05f9d0a0868e7092bf7c2f4cd9630da8da6f581b5683f460cd2a9f37c0bf230b

Analysis

max time kernel
122s
max time network
139s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8f09d31027ffa3be37fe5a8713355f2_JaffaCakes118.html
Size

92B
MD5

c8f09d31027ffa3be37fe5a8713355f2
SHA1

13ebd6d7b190d603377f6d500bae3c33c0dc26ce
SHA256

05f9d0a0868e7092bf7c2f4cd9630da8da6f581b5683f460cd2a9f37c0bf230b
SHA512

4a0c44a39733ba5074755ca769190fcff5690fbb323dd7e61a9d9d2911aedc5f6ed172fe5b2a6c71fe3335023bb2cedf20167f54ffa468d3e692e5ad4a357732

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431101086"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80e8f4f719fada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000007aa3074ef8df90946f4326f5e6fea329e834ef13140afd3826384180c0d8cb10000000000e800000000200002000000087e9be829e20b89ba8eacd68f3a6257e9087fff944aaa6f87f81e2ca11c599e120000000d1abc23311da54416fbee84e6abe1cea2d5e3392ea1a8e56cac66729cd8c3d3040000000217170bc1ef0fc000ffe7eade7c811d67cd8d5f7060f61531df4d1ee48879d8d2eae5428e0a0591a4e4f2b54f41b903ad467d5d0443238a9d1d5384d6dc17e06	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000029c06fb91381869ab36afe7096bdab38e6e8a72ebc72f633d0672a672ad2ab0000000000e800000000200002000000043d043e78f62df61507e5ee657c005bfcc540af5c30ab4eb443c13d08ef3c7c69000000080a1037a843cb8b6d65f2ef4227863af63bc76c8999907417eb7d8afacd4c55b8f0549c3d3424853c7103d1110f48384c7287d2f72bcb8a46edeefa2ff815b5d82067d79cf094eb647f75f6a1d5f85294655a425bc4deeaf347e537b9ede4f2b03f1c5d3b6bc923246621f3ff6866b5575bb51d5a587e0b360ac8e2176cafe2df2fc0562b046128aaa932dc41e0d9aa240000000e56d37249473a756a296680a6d4f1a5657a7874c8391b17fcaf2cf942f98a0b3f7cd43d9374a7df00a620b5c1e876b27342c8a1024ef03b65a61e2514c551710	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{275D4271-660D-11EF-BCCD-5E235017FF15} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2256	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2256	iexplore.exe
2256	iexplore.exe
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE
2364	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2364	2256	iexplore.exe	30
PID 2256 wrote to memory of 2364	2256	iexplore.exe	30
PID 2256 wrote to memory of 2364	2256	iexplore.exe	30
PID 2256 wrote to memory of 2364	2256	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c8f09d31027ffa3be37fe5a8713355f2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2256 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
a59070bad4f25789f8f72108431f059d

SHA1
6c52bab4b2d8920787d0c8260d3cd1338e74e15e

SHA256
522688f0de05800a34d7cfd7fe1ef93dacea57a0ebc2dc2072dd22e5722606b8

SHA512
68b9d78b6375f279366e142e8d3c5be40fc71e3e8a0d0d8153dc6ca2e09dde7cd1cc27073a7bab442572909e2dc55d1dd7b2a355af290629b2e0cd0cd4e3725c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
833f156c13d0a960fbceb3980528b2ab

SHA1
02e91983d6238703cbb62f77da7c0ee4e7d21fb9

SHA256
5b5acff6b758e1e43105b3956ae2e4e6d65bd28da9d041d7a157fdbff3e9e666

SHA512
f90b5b0e96641f525d90e3de8e87bd94080def343b343795ab0c587ad3068797bfc5a2e72367268888d318bc166c3456518d3cec165ae0ae8b23be89bc3cacf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb445ba8e5f93069990799047095c893

SHA1
f162f76df5bc2f0ea528f22b5bd2020b75c5fdb1

SHA256
03bc93b0e5d364c5bdf4acd85e41478bb56a7789e83067940f8e0222637d2cda

SHA512
d2a3a1e212859ca2d96f8228b89974d0fea0d861c74a252126b0af156115c8ae799a097251e9900738705311588c8254e8958f265825423652ce367d3342f6ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6010345d0e71757afaf8a522ef79483f

SHA1
ca6b4a63b5652ebc37d701764091722222b0810f

SHA256
21c5c25fa12bd17463a05efe363baf552af8c40eaddc57a2ed575be11ac7f3c2

SHA512
db7dc18039a32b4e7c42fc0f8dc1e39e78b20ec8ac20b7961ec5debb8701e25da0bac0f0e5c3b1d4d32d190f721005ed531db2d86bbe3ee814ff91d6c960bb8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8591b12f0d7352eaf063a49a65067a81

SHA1
cf586c63dfb1aa0599b279871043cbd3ea856fb3

SHA256
a91cc8979bc02efd816c66fe613c9b1bea33cf46ef484254b5af4d09b15e1d5c

SHA512
a1d1942c4f19e07d4cf933fd0d002470214cc7285fad2acbb9cb54500e3214b47a1a131e01fe6284d36826b27eeb4fe0fd3812ee5e040ad3a8b780b8ce0cb084

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f0696a8f11ca68e3ca5072d0bedd346

SHA1
f6cbeb809151f7833424e981f197d156d75aa6f4

SHA256
0ed967a7012d873eae8e616a3f636ccea896f8fd04c53605501736a1915adacd

SHA512
775af2e3a5861c5b46cdca98d7fff15be349e831e255ea9e5f41a8272b8b6566a883056a569db957b6bc7588bfcbced929c65243c4622db062f11e0c55e561cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fd2ce6bad58a111b095a0ab04653ba3

SHA1
d29f97dd23b5f57897942c75cc15892d8db72f15

SHA256
2225e7c157d2b118d0f019a0a8c467f1b18f8b9f9be778effd74c30ec2b0f18b

SHA512
38fd9c354b77eada63d857f67af07a5e86166ab576f5b3a83d6f47b60c9822cfabd49df3ccc214acabd967cec69bda00e373cf2ef10b91f8572f0b3e3de89a99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67ae099e27d658846f3416f27c7e602e

SHA1
62740a40cc6767a135acd24a59bb99be9cbd2294

SHA256
3cd53ebc5e11cce6b66f57d93e29fbacbf14b327b4c0fee7adc2926e84657567

SHA512
d0fe4e9a53d085821bc7bd097de08a0ace8f6f54be5773e6f1b31043111f77efc515d0cf7ba17b9cc420453c57f4eeba1224fcacf811b73dbdf94d7fa1f41877

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26167689c4ac6123be3513b403b5edf7

SHA1
1a7428f297d05453c7333069f84d55c423ba855d

SHA256
4dce90a6c36a253de5ebf63910015f029a891533926251766a8476167651c60a

SHA512
71d4e5db70becbcfc09ad59c409d9f654c384b2619fd84cf1dfe24c587963964bf0541a10f1410ca8a9abcafbb2a7c75757716079602345d01fd17aebf9e87ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
484ea512664914a082ec1c6a97b50022

SHA1
b47a2523e6625668ebbd4e4e4a43ff51ccf15a2d

SHA256
b2f8fb0811043e317403edc00ad539598f98507522f2ddad6e422ab9d085c623

SHA512
065884b2faff83ae782db14d8eb94dad15a74cfb75db362c48b2cd6105a183c27783262f882faac489d35f539e42afd93669edfb0525336fbd73e37256af88bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC6E8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC77A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit