c07e8e10302b0e2ee1a9d60917d49d0843d6c73c557c0d

SHA512
aa1803d9da8900613c326e78988c7ae32b5c198b951fbe60aba8a47e6c2357d9b1787efa7088eac9ce97c942ad42a22da3eb4fdb1fa44e0ce20e6e78fe0a2428

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f774121ec4717c9134330ad3cc1efcf6

SHA1
955e0c5ea00a88e421d49fc24ac6f408185c14f0

SHA256
e5694b3b771c82240030acff81611c6588cb87306ee8c46d7345e81f9a51b80f

SHA512
84dfee7832290cf4f1ba01b0b148abd7230cc5923525a5c95c7544c71ac4eff2bd8b8085e9dd402e29efc9c90ac78eb3933766f5d4b5a15a2fa39fe80fa30cd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26d07c77fb8552bcbc77dc38aaf01773

SHA1
8a2f9eac7ce294a98919f415ea4cb3d360457209

SHA256
46e22a97a53b84df62e042bb4a3091c8c8eade76e4e3db3520a15889895ef1b3

SHA512
e8caf2d4d4f7cc7f9f38d5b9c1899fe3b92da3274b86753fc1d1c236490d427588cb2c0af145697e362d6ee222842dd18a05089e79f473471dd89fdc7bc356df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b741d61fa651002b4d4775aa65388c47

SHA1
a4bb150cf6e26ee0714eaceb7710de0fd4c6b822

SHA256
0a475a1e554d1a4699d6403f799400a28c5d69f43a5e6ab522c7bb1484456d58

SHA512
0f7283950936b5edf0108af3588fdf3555bc219662aa0ce0ec58c48ce56528a742704b69a2c0de2cb858d9c7a71bfae8509085e1c08d72f9313cc4872e234f6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ac08136c044990f32aef5eb57450516

SHA1
f6beeaadc26f1b343bef1794b58820c5dafe6393

SHA256
14f174b8dfc776d934e63ec83fd1ec7a04ed8c97643a7e1bc0d00d62a0cf13f9

SHA512
e851ed0e3ccd8748bf853df45ce5fc896608d34dec09eaa10cbead25334c75fc86e8b0b3694ad8b23998e4c373d2e2737c4eb8e3aab01daa4bb275c30fe60d96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c0d6e3750213d545f82b7a06fe3bd5e

SHA1
1b9e94eec26ed2bd85c5f20c643856ef737dd9df

SHA256
db9f0b93c2282f716be1f328dcb5bff27f9b18df58d0ca49d0ccca40b9ad7708

SHA512
d005ed2efc2a62d8ecf9a6f7667d33a94dfa4763bf29d0d1c65d88550936b94e54dc6aec4f8301ffda71417b362ba2ef8a9a233b1b013d4bdef288437c86fd30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1b8fbb4c22bba10f73530ee20a9bc20

SHA1
64080695e144a50897be3f712782651efe7813fb

SHA256
ccbe931000e45a3eb589c77d254eb9aae90d4c84c3302549117b29ca83546e41

SHA512
49bf630f3a6ea7e684cd0a0cece22ca92961bd1f2a13c1273e8fc251ac2777bf181d237fb099fac089dec8dec77395b5a9f04b4266bf85d7b843398cffd28b41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
495be025ecf8599ae4898476fd1ad5f5

SHA1
6488320bad3134a535bf7d97ffd8bf5dc0eb99cb

SHA256
a189235d495be2f620ee1b5bc025bcce43eae5d495ef00cfba3fd9e5c3cf6321

SHA512
282596527fa93446785087b99491725e25c19ca421edff6495c07db25a38882d73af520e3c7c2b8184169e1e697a3a4a1aba73a8a6fd091c3afda062d045258d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4dbd2b21a16b297c50ca2b5368a2b605

SHA1
c7f4f66a4b2b856ecaf2ca014f970dc982f743e4

SHA256
52b83c54989e77e057bf8f9e740c11f2f69d3bbf81a3783446fed3038172bef3

SHA512
02ed99ade7729296fdd05b82e608d6ff29dfda458d9a0db74dcafcddf6137dddbf9d9f6c34f1633fad9cc1280e77b152455e3c4183655b0550c67cb02f9cce43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d73ba3185abb0b2c965d350f97153c0

SHA1
536afe7455c4789cc140dcb6c0848b432b19719c

SHA256
daafc71af5423822d6c180ff35b604b56ffdafc556230f9a983dc6a120dae83f

SHA512
989876407c76060713dbaa9660ca5ffe52e2de1f3d4ff03da49a149e0ea882220fa95de4989967021d15e3b5162efdbc98d13b35798e287aa2c1a15827aa2956

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
daff7f7cfe3bb547e95f5bd04660601b

SHA1
17f303d72d9dcc966c2803732a3924d6891d5334

SHA256
fa616332a75131b9cf1a74cc9da68d0779145688b427dfbedf5b794185357a13

SHA512
aa7845feebd82ebcd3a745b1a2c81770d8e63699f96302dc46ae1fa06309d7aba47b285e7c03cf329a3f9757e4419511694c0d82e6a7a1fcfdabd3d7439df89c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
793d1d114dbf70e2dd17fe9f0fe62012

SHA1
3227b0d99b57bb19c3133d3b84f06a5d73929090

SHA256
8f0e8b99785c833375cd277b96ebe2590169158bc115b166f70739277046ffb5

SHA512
97cbaf914821408bc6d43ee08328fe8285348de8b146dd8803ea414bbfda241e7ce1015a253c774f677d91571901f2afa1ab8ed35eab77bd8d9769de01917605

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB166.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB178.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit