5ca9ea8bd735decaec6eaadbf4ae7809eaf6a3419c54d216bcc8b28af2caf7d7

Analysis

max time kernel
88s
max time network
154s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 13:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c8ed4f36fab8e7323e72dd33ef6a23ef_JaffaCakes118.html
Size

461KB
MD5

c8ed4f36fab8e7323e72dd33ef6a23ef
SHA1

a88d0d344b8ae241200704aea1ea5c12a093218c
SHA256

5ca9ea8bd735decaec6eaadbf4ae7809eaf6a3419c54d216bcc8b28af2caf7d7
SHA512

be6a3bfc8504fa249ea3a8ba0adb718f38f73a47af7da12f54a2698551659e24e6815f8540195d44477a7ccdbbe020bf2a45a9d9400b6ca10b9fb1c541c13a9a
SSDEEP

6144:SXsMYod+X3oI+YBsMYod+X3oI+Y5sMYod+X3oI+YLsMYod+X3oI+YQ:C5d+X3v5d+X3L5d+X315d+X3+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000a43c66d98cdb57fd2575c6a0f6f07c4d0baced0f761a7c6af6408ecdb8ae7c2c000000000e8000000002000020000000c710906868dd55fdab8647d78433cb6cabd7f1ce39164e13ea624b635c4a8ec020000000244cc14ebdbc70a0a02f5ffb26f62c652626125bae0afd9c41a6f67e9d4fcb19400000006f3700e75551625d3330c2b4d774e133bf1f31c7a8cec463167ab3fe31db1f0a1622adc356384aa1f4135fb642d908e280fde3d6faf99f0d532692b452a38eee	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{17835B61-660C-11EF-83A8-4E15D54E5731} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000aa92ca8e241eb842465beca85be2760235eb8da3aeedea14a3ab815c708da1a1000000000e8000000002000020000000531962abe86827ee49b9dedba937fd147f5d719310dcb521fc6f374592f2a9a490000000f13d02502ec9fe8f8167878c99f08fca59c039ce2c1a81e8a0f33168d2a11cd597c68264403aeebebee781384cf2feff9f32f24b34b33cdec13beed068c7c93d0815b59fc22f39c272fa578c262d5a587eda21e9b0dadf67a5a4a68920992ba11e51d69ed37e212032a8ed67f9a4315506bf13dfb8ab4c5688fb6129e3fe0895b4ab07141130ffa769f8d6c98d1417364000000070e9ba1f36117190bf846fc42bac301340c8e152fd4b65bcaf419d183bd1c99625ad9d1be17984706a88024b0af7b7ff95b3cf1afc5b4868c69fdbbdec051a56	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 603283f018fada01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431100647"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2936	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2936	iexplore.exe
2936	iexplore.exe
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2808	2936	iexplore.exe	30
PID 2936 wrote to memory of 2808	2936	iexplore.exe	30
PID 2936 wrote to memory of 2808	2936	iexplore.exe	30
PID 2936 wrote to memory of 2808	2936	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c8ed4f36fab8e7323e72dd33ef6a23ef_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2936 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b9e46b3a54cad79482ba03d356e250d

SHA1
f9a002886654c54bc6c45ea25b6257d04aa238be

SHA256
3f9d623e5a80ee3538aa8e37cc7280b26d65b18ace99a38f7c3b493bab2e0fcd

SHA512
181e0e5c9d3b860be558fb4aaed8c74655f74e5183bd6868b6c94afd837e02fe25a1b8dd44b39668328e82fb84744e8131170135a3b0a4cdedf909b2e5684524

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df4b19d9f705e4324e7bd7b69a80c97a

SHA1
35d4ac2f8c7ec6a772c4276ee7274c31b8b14fbd

SHA256
9a52dbfb00d587cd9729896f0db30ce01714dc9ffeda4a42540d8bfb149e3758

SHA512
02a941ddf9c5a1f4fd260eb27b173f368ffa6d46a296e5756ab3fe3a8fccecef1d3957b042b0fe11cb5a4176c96d3dd00b5df549ca6f37338ebddb86d9275ed3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
abe6ec3b5d976082e0346e85100b9c98

SHA1
f289e66c23e661b9e3bd639239cec82c6530edf5

SHA256
3e4e20195dc1a3c10a8c9d1f5cd2cd2038f9e5387850efddd871e0472fcd8c92

SHA512
dea6235b15391fd23971b29d5b74179204a531dc844da2209897641cf4796d6e900332c71523e81249674cc1aa41cb8ac9275a4024bb8b4ff9ec10631bf3b595

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
560b2c993ec42b83fb08530f50d2dd94

SHA1
efb20e573011888a603ed7c12bf043214c7a8f31

SHA256
c5cacbdf3b203d773af5aa20d6802a8a1d3e02767cce0585f206fe1707ac01d0

SHA512
6a6500d5e95159037b27000e01d8d0228d2df1735e4812a1ef8593528c33e1155cd49d14777b50dc40bba10367f71ed43145f28075600a08589cd06b297e589f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aeacc7f40a8979da7ad808da8a83362a

SHA1
5efd40e595617cac7fa0704192d26eb79119d820

SHA256
0b4e0837a76ee50483c68c92d25c9f9ef49e2da844d7479a66b4160e7e0c1511

SHA512
4df881c6672f45a88d414e7df9904ea6c548e3eaa8c5f896971fea15d764eef99ef96ba409bc750024880bbd832e116430928d54252a141b04219f65c172eead

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f2ff2a959b8ca12e4e3fe81021a3635

SHA1
02de944290f753d52e9676984b958932935934b5

SHA256
ad1fae24b779e72e5cf640dbdf5ce9aa75006392ce85c8814d8db537488202f5

SHA512
ddee474e441cbc7d4cf6bdac5ba3f41b69cd95f96fc51f627d34ceeb8386c56746c9099c32a7e01a627d2560557bb7cccb4aacd059fe3adb005d510be606dbcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be11b7431f81afab2fe2f505de7725b6

SHA1
d969f0a250db8f1c029c886e28572307e963a804

SHA256
0239ee8948342dfa86d7cd5ce7659b83d9d4bf969613e1e4f13614ccc36b7d54

SHA512
f75be231fb3971a2dd7bf1d1ce60667aa81b72542a87ea99e3708b7db65cd32818a1610f961e62cf9fe9deacd38261c0298e031e57f4274db798a3fa0a4741ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91d3147be53230820e5c82381c046a5d

SHA1
a4ba6d66314c61f58f319164238d0a14f57e8721

SHA256
f8e7d5637ef870b76cffe89e74a7d847953a1ce381f1b1c2f9d4418762984aa3

SHA512
cb1627d323a2ba5f531768350661e7368939b4f256a8670db5383be578161cf4988195fe21722cd5c09aaf4246e69be0428d808a85944c34e202b4fc9d746ff7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8239717d82dc5b63292b1ccea470afe

SHA1
a0337cc4ea5b5c7afa769d70d719806d9282af7b

SHA256
4db97e1da6fab19390ccea24d0f94b60ac382ae7500fd86fdf77e436b6df28ed

SHA512
80a7fd2cbf57546c20937967496ff2ca41512ffff4c823654c2f9cfb09efa9772a3983ac7024a8f3021b4e1afde9966b9cca3307e753c82483fe0858f02e57b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b74e8d1a8b46019e3bed0b367177b4d8

SHA1
ba20b69caf6c7cdedb7304cb413d911fbaea6d39

SHA256
766a2b0c5cb24d6a7efa9a3ff1b7cbc21735f3df4fc84353e9e2a1d3dbd0c3c8

SHA512
68752f631903ff164a4793fabe3ef0d3ff94089f85af0e134ac12758bea815aa0487a82fd2d5e20e9d336e19c1c23e8f124952619563066ae17473cd2195f2fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
209d2c53d9b486ce0549843421191685

SHA1
357353f6a85306b482ad189e4ee880fad1d00841

SHA256
3d1e35f1f1bf667e4ed6c2885307218d9132336fefbbd4155ae42d62766471ae

SHA512
a81c4232fb2f7275623c9122384b4e93310c9dfd2a0cea9e5485313de017bed0b7fdb103cb8df155e5b1ff505fb4bf5d395592444f9b2c152f9eab30dc874e01

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC19B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC26B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit