ce031805f5eece32787eb5b1bf48780ebd5480691068a339175b3b7ab09664db

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 12:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8db61998de5fb390a531b615fdebdeb_JaffaCakes118.html
Size

10KB
MD5

c8db61998de5fb390a531b615fdebdeb
SHA1

065aea53f97d915a43d35529eff7ba61d2928290
SHA256

ce031805f5eece32787eb5b1bf48780ebd5480691068a339175b3b7ab09664db
SHA512

7ec6a72b0a4d839a596c475890434a12b06a0692fba5f5d4f5a59111a2e1b45ac28866654f6d5e070b17e83b7f7e935480bc177ee7ee6ad8ff6a14ee7cb8a6a6
SSDEEP

192:guHJg+rwzLiiP2QUIQXIQe1m1wg4lEKwcKOq5yXAudECHYoeDGHTsMhPT5fZfsNS:guHu+rqia2QUIQXIQe1m1wg4lEKwcrqW

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf710000000002000000000010660000000100002000000051ff08b8830e147cbb0d111e890d7eac15711c57310b3e45b7768331b8451be2000000000e800000000200002000000012524b9f2bdf459ff7e4044faf7cec54b24d66cd0a82b1ebfc7d354511de87d32000000095553ba99b4c1d8f5b53f67fbd93899207c856f4bbf3e2900630cb8317bf9856400000000843e98b57a3368d09f3cd247c39b07bd1d9a8b8d2a4bc3da41f973123c7ec6adaefe17751d974d9d0996bd97d7c664ab922fad0e29dfdfdb762bfdf42281b75	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf710000000002000000000010660000000100002000000000dfdc3ff69449b2a08e5969e4261b3a7ef284a9c3292df7e8c56518fa9370d1000000000e8000000002000020000000eb489896f0d6a27224570e63104ff3918a6339144ac682380c1fb427afb8257290000000e1b1a3a593757c72c04847bc88064781e921b4c991660e27d121fa8f9630d58c8e49d5966200b9505a2abc08a6af85a9f95f3d65ddb3713751f44228afb0b4496ce7f9560d8f0c3e53927738ab05ecc5dc5cbde294f5a584c18cec90109b5215fc466b7102927b8cb2971d03192959abc100e74c40536296f1178ff7f8fb4c5950bebfaff71ae9f0ccab6e987593dd5c40000000006469c749c72b08b442c98a239646ae890017f152f17fd0f68baa473cc34f3ba7d7307ebf9030a276de654f8855de0bc69c94c11ae1080d9727784011d4fe5c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{00F1AC91-6606-11EF-ADD5-E21FB89EE600} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431098023"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 508360d812fada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2852	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2852	iexplore.exe
2852	iexplore.exe
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2824	2852	iexplore.exe	30
PID 2852 wrote to memory of 2824	2852	iexplore.exe	30
PID 2852 wrote to memory of 2824	2852	iexplore.exe	30
PID 2852 wrote to memory of 2824	2852	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c8db61998de5fb390a531b615fdebdeb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2852 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1ff4474ee204a69d102f89ed746f396

SHA1
0dbafa05f37b590cb02d44d7b8326d1b9b8f3ab2

SHA256
0aaabaf1a80a8a4671584fb4d46e99ee5c4c656f1422a6a6980af96b7f9247e4

SHA512
39db88e7034ae5cef28dce0600ce6aea88d724ca51759fb97d86b7054c4ecac2e853f1f5291454680359dbc24158069109b6b0006b6c2f9c337ce526c5d3a762

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d27c1f69e1719e1d406582311d37f89

SHA1
24d001d8579ee9ae7da4cd548ee8947698e15a7a

SHA256
b8b35b8f014697009afff0d95c32d5531afddd44f4f43773e8bde933dbef437f

SHA512
346019d8bd8f36d1b38136fe3b63c0dffadebae231badcaec4a2f2879ac77187aebdc0d47473efe8dee640dfafe7938483667f4a8e71e04648740a85112df554

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3cd28aec1ab0ac70b61f7b3d06c705c

SHA1
38e7bf449fcdfab86cf55dd5c69f149368b413df

SHA256
c7ef24aeabf4b399faaf1e885847b9aeeec62657113d44d8247f928daa07444f

SHA512
0baa58f2219844b7cf22856f480fab7bb1c1b34e455eb97d2888817a98793936ff3a83b7c954b395b01257a4c26f89bebe3135696c89878e14137c43d6297762

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7dc51a9edddc44211e9a57e5361d65bc

SHA1
11238254b94d141d8aefd2f1ac62d697b3520d15

SHA256
1e96c7db31c78a0d6876ffb77defd88e89746f6686c026175aeecd687ddd6b45

SHA512
edc5822417c75d0e2507c7e25a60cfe240b69d795b160cc417fa0522685aca54533c0321094affababeae1ecc50a82614db5280f60d672c81deeabbcf837ead6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5587c9432f675056c280e04f7a28095f

SHA1
c77da9adc7ee3bc2aa0641c1c0c8b3c8af4b0eee

SHA256
14924d2fb27293fc7e8575395307ef8c39a1cf312950df2d71d298d0292d7cd8

SHA512
b7342352e95ca732852e7a96d9f60bd2bcfbe358375df313c63bd459f76573e8808db90a39f473442815c6b8258c322328bd231b2d496fd17b73054a28f9ed2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa50785d64bcb66e787eb7fc7cd6a170

SHA1
af6113b6f6266135ee1aea7f70b5af9a1e859b5d

SHA256
b329fe7fa3009e7aebf30a24ec71ad170615802112965f2078a279cbe009e65b

SHA512
567448f3c7cec7e530f3a62efe3edc0407ca44a3df1628cdf226a742a340a40c7324b9f40ab990dd05774d511c50008e70c70b41f279b1e0b30a8e8733668701

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95fd39289ef15ebda8399e2a931448a1

SHA1
a8aa8e3ec3fcb9bfe7b5c3bd45a92bd4afbbebfd

SHA256
9f757bdac73906116e586fb37dc7ca4033e8027aafe68fa7dd401ade1783725d

SHA512
d72747e65aa11378dbe2fe963acf6c8b3cabbd0f485f5ed008d62e7076ad77554a2ebcf1ecd9f173825d2e291b36704eb48793673df26e6e33c94ef66cf0bb57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e93546647fd60c9f88295afa4340d70

SHA1
6a960991f4b27ac5718c9b488dc47ce9cbcdc12d

SHA256
9de60e6711ca8295ce788e58cfad224f43c38473ba8f76557a484d333cfe0bb7

SHA512
755dc8610977c6922a9f346929503bbf271a4cc06c7c1d2079373c0d7fb769aeb5ca96c18b40263ac241c06367121f0551140278c92c60686f424bbf986ca6f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee3b1c2b77760cf62424d14e869df29c

SHA1
451a73f80b5a13cfe64ea4773b6a803feab6eda7

SHA256
e34a091b10a905d45bf56ae50cc84b2cd202e55ffed3d64e28e1f5169aa482d4

SHA512
ae7a33f9e5619aeadf4aac6151eb31dad053b5731bddd281468017508ce8f756c72fc1c5768dff65594f2f5f0b35192202ecba80e57e8bf5a0c7ea37652d6c7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b7ccafc455618637eb4143cb10a76c0

SHA1
4ec4c76de87c349f4c0ed1a01fd01b5e500549dc

SHA256
41020ded719d01ec0ddb23980ab52a662393af10bf7a4488d3ade3ffb4aa7207

SHA512
19560560aa69d67e8fd175cc1bab75ba093eb5144fadce919007d0ad9260a56ef49cb9627c157cbdcbde6ef481a1aa5246ccbb004b6e940b79f628293f8d0c26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
567b36e960da0b3a7fc98c93fc3a0a4d

SHA1
495a5771e1c14e5d0030a0c5c04a905b84fb929f

SHA256
4a86f744d79bd8d4c258bed8dc67fdddfabc0cf1bbf0e139d649b6159e6dbfbd

SHA512
e0d064bfe5e91702c42e6a3fe449488e3368f66c1db4b4154480ab0f0280bb7fcfdb5d1c7991052aa6065ff80720adc2a84e1000ba69bd17393c4a61cc2a1287

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8e0db62ae58fe4cc9d6fac703c873f8

SHA1
7fe971c958032a438b3c04f9d2a668d99731b228

SHA256
6847fd41b946ce2a03431dcde48c13273ea2832445a7c2ca38cd119383293c51

SHA512
c9dabd948e12a27ebf82e2310ebd2f6e5efc86bba94607c2aa28ee31c27baabd2f52b413a47c7f7691b31c615b8712446fa84dc831502fa38e0b61e7bfe86cd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7b211df06fb38080bad8c60b1aaba8a

SHA1
b4907363f1efc0c11bf2503a82c808366e17972a

SHA256
e4952844a2bcd39297b5de2ab2385b5eafd980eb54f83f3c3074485f9e763adb

SHA512
f11c2a56442d92ce5eb3c8ae4b9661e82239a518f81f4414c559ea8a60b4feb3ad2e06333623c2dd06aefff8358175ced52055abdb4f31d36f7ed6577c728ffb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2c01ed605256eb75c82aadd5bc2df92

SHA1
d6552b96efe516de24b704a3f68f13b4c1355df9

SHA256
18e73fd00a4e397f702a22ae5cc41edb877ef9c9d3275f17861eb180fd8350c5

SHA512
d62e1f3e8f851a9e27077442a28eb566fc534f030f2dcda50b1ecdcf6be34f95b23c6d7512e6270395a9164be62f1760940a86246241059311ed2e9604b071f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
377def5e31155258bd8e476febebd13d

SHA1
b7c16222e54a324ceb799ceb31c03c047f8d6a0d

SHA256
478c1ecece82b2e0cb488b2a538d11765def1d90f34dee1b339777db1055150a

SHA512
706a05e5495541779aca765c81a4392353b2c13c7d076b89962c8754068a7fb37001d8e0507b9f48b57d9533415b399f81d7cab0316e828bca0085359b3b2d14

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab57A4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5863.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit