56414bfbdd8699f6ef8f22e92460f3908cd211832dee2d020f0e2c29dd910355

Analysis

max time kernel
121s
max time network
131s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 13:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8ed8af6aa4a83eedf9b26d2ff5a9e88_JaffaCakes118.html
Size

122KB
MD5

c8ed8af6aa4a83eedf9b26d2ff5a9e88
SHA1

5806df491a0fb0580154008c1c5e487ff618e5b7
SHA256

56414bfbdd8699f6ef8f22e92460f3908cd211832dee2d020f0e2c29dd910355
SHA512

0a298e18ca7cd3cca2aa94d9265d4582fdc2d5fc5bb23e23f8209da609ed8fe4f6b692cdffe2e72003e143aa76fe963be93386c887c505cac5278003b162719a
SSDEEP

1536:SyutyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCW:SyAyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 804f340219fada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2D9BBAA1-660C-11EF-8334-424588269AE0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431100668"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000001e2a3a9c2b9cb05dd1ade1beeeab22dd12003a9db0883175c8ee267d5bda8b02000000000e80000000020000200000009590f164c4b723cc5ddc5abc70480ba1e0e8e58dfebf93818c666540875763f820000000bfdc21dadc5e8da21fbde169fb4ff8477bc1cd6f2711b27727255a1258bbe84140000000c1eaa385eb5f127405b278992c8e0dbea265d347a90a3b7a41a1b689757a2a14c77dafc14fec3c8b8466267171af69fa02697c05f934ee2de0b41857ca28bb2b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb470000000002000000000010660000000100002000000021685113228f8bf5d4bf0bc44d8e79a64f0da2d804dd78c57ef4d5bb31165fc5000000000e80000000020000200000005976acda200bd0c418082fad14b04c8a0f5bbe2a25a95f223e18110e288b92899000000063eec103996e308778d47f72686a68bf0f9d137506c85c43ce553e87c6f988899c729932fcf746bc96c8a558b2bef46966679d8665777999ecec5e3525e95f1301fcbad64759e82521de719394b2d760ef050957966fda38ea4f9cfaa7937acc9f29c32a3a6559d9836c4cb6315d76c5e1fee61997f82ce68d7fc7da581008fd10680267e96eb258a66302252efa634f40000000add10177d24f3c0ef6abad6ec6fbd045e44e7f86d931cd941762dc67ec59ee09b8d11f2791e33f4cd941207109f9d0dfcbbb5df852ba92eeb4b5ae797aa67402	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2316	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2316	iexplore.exe
2316	iexplore.exe
544	IEXPLORE.EXE
544	IEXPLORE.EXE
544	IEXPLORE.EXE
544	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 544	2316	iexplore.exe	30
PID 2316 wrote to memory of 544	2316	iexplore.exe	30
PID 2316 wrote to memory of 544	2316	iexplore.exe	30
PID 2316 wrote to memory of 544	2316	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c8ed8af6aa4a83eedf9b26d2ff5a9e88_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2316 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23e76f15408b3f961d5cfe23c4fa2fbb

SHA1
b2d8c1c55a47d187894fc16271c6c2623aa3b0fb

SHA256
283ba8a243d58d0055915df98fe3fb04fc48d3eea827617a58744cee54e38314

SHA512
4e1ed9c0282fcc74a9b67dfff6794d58e1a7c9423b9661561bd57604b8c0b04e96687b086322c85de906ed732d78aeefda1237bf858cc472761d262d6c4db00e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23f4c9b32fbdc523442a223fa8e48294

SHA1
4c533a7177db08d2697b9c84f41a1c106517fb92

SHA256
4e8ffabac6747816ac503420cd34eb8413b5b2d63801f40032d40e549f9ecb4f

SHA512
58399c748cfdfe9e6d827c05d85d5f46e006cf430c3516befe12f96ed8c758a225b8321a6a5a585b84ae37997fade058b67efc5c72eaa58c2c9782e3ba0bcea3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cdcaaae2e9dc18b2ebbf54933be2e816

SHA1
192985cb992966bd1933fab384d280daf773afd2

SHA256
7d766fc9f04b24a5f63f16c7e3ebf876ed2c3992d2862b26b3bb01532fb2cad6

SHA512
e78213cb7b96b95a7613094cd2e888811f15d50f84023584022f59636d8b856d42d32e6e17c2d73acccfee6a99370ea9a7458546298bf1cb11953cd6e2742590

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c0b5ea1c3b5b1c66db8e1c0a859f2a0

SHA1
a47b48e5fd5e7ed0b1e7506634f43ea103764422

SHA256
a0afe045e58a62e6f118a77855609b120cf1348ce6f7f1f88aa75414da11c557

SHA512
b09ad9f0dcfaef7bfd4fa476815da3d4503bd5bdc16576dc52b151ba89930236063286cc2b37ddac2c9c7d57ff48fb13cd5c391be7d6d55b158325e3b26cc381

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2ce6d168e52da122353ad0c591fa1ea

SHA1
14f138c5332407381d7014e62eea99f2069b43a5

SHA256
ea2658cbb8de0f62aca4b565825644b8310518d7afdd52eb543e9c3955c6a0d2

SHA512
d83b6a715e717be85ee0877235dec8cfb5fb4651cfd9bc76fd66b94954506b3b6b36f30b1473d8d80db8d032e959a75bd4e713ec50c54a0f532917fb60ee313f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c55e11f7c01b4d7fda24d1e1154fc750

SHA1
fc70a031065460b7d816cfe92fd51ddebf605a93

SHA256
2e986ca3d848fa2be1480188c08f0cf73813b0c836f290782c9c9dbdb63adb9f

SHA512
98aa6a95bdf05c09ecf304462aae02bb1d88d498310480af0132f96bc8929432123c8d8257f0a6bc4ffd8737e868456797b590901047f7d8c7ea5ad1c822e2b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6127b591874aa4ce3097c2d2ee22851a

SHA1
5da56b1e2cf2716fef9c591cb7cf2336221c8baf

SHA256
cf0ec0d474d335eaf7594f587d4c48c9f9633357330ddeb1be94bb4661b94ed6

SHA512
8b9a78e966abcc77b8b410fe443e3058812e1a8e5e3fb6ca926b4ceb3e554729199744dc8cf222ba513db7c856f05a06b477b9183ca738f7da815286d0df8c65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31b66e8a259fd8cfa28fa97b8af555a8

SHA1
aa35cc6083b90f5d6eb82dd4dcd596593c0581b3

SHA256
16df3e1fb71069f40be47165a632abf9866ccc1052c02cb9bf7b6671d0ae2626

SHA512
43d140168adfd37f3e41e5a495e9814c779639340b0adba562614da1db49eacd669417d68e1eec20cfc0c0a752045cf2dfc5ce69853889ef495cfdd9130a1b8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6f5186932075d6434a5e28c9a0e126c

SHA1
44300d1d4f24b0e7088d9ad11f2887787c657f4c

SHA256
e66af0a0fd15c294617dad3fae8a4c0ea9e8c8c07d25df8530ae307fd6fd3c0b

SHA512
4cd0236e7093d319d873a2e289f3537729b946b5fbab09c5f7b280d4f116611748e1f175c9ecedbda84b87e20a02f42affab693ecff457fbb38a667eae46fbf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e786a55f0f1b8d0ed98aa3eb79dd5fa0

SHA1
592ae0aedba9de8efe98dbebf62d11bae6ab0892

SHA256
4baf08fef4a1656c6f3987b4f43d3bdfa2f2239e2e1d32b0d37caa6cb6004a2f

SHA512
8eca24ef021e56bc5783be9d1d6deecb092b1ef63837abb6a01abc0141ffd9257de0432e7643388ab25ef73a1a3e3c87084ed5b0104c20c9459898ba096bbba7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9dcb21da327339b5d63a931e8e30757c

SHA1
e2a6ecdd49eb8fa3b7f3f60bc594db10eb4eab1e

SHA256
2498d90753ec5a783f4b8b9920b4b7a9835f4cca7b192b2dc4ad8d18689655f3

SHA512
1e16a49d20e565d05705d596c7126f632f6b8f69de0c7030091c661eea60fb5982aff9889a40ca3617d8c23fed4e0a9cf61e9b75bf21668650b8c51af4a4489d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDB44.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE7F5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit