46e3039787eaf897e00bd96186cb35e22e1264251b198d4e8a29f1cd73334c37

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 11:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8c55848b3d02d178a4aa886b5de95c6_JaffaCakes118.html
Size

15KB
MD5

c8c55848b3d02d178a4aa886b5de95c6
SHA1

bdd5016e09d679acc22634b046368ef29417c1da
SHA256

46e3039787eaf897e00bd96186cb35e22e1264251b198d4e8a29f1cd73334c37
SHA512

59c5db54f6f22088a4e4335b7b591ae0e42cf2e695f50e18d5d6dff0a5a13e48da6b69bcdec8d8c1b27b339882d635f51d8eee1f651ea9c44a6da902b94afc82
SSDEEP

192:x60Ua1HCPpDrr8x3qgtvW/OrUjLsUCR/tm/G/ecaWxD6kDK1jsVNOkdzldlQi+UN:MJP58PlG9tjsN+AM/a8jkE+MAEM

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7AC4C5B1-65FD-11EF-BD41-DEC97E11E4FF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431094350"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000a7f3d588917ba44e0a998137f522e053e91a96615c48d0e9c80d5da5b17cd452000000000e8000000002000020000000872f1dc6ff36e5a5b45ad11940ba72d902f5636578698af8ec8ba5c33a6a8d4f20000000e270e9d8d2f03231145e6a40244b9ac9f841543b3287e9486bf85a2e910b3012400000009da7a183a98a0255e159f8b1e1b17ee3f4a09421b7878b481d48fcf572e9c13ccc2309040918e1f5d8b121599286c8fbc1ad6fc3d0a3aec4871b946980f499b5	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000003319eccdf6327ca2d43f6f8bbae1ff46937f449454f5a624203d61f094508cd6000000000e80000000020000200000001125a3a20075b2b9d53c65e904ab8bec020a1ccdf94c0021877064cf669ab78190000000248276fdde49b88405df4a901d890c8c1c7c93fece80ee4c20924855c43d5aa8a735b9b06010a58481ea7513f25c1e39db19a67356074d78a48b5e4b93dd161802995f6fa6d41db8eff80412b881e9be4a827aca779415a49a6ced03c1e18573243df521cd0679f54066c0f2482957f9ebd2b1b179eb04cc007739218e02966d2426aea1f43907065c0ff39ba7ab23f6400000003df68636624c3225553cddf825bce46fb47f293f69c767e6628a0a52e07a67c99f153d2a7868cbf1e083418fa02d48b6c721c3d1463c9eed96eea2568afbef1c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 608e1a520afada01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2432	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2432	iexplore.exe
2432	iexplore.exe
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2776	2432	iexplore.exe	30
PID 2432 wrote to memory of 2776	2432	iexplore.exe	30
PID 2432 wrote to memory of 2776	2432	iexplore.exe	30
PID 2432 wrote to memory of 2776	2432	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c8c55848b3d02d178a4aa886b5de95c6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2432 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a1e6e098de3f3cb91cf8af7a566220d

SHA1
6a96195a6590ae5d53b5315b5f1845429e7014a2

SHA256
848f575216f472054486ec8dbdfe9c59d00a6e77d59c8450a074e5efd758fd1c

SHA512
3d7626d443f66aea095f523f03efae114628c9aea1f80675eb73a92023c89d53c8abe8b683abd7a75fd81446069154f08311831249d1584793f2f88d7c140cc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c745ed6666fed4a771a848a5e975da84

SHA1
dccc00fe031c07e7f9ad8965d92ae1fc10421fb0

SHA256
29456e90c772f0a3b021f1f0044a316268c42379e0de60ac0f6948371d5908d0

SHA512
7e089ee770be95857bbe7900d32e44083858124475600b3504fdc0fe07229c11e62a645b9c1a024a36563f8a1512b7e8f68221827538261bcdf6e08bc6d1c146

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd3a1ef72d88de74a1ff25c65236daa8

SHA1
8a171f0f34c7dd768243017539f2b80664b0e794

SHA256
ef4ecdf3c2c495d774767aa0fa64bb31abab3f649daa9ba9966a526c0e615dbb

SHA512
9c5a94cbef22ddca527a3dc59f9090b6ab7902626af5095318d50a52b4f085214b526317e52bc2aff46c859453c3ed3fb276e634978029294ff30c16ce34440d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
298e364f9b82cc0fa2d6d2e58e007a33

SHA1
99acd64fc35705347923ece949c2f078019ddff4

SHA256
2aac13a0cd2381e631cf0d0039b0295ecf598e901a7174df3eeb0d10384796fb

SHA512
b0f3046f0a0be7edef18a612a65b42a3a61f4858f0ad067a263f0749cc6a63f6900aa10efdbd5bbc7c8d8afb948f79d3c54f43d6e499b3f6bc497d4d676bbd87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e1ca6e7353ad2e2fcc5b34a98079b21

SHA1
59c8f300c31e930d1c5ca8c5c6bdf2c4ad95b67f

SHA256
78b92dd2127f0b77c9ec8701facbccc6985d32b92220d1c626cda8145f8daa28

SHA512
8d060e8cd89fa46db99a435d762f0989aa8dd453c81f34f187d9a6f633c0399fe6ab57641dd09d30169cd0eb8f4ae12d6c9b1cd603adb42fb4e165cfc951ae13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98fe5ae269947baa4e796f85aec802b8

SHA1
2bb7e08321604da02275971f1f22972c07d43946

SHA256
5cdfef89df00ec91ae082116d1851421da593e981adf1f475d72fd4f70f48d43

SHA512
f2173c3f97fce4f0fe05dbec084221e05d44edb43056e2f712295acdd4701b1af889ad4447b7beb303441f2e30bd522b4cd9b8106bb4addf25cb7a77ca751c94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
578400bf6e19764e87d60f8ea3ed4837

SHA1
14a2c883ce792c71790b7a37735235fae41810d5

SHA256
12b5cc8037b3d20417ffab39397fcbf8cfb7676d931ffb431a4a29a7bb73d967

SHA512
805d64ae902b52f81b26717223934ba654bef594320f5c71aca74b04c474bc0e8355c6277d93708c9aebf884e6b34b3290f4a9de621cd7922abe7a910ef93349

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
383a95c6868b1d4b517be92383f1bc62

SHA1
9a2ea95559a3ec605dca2a82f75707e30f63259e

SHA256
fa8c6bbd0abf846446fe359c6cd87320a054b095cb96ed88706b27bc08414d56

SHA512
2ce9599fad5017fc9a6fa56a7ad6f2032132efff3497da93aed03481eaa975dea63a24dab046d8d1181a86da15122cfb16c26c1ceeb5e3fef908aec449fb4ef4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39b1c4428323de4c821e4d3c5ba60bd3

SHA1
6ac3961313ec7be0ce9fe02e8284e4bda04779b1

SHA256
4a44409435a663bfc0c1a6ae2c894bc3862e37041bb7d1595ab1ba122e664031

SHA512
8eaa2960d93d652ddccadc2f60e31402464f3a1440ce79cf46cc8e6fd41ae67802acb3d382a7bae31e0b4a2111081ad0c2c4a077a3bdd1333d65590f220fbcd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20eababac6ce7f794cffb57a8c47fabc

SHA1
06e7570e091dd709f88c0b242d0b9f84bfec89fe

SHA256
c2ecb24fd6a97d1542bcd0182f8f889a07e663653ac6d4f5bab7d7ab38eb3d5e

SHA512
2ad1c040d0647dd8bafd745bd53e1914683eb5d70f3ac6fb874157b0def512d941f23692300e84c484597b6fab39e5b995278ea71f20da4e9f065735205f1ae1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be1192d93af7f6c71bc4f0b0bffe3f37

SHA1
02ba4b3bdbb483eb66e1d378f677b86e00e9a6d4

SHA256
174c6ca2a4ab4a371e5a1efa30481007b00f3e7378ccf0422a1b47969b11ff30

SHA512
aaad516ff7616ca01026b6870bd95844ab8656b0002bf616530220b4caee8c79fcbcc9e2757da13f2f18f83af810dd1ff3d192ee94df517e90110cb40fd395aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7523.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7610.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit