48447e9ad99a9dbdd3cb86849a8b30a5b0c26625dc0c641091ed97bd268c92d8

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 11:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8c09f36ade4c7224380c8054caa7f5b_JaffaCakes118.html
Size

461KB
MD5

c8c09f36ade4c7224380c8054caa7f5b
SHA1

3f3638f52933556174d9d111e29c75e605153d87
SHA256

48447e9ad99a9dbdd3cb86849a8b30a5b0c26625dc0c641091ed97bd268c92d8
SHA512

2ec417c543046e1a2199f21c2a175a105c0f4d6080273e3e37662f57f54d535fe4b7a96a99d32f909c8e63c49c605d1e25a4082dc44c4d4132df7d621a79db18
SSDEEP

6144:SxsMYod+X3oI+YjsMYod+X3oI+YpsMYod+X3oI+YLsMYod+X3oI+YQ:I5d+X3F5d+X3r5d+X315d+X3+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E14E7211-65FB-11EF-A17A-428A07572FD0} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000d769f42ea974e0cb1a6a16055704d6bda6373ff5f8a9a8de1e1c9f826db295bb000000000e80000000020000200000007b5200e4f84a5cdac70c69a97db9c5c0d4184289cf1adea1d4fb57ebb06df0bf200000005372bab43bcbac22a54ef2446f404873aa1696ead626369a390bcbd72e06d28f4000000061c8fb468c11a62b0e5f99f041c6b0f36ef604e5df0967f79e3d74788678552a8a9169dedee981aafdbae556d7065729531eff2dc453133490892d9561257742	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 503ed8b908fada01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c920000000002000000000010660000000100002000000002c057ede491bdc5afad13bd530e53c6d6e28bdecaa08f7961318ad4cf3bb7ed000000000e800000000200002000000076dc99fd09975e83c28fc455c451431ea7f060ee2c02fe75222ea7d323ca6d3e90000000449d8f7b83ffaa6a423b27593e9525ebf3db61a33e7ef104b5b72b00feb1b16e8730fea5f8eb5e36721d4fe9d079c15c1773ba850eb75ed7ea7f339195a2c14b98892743a59517eba9a699b20d4936997e14d46900f28ba72123c87150df0a1147837e6f55c0f905e679c7dba4465da1fbb9a712bbcaa0f1f09b6285ef4626f9e22b8b4ad4980b0e6a3a270f539a6ee740000000891a36c4af7782404aa3753be11dde385b3c52d12a331b7017d61846ecc781bb8b95799f20487720d64b222a8e9cef311bb5a4bec7b84d4872cc427d2e3ca9e1	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431093663"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2716	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2716	iexplore.exe
2716	iexplore.exe
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 2680	2716	iexplore.exe	30
PID 2716 wrote to memory of 2680	2716	iexplore.exe	30
PID 2716 wrote to memory of 2680	2716	iexplore.exe	30
PID 2716 wrote to memory of 2680	2716	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c8c09f36ade4c7224380c8054caa7f5b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2716 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
995ae39b23ac8a5b62a53650819fd04b

SHA1
5c1e708782cb248d55268f29035e3f059f4b9d7d

SHA256
074520402145bc8105890f8db173426ac56b11e860ea0606dd3101b354fa8c6b

SHA512
33ad9081871bce8baa6e619f701ea3989c99726e79d67928a78c0c83c4d87da21a86166da8421274dd876cd08c593566726f3d5713653404b3818b5c46946142

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c84eb45e98f3cb2d714d359e1c43263b

SHA1
9ccc4bc672bd33aab3bf1f35f1289b20b05dac8e

SHA256
2e118dbd7c2895619d99186b909fad1bc636415e4072cdeb766396ea54e2b12d

SHA512
bdb05152010022536ae11b081dfdea85515771c57c543729e1e1767f494fd6be423c669f345f60654ccf1b318ae3c3332acbf376afaf54ac6a292b4ac07f4f26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1bd83bb19c4cebeaed52d1a883644e7e

SHA1
74b1d151e6c1320ca79b50faff9d08ea576de6c7

SHA256
d84beaced27dc5b9f2c455c5cfc1fc6511cb68f60ec40be5f0dd02744f761464

SHA512
3e8bbee29d1f8fe7cfc064fd6f3bb3839375db08d1780b80d3052c06ede19a2b7c9996772c0c58622be8bc093474d4b710b8274f1769f42496b61237b9c71bb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad16b2a85641f08c84be969c439e9215

SHA1
fdc19d617bf0aaf9756d33e60f5824de2bbad86b

SHA256
c2c1e25b49ca32131bb5de219b309f1c059178e2ce3930ca224d0425242a1e7e

SHA512
9f524d613213c10481b4dc1297ffd8c9351de7128724179ba29fe44e41cebb377c9fc5eb443ce0eecdbb9c8778945b96834ab99f4adfa1237f2f9af1425cdc01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6873211ddcbeb535a9aa45c589e27a52

SHA1
a5515e29be9401cebe5be83524f4bf80abdb3c59

SHA256
ab4337a826f0b3e0cf6f218b2d4afbdfbfbcff1a32eea1410d7f728c926264eb

SHA512
112bccee5d38c65ded9e05ddfb7edcdcaca9eb6951bacd5877c47a9335c142451c36255f3a4915a53c876802b836a3faff41794fd42ecb6b867591ab5881bfe3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93172bca5aa4a5bf038844d17d642a86

SHA1
e2ff90ae568fee17905611b06e54d9c9a5a9583c

SHA256
9a39f46785e9f3dd2b54cc23a207cfe988525cc8f8f7447a1b541ca4efcc30bc

SHA512
4ef8c1f309e619e6997cca404b6d742c50fe8fd3431a3d35f9b0a5e59428ba9a4720e97cd32505f515dd9d11d0f7dd91be9335c261b554d4cd04b116aeba179a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
700cad8fde54961e78dfeb2c14d62e51

SHA1
7acef7c4d0f804a3729968534b29aa53bf86345e

SHA256
a1108a52dc16332818b0e862eaa422182deaef40c0b83087badafe59e6da48e4

SHA512
3305c82108d1e44dd43c03b4403aae3e583c4767065062e4a206f3c23b849225057ee2d38cb1077fffaf592533f3562dd47dd9d33f88cb476edf4926cf2917ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf9a49dacc548471239c863b932a4018

SHA1
b91a0bd9091e9f0510132e84942d52491b3e4e3b

SHA256
8a257063e308d1bf565e5bb656e7c65bc6a6a832b33643b3d43619a3b8b4d778

SHA512
384d5864a259bccb65fe469c2256d6c03db54264168e9620463ac7f60c21643b04a6c01892e4c1b0d26355b2c57391cac2b6bb53e9783d7b1a57ee8a32bc109b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb704ddeb8bc7a202e7490f9a051c5b2

SHA1
a9c958e89101a6298cf0c757a75f47ec0f5b1480

SHA256
58352415ecb04bb680cf1a14393cd1d9a0ef64f17d56e32ea1edab37fbbb75c5

SHA512
e611c7eeeab84cbfb137adc4731df585271dea667fbece1a8fb132f8d0050ff112bde02ad3ed8093911a6b6bbd4bbbc1a67199eb187ef7a8d57a9d9d4b40a21f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17217dfcdc8ef56ba8a547ed508a363e

SHA1
8b224f0b547f577ebcc5d34883ee85fb4f1d8f02

SHA256
24818315fb5232957663f109b22ff73b096c1b528795eafd053bca3b7c6ae78d

SHA512
88db5ceb109f54483dfc8a597b0c6caca3f36b5cc5ae71e217075b6985e2bd1d4f93d6a0f071427aa1e598377f4651250bc4ce472c4438d51429bf8cd399d965

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e14af7a2275dab2dcdec502bb88567a

SHA1
c4f300114558bd104b3ab9dd43393855295489a1

SHA256
2497804ef578ac0474e8ed0b24ddf8d5e9110b78d5eee118e476d70a08bf4fed

SHA512
688b34a3800aa0c6d192859e017c49e319c0917ae637b10aae826c063564b89720e6f00a173d49049d5656e952a63881f4ef6bcbcc9be4d6b5a9724bce9b95c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6C9B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6D0B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit