2aae4aef1e78b24c09edeab12d44027983ac100bd42f262fef785c75bb5a6759

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
29-08-2024 14:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8f77ec00d252ba1c70afcd8f94a30ac_JaffaCakes118.html
Size

3KB
MD5

c8f77ec00d252ba1c70afcd8f94a30ac
SHA1

36d501566cf5dcd302028d76ecd41fa77bf9c64e
SHA256

2aae4aef1e78b24c09edeab12d44027983ac100bd42f262fef785c75bb5a6759
SHA512

0ae107bcccbfbba62dd5cf3209a30b29c20eb2330d18524899c9901b93b7d52e8443b1c5667a6771709aae733047d43bfe7e6cf1797f13c76a1c906cb6d27be5

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000a38c44414744ec642e13152e60d6b38ec4a2b4caed1341460188148604b6a6a0000000000e80000000020000200000003904acce5ee04c3381b5d984d10c4ef1553d2513128269c3b731cbb31312365420000000ee5bc760c7eb89e71dbe6defd933baca3271bad3a4482c48cd1282bccd5d18644000000038215312ff5619e29c143867bc5c62acbbff2f65edd5a9ce1c6a96205108d788af3766ae33d0b055660dd5232323f8559ce52fbae453992335e0c1219d92e3b3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000004d373bbcbb98d0380b47b20aa167b2b3e185fcd998609e89dc41dd2646d8adfb000000000e8000000002000020000000745d318b97e8d3607bdc38100eba8dd94a4e8f61791f65799b2e2aa4a3c6282890000000ae78aa0a5213ef2c13f3915ce232bfc0c5bce37ffb88ba778e57ee01925656497601698f11691cf5e5985985c9e049f7e41272e572248271ecdc570e05c614d374f2e7419f548bc454fca2b72dc55300950562a122d59dc95fba0895f687e33c0e302ec1319b2cc0f7b7085fecd2f6ec61053d3fcba1c5280c62477e44f824164dd98acc2fea6c26a5f54d98817975b8400000009c8628e56cc93f0076579de994e151f339de1dcf307354751ea14f3a719d21203e44e10a9c6060697881377f24dd004a8852ed56388a3fa86b10913ff7126c77	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431102061"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6E58F911-660F-11EF-B96D-66D8C57E4E43} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d00bd0421cfada01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1708	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1708	iexplore.exe
1708	iexplore.exe
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2204	1708	iexplore.exe	30
PID 1708 wrote to memory of 2204	1708	iexplore.exe	30
PID 1708 wrote to memory of 2204	1708	iexplore.exe	30
PID 1708 wrote to memory of 2204	1708	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c8f77ec00d252ba1c70afcd8f94a30ac_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1708 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2defe75984f675c62bf0944fa86143f7

SHA1
2e9c6067612d4866e24c7405c610ce2b97a544cf

SHA256
05b6eaa7616146224b73c8f88fc12bb8ddfb67ad2c39eb556ac5432acd808682

SHA512
1356a65d10127ebff0f4390c91671ad48b214f0d1854f9d84d2fc4633a51280deab3b86c7bda1690103c7f2838968300b24c270befe52a6c030f07277af37289

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62121fc541eff38320d0acdc3ba52e57

SHA1
3f1f55477fa258b1a5c4cf8534afaa2e6274d548

SHA256
247f84729b78b965f1851a7043fc89050961701e49c20e27bc4a26adbdbf3968

SHA512
14d32c6e90e4f8a085dad8caec1040dd9dad60e723f3108476cb9cde1e5471b31462894d25199489256759230507935126c6d6e7e50d0cc8ef66cd7e262feb4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b22723ecd7ffa743d47a56a48626d2f

SHA1
9cfff96cfc78ae62e89e9f52c1da2a915253e4c7

SHA256
6bde76d1f4767853cc7566007aac34c740905a758a6803c130a3b078be98c9a6

SHA512
b0c03df1fab9bac2b9ba30bc8ebdc1e18de80915155c668eda9d05be4302ac19a9e700282b0df9bd16cfdabd64fe5e1476ad7faf67683daaceff905a99f84ad4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1c90127f05e416279cb45d7bfdf9f8a

SHA1
b0fdc8f8b3d2d000f821c30692e07dda3a7bd712

SHA256
c756c357ac5eec514e13a54ce5084c165aeec1b5960b32466cb0307235bb6b4e

SHA512
499fab5b24c0c5fc2da39272876900f9a6df946830cb2f0d7ac3269fe3b7a1aa5bb61103861b6a278d0f8e93ed80c13b8e3b63dc24f7d97aaae4360ecdcfee8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f6361a9dda898fed9812b5f458c7568

SHA1
065d6f615cab1a40849aa35401e987accb223e7f

SHA256
744b1c3531ad4d82fb4ec29299569eac98d68505f5cc395877ac8234fdfc6ffc

SHA512
2acad2a2826dd2077f1f2db8631973085cad178afe8481aca967a1d9da81f83189a2f630b9e2c14cd47005dcf4a8950ccaa56f34219cb74300b978a60377ab77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
435815d29c06c390c569490273e26ebf

SHA1
41680d3ce9dd35923726431e1cc0ff22ce2d42ed

SHA256
bf9a778fdf342c6d4403230cb15294403f45e8a761f20bb4e42db8e0476e10e2

SHA512
1c5822366ea72792116f62b5639399ddbf6e2c2bf19e9646560f53a244562063cf9879a9141776dd8398ad019029f58f430cd120d761f46e31bf72fc8df9bb7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
816c51606a00dcce67b356ff7d210359

SHA1
98a4efe558a58eca7c3cfe2251ed37668f2f7ff1

SHA256
9e53482b6acb833bb9494aab46f932a9bacd0e9c5528d276a99ed5aa25752de1

SHA512
721d09701e9e52ea70cc2034050bd846598fb680cb17fed725b46ed8f8cc0c1aa342c7c7f470fe42f26dc9053b3ba69e8df18d66fbc87a60efd8fa2cd399140e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a094652beb50b8cde989c010f87bd7ba

SHA1
8f595f06db6c7897d50431ed52d42843bfbfcb14

SHA256
bd368859e9beccd95e2804ae900c832b0e1e9d9bab75c5dbc26bc7c808887331

SHA512
60cc0af7bda1cd876d25fa3e6c17f22e664cfc22490c682658abbae728d8a92270a02f4b245632adb7ce458dcee787ce787ba77138049d1de1aec2650e8333b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96ee09ee3b9b886a71f6e49c161f9d27

SHA1
693f6b9fd10ccad7c311311eb629a7122d138703

SHA256
289e7a5507ec5e4cdd7a4c011c12024a4b78b755d13dcf835760eea513fa9d16

SHA512
9dcca153ea566035533ccce766050f31419a5632374efb6110f123d964b26a47c4b55ff3ea91089382e063a04c14aa755b466e1a20344570e5ef1a2f69af1b0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c61269a17c2fb36862321da44d9f2432

SHA1
f24594fa301811f5b161baff10b1650f3a35dc0a

SHA256
743b51997e0667a043e63e00f9fff3d648b545d8890a49113ba74084fff1a78e

SHA512
4b9af8623c85ad287de419f9017ff973cff0ad7568fb7b5ec840987de1a5d506c2dab054441a5dbb516c056bde501b19d89c4897df25923a4295bdf0ae5f313d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1bab5ae5ffad1c720a3f97250c94be6

SHA1
a3050577d52d8a006314d458df4bbc17ac8eedd7

SHA256
7f14a41a802d7de5afbda8059249a6cad81690afdd1acb03b0585dd8eae7c441

SHA512
d7f9971397f4d0281883efe74073a9f55c61b1437bac680c496eeff7138e424f755666a5a99c98de7ca4507e289a87483b8e7b8c95c76dd9875120ce69b9ee29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb65b071fd7cf601dd69e8b14ef23439

SHA1
b5e8e84e70783f30d5c82b899c840030e96a7e2b

SHA256
57085c4bb1ea3349a5bfb03a15f89e52d056f270b52c3e667904e65204d4f9b3

SHA512
ca6da8a6f8065d37a661aa0affee100bb3d35bae4fb022f0c7e9301d21b1d46a6d8e517f7e02009f98116abb0b62a5151f80b73829e6d9a2572aa15a77d75e73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e93e95f7adf1eb333bdf612b5e79b6f4

SHA1
ab6e8e87627df791baf5385decf87d46afaaf2bf

SHA256
583575e49f3a5eee3f5f2cda2e9edabb0d0c047aff221c03b6778acc88e18b47

SHA512
9d85d772b47b34466b56fb07c6940264f18eb0f90a9843669bc0c82a3dbfae48e9c8ba10b13df71c73f3d00c396686c9ec1159ea598fe9e0a8a85e8d5b3b7c0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b4da17ad0d2d328139e3c61770d3fb1

SHA1
79c8a160b642563481708f7ee8c4c61f828c83fd

SHA256
cd1385c07b542db9d2408c6ab4abb669993292a9c430e9d3a3eda344f1e59641

SHA512
eba69e1c22d45909c75fff5538474f318334e396173fd658cfe29b259dc603d0eefa34764279ad14a7d5a8f62491b600364f0ed147131ae24ed50a7240634a4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEDFA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF2AE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit