9652989e0d9bb04a081e9a8dde0ab2cdaf7f2426c506f9b69e2dd9a8060c8263

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29-08-2024 13:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8eebafa4014641add132152ef2eb1d7_JaffaCakes118.html
Size

20KB
MD5

c8eebafa4014641add132152ef2eb1d7
SHA1

49bf5ac05f376685edef3693f842dd82aa560e83
SHA256

9652989e0d9bb04a081e9a8dde0ab2cdaf7f2426c506f9b69e2dd9a8060c8263
SHA512

972bcc4072104cfcc1bcbbafb25fb581fe17b31d50d7e828b609c8252e5e64e5a33f3dde30295d5ae0e5dd364753f59994c0b794aeb0d964eaafaff16e2ab3e3
SSDEEP

384:SIZ58k8oIPBtSySzK+td5zsOjurD7ockriBmlKzVdNyiQcQHRWc+qA0CjrXpfgZP:Sq58k8octn0KARsZrD7XIrwwjHQc+qAY

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0727c4919fada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6EA05241-660C-11EF-B913-D2C9064578DD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000009f5e8ea37b023356ccd4f3b042dccbb3dc28d15a271a1e23e3562aa8cc75e531000000000e8000000002000020000000239208d5e9ec6810d7bcce1d56de1083258eaa627b77ebdfa2f60a1e96b7685f20000000c38ca27e0dc667c994742c75247109e34ef2eea842bcbf9828ae306d5301b13c4000000081706f18465eb8f846225adc0b73e171ba26187cc39e7cc1bf62ad7f18de3674ac79d9632c2d2cbe407b3f5addca87c806fcc2c67d881b2a60dd3df35b0604e0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000c10b8b837e166a9c6a42f03268332663f1331c9c22f4a05ba8a4fdfe5bedb87f000000000e80000000020000200000008e47905cabbec1263dddae04636b2f2fa7f233414c3799a8aac5df7a5283648f90000000195f6e7e960b9ec0e26b27c2ea2d94551f2a42f82a08aed2345bf891333008e310d0ca0fed716712c035e17863f0bebc23242f5b11410785eda6cf28ade81745a9dfaad9d89a725cc02021a72fa68faec05c562ead60ba83b98ff9bb301b9ba9c95e466078bfc7aaad8234afd8b8765266132e9ea85406684a0684a35d49e8ca428817b61d885c8c49baad47eaaf06d940000000167805e4ca84e55fb392196636d247e78a2f21e42d876fe713fc9ba87f0a801a51454d2b4cc52bf7baf3aa05a7d3faa80e9bd5e69583214a25c011865272baa9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431100788"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1620	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1620	iexplore.exe
1620	iexplore.exe
2480	IEXPLORE.EXE
2480	IEXPLORE.EXE
2480	IEXPLORE.EXE
2480	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 2480	1620	iexplore.exe	30
PID 1620 wrote to memory of 2480	1620	iexplore.exe	30
PID 1620 wrote to memory of 2480	1620	iexplore.exe	30
PID 1620 wrote to memory of 2480	1620	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c8eebafa4014641add132152ef2eb1d7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1620 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
d8122378ea845326fc3f7aadb875671c

SHA1
206d4235b2ccca9be005c48d46adfcf75673897f

SHA256
3df601a59dbab637cc0a07309ad59fa0d813a1e62a12a89a3b0f4a329dbc4bdb

SHA512
83abde4f2f2cb95688bd3dd8c1b3f60631193175f72fccfa49a63880274206897ff6a1f6a852b53ed4bc5b7bbc1669a98699c3c104bc62906f2bf752b3097f80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d018c06e9dc93fd49b1408b205284e90

SHA1
83644efa4718c3382e6709488d930890ad1c02b7

SHA256
65f8880914600dbe3328658da5db3305f6a9f6bbdf60973ea6479dd50fa98220

SHA512
4298128c9fd93ca65dc6e7232a264122c920a84413baaf3529755b89f7611f36257a310195db629d7c7b609db62bf5f95d7fcd1135695d677fb1c2370a67c7e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f60376089f64c43c033a6be20e2f1c42

SHA1
ee0a5633598740a465c200e8f8a5ddabd2f629dd

SHA256
595fb3154a253ec8e46ff34a4a145e5d22a9e4ba4f97ad5da531ca5fea58335b

SHA512
c330c20d37030e4daa57ace3556b236ee1cdae354725a77a2a44327fe2c507dd4da45309242c16f7558a2013de44628d16bff3a65e2ef3de6ecb670da71d92d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9804c046c13e2e2bd55786f9a2f8148f

SHA1
53d1812dc957b633de7e9390ea5975a63a17e947

SHA256
d68bf79182d24c507b3efc853fcd6b44a52878f08afadf7616b70a4faac4b6d0

SHA512
782da7d7a9d6aa12b9d022d136acc7a1dc3dc13565fd996561621df9c361fcb811e46e65a1f1e6afd471a338f00accb91fdf327c38c27e429ea228d418bec020

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32b89af33b65991ec63432615d447db7

SHA1
8ef000d20d9c4ad24469967742ba34612cdc82f5

SHA256
489c9160972eaf35d7a0cca4b75d28847dea69948e130c7a2b8ae5382bf4e8cf

SHA512
3445af39a4290ff77c580899f4a62bf9de4677308ee46bbee65e27193360335365ddb3135cd3424be8dc04f5ef3c5b8cf50d58963e376a7017f1155b5fa68c2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58bf677bd442d5bbcadfafc9d6a124fd

SHA1
7a57d90cb1ef91a5b76795e6bb18a1091f5ed44b

SHA256
4a90ca49c09e289db8bba835cb69b56831fd66597de084e14cf8fe02d514e5a3

SHA512
76be1552c38eebf1719054b8a40e1a861f20931f0032d67761d5682dbd814a8846a1bcbddfa0e3f7d3c090ae693cbfe3843b74fdfdb4d891e3f8fcb733da049c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c678539029b45c4b9f3ccf932521ad4d

SHA1
33fa4fb84a3a0c893f9038e71236f76ce6311174

SHA256
ae4a82edfbac519cbe311756e588882c623d5da4689c65071fc8c925b8eb4b3a

SHA512
db7385f097c42eefd3011ee458c675cb499d2f4282eac664c3f2b9552a9e46b1e0234a491d6f7b2f90d08f37985ebbf18944d5be9ef13e6801dafbae518bea46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
d9f0745a84feaefff8ef40502c5f8f5b

SHA1
c0e644e2d22bc70d31ab000242d84fe3bcb5267c

SHA256
b62f4bcccc5551111b0c1d618770b11b2d252c890e7f685da61d1c8cd707d8e4

SHA512
fa9dea5cda635f1f3e2b9e494752491bede32ad019201f2a37cd61b704c3b5e8a66d20d575688479d5587692ec33c4292d8c80e0d20f5d1c7c7e8150bbbb17a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC6F9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC788.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit