958e813a29b6a97e7fc80aff196100faaeb3cc2b4ef69847c77bc8bfd93a3a6b

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29-08-2024 14:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c90d51ff0e154ce1636538c32ef1800e_JaffaCakes118.html
Size

6KB
MD5

c90d51ff0e154ce1636538c32ef1800e
SHA1

b5ad9e4d264eaa049772e7405fe842db3b2ca1cd
SHA256

958e813a29b6a97e7fc80aff196100faaeb3cc2b4ef69847c77bc8bfd93a3a6b
SHA512

c5fcce3757eccf83cca45cd98e185fb2323a418ab7e01ed1104873b07e16843f190048538a84db71c72d810c4e431fd58bfac0941a2830046bdbc421387b0de0
SSDEEP

96:uzVs+ux7IoLLY1k9o84d12ef7CSTUzccEZ7ru7f:csz7IoAYS/tb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000959c921c9e4b7d84dd1f1e826536f4e63a9057c6ff071abd3b63ae9bf754891f000000000e8000000002000020000000e28b2ed0e932e5327d7fce5be08d428473ee67e400250a31c9b6e6f2876daaef9000000085bb631177a6fdb9b0e7958e00a58c506883f0532d2833a080376f192747d761fad138e131802e14fd5988709892055ce57228ab3afd9008c8032051fe9d1715e807680e43005e77e2befddd52ee5c36368f7a2f53a5a3fa73b25ff665993bf46221707cadb59d6b17f7bfff536f767af7f91367666d8f426f685b4bdca84af6bc7f2d48c5f1d1b6f1ad9359033a6223400000000cbee6c08e30dd222418d066e8b6a7e6e314cdefcc2acf26765c50f301ca47baf49e3ab049dcb8ef9af973ea910affb59fe0e874726c4bef7ee2606da3379620	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431105415"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3E020F11-6617-11EF-95E0-F67F0CB12BFA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c70000000002000000000010660000000100002000000082b19f2231616f85f750a375b83e2008ed307a523394140d263326fcc2f5baf3000000000e800000000200002000000009dd2c436a06c04a4c84cbe1a2bbd6ab80c3ec38ecd6dcfb42796a9cd9715cbe2000000002fa57885aebc0bccb8bd92e01575a4cfa223fa284981f1d872c1e4c73653cc240000000ae77409ead891e4a0ebdcd9d95e95751620ea735c983e70154f0404941b799411bd8f2675d1eff4e5371e8dc703c6b802ac6a221832dce53b129a113e41b2725	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90b98d1424fada01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1940	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1940	iexplore.exe
1940	iexplore.exe
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2108	1940	iexplore.exe	30
PID 1940 wrote to memory of 2108	1940	iexplore.exe	30
PID 1940 wrote to memory of 2108	1940	iexplore.exe	30
PID 1940 wrote to memory of 2108	1940	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c90d51ff0e154ce1636538c32ef1800e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1940 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09be76fc897f6ddd4ca5c120ef497386

SHA1
1ab4d4fd6573273133f08bcd2603b493e1997d43

SHA256
8f2acebfa76a7bf2dbc5386b60c9b3e3b8f401218ad31b62dd365471e6bdabcb

SHA512
1511895f7112debe7f8c39245672bc722ab1feb998cc3bbdd3648293be1681aa96c329f650e84d38f53e8042fb8ad6d264ca23a7f10e37ad1541786aacfa7354

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
729152ae6e47eb05ae9246491356342f

SHA1
21533f6a2addd1ea21e1abf8eabb58569bd4c467

SHA256
0bb27aa7f69965ee5d62a5f4ac65cfc592d7fd8af5b7d1e9b2a8890afd4e8efd

SHA512
f3e1b7ef9d96b77eacdfbc5b005ede5360f206336b1b5892ab4299c66b21da7401fb4413aabab73b4267a3429ae0a4fc8ad1191558e0ee08a19b4b8b7bd770ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c309f8993566ed7db27dd6ecb3c74fb5

SHA1
a6bbccf961a157c84a66b5d26df972356845009b

SHA256
6e0000bbaf5a85bac27d5acbe0a0b75da2c0373f9bc2f22e439221540bd466db

SHA512
2429f8b8b92ae6147d9b7c5528d150cbbf1b270f7c1146f810b316f55d3663992fdebe9e60823229bfe5e1b1ab08033bd226c10379bebf499bbd8b5c2b2b8364

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f93944adeba622361843d7af50e91a5

SHA1
0b0d8c7d36d33b8aa8d30d393a5a23bcf53ebb87

SHA256
a9f93e1fabd9f373e358216ae545a83242ff969a5a01d1db6a13ace77e8869d1

SHA512
500dde4a5c87702e3b2e1bd530dbd2142675828c69952ba36dcf8a768732f4724d67f6a00b8de6a843979f6c866f02f9b804c72ae8bad001c5e08a2867b17761

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
488209695af3ff8df4750738756663dd

SHA1
72f229c018dec4f559dd6797a977e6304a7d78c8

SHA256
d296a2555b077b080aebe4b25229ca9840b45833efe7e12ad77d90d1d01d17a0

SHA512
d233d2e55c91039435a6805e88ee9b456e19a63a47eca68620bdc8b88769c54a5a5a71f4579c434157e8627bf386ca2d44d11acdcd2be75c5c2ee2b6852decfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f671fbc371585b5b4eca9494cb19d207

SHA1
5e536476c65b66468c6ef1389cfa632ad649acf1

SHA256
e81c65699b944a6d95c49653bc4df606c3b61ae42f52b74523a7036d44866dcd

SHA512
98cffe23fdae3d61bfcbee55af433f70045f5e612ffb8b04c76aa7fda2087807b6ceeabdca7285671088d97fa5be8ed77868b4e1a413dbacad8ea99dc8aba480

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e9e307540db6be39abe4e71ff4fe12b

SHA1
26a3befffdca845e14f98cbd5ef27b5437b5d779

SHA256
8f4f63a9554932865c39b3cec89efdd90f34cef4331c950fe9f14fa7d31dd772

SHA512
34f1f94ffd432e7ff9ff8bf95d4a3845a5661fa255a817f705bd06f5eb40d1cf0c9756a32944e95c9e13ccd5885658bae8d75df163135fa521e614efaeb23551

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be4da2605a7649da6aa673e5d026ba05

SHA1
aa76b5e23600b5f3716946289dc4a02e9d8cfbc3

SHA256
f73e368bf26c4a454147c2445f16adcc1b69c0120fa8cc470539d55cc5f8ec27

SHA512
7b0a0535ecf9d46ce63e75689560fd8330fb7e8056484c344a0c0a532da0a03f02e43804a3e9f1f94431cbc1838789fd29c1cebc60fec9d98fba747e15b0bf77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea5a08010cfb647c6353acdf83ca1962

SHA1
7fee049c7277587fec10867e7374e3e8ba5f8fc6

SHA256
fe3172614b50d0082a4cee8271621a916218c21b02658da837a408e053eea9c1

SHA512
e446047e14f4d105693d5993544c2d107d0eda55e99373b63780da066d62a64d23d4525fe3db016bc4d4f2054b474ee991f63e6fdf0f3789c767a46239489195

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
428e4a2a173d2d12634da456d4885d58

SHA1
40836f4df6090f712dd842e97f37c006e65bcaff

SHA256
0b6890158cdd635dd1a97c8f062bd8bb48e4e848299b85558430bd5accec33df

SHA512
32dba83ee08054e2bce99e486b9fbb55787a551b82dbb29b6bda21dc7361463e408dae943a3205263bc4750d403b930e24d4f3cd7da83831516574bece254b1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6a4525e42c021fb28f915ca63ecb0f0

SHA1
fccf9438e33f8ff799b44187105c0ff170fdb505

SHA256
23706d6a5f602231db010c84447e0ff124fe82b1753618f6f6cafbf1cdbceef3

SHA512
fc423d825e58352c3c6762644fe3cbcc66c3aa37f491c48f0ba4405cf686423267fed3bb9a42b362cee76ab4b5b816c25c9547df047db2fcd2aa8090c229d0a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82dcf6878eb23ecbf278f9e44c2b59ed

SHA1
e8c777d23fbede3e1872e54adad0aba6ef6d5702

SHA256
1504ee28b72d389f0b2266bbefa7cc4b644978723a181bc71adc3afe27309d2e

SHA512
3afa4ad979defe453344d358bef9e34e04e53510bcdfb1d8ee0f1263e9417a0d6c8ac014af4185b4395c578e8f2303cf89d4852b536fa339404735e2edd7a0d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42d30c3b8628927e633d9dcb63b929a6

SHA1
26307f80743452d64d38d021907e7f3e71b5d90b

SHA256
897c62a55178a20633a760199fdfb818e9b1d121d2654432d5522c1652c67330

SHA512
017475fb40a1147ff104fbdeeaca54ee2b01180c89418ec11cd2294493c098437183e03cd1aff420fbbf1ebe0df0d608fda79617e9edd98728f7d7136bbfb9c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ede00e379f8fc1c109c39b767640d429

SHA1
f4f39bb241d8fb546539ff7c3486f54acdc46c82

SHA256
9946698eb45c497ca3a02f24aa934fa6c83db73b7a8038085713922733cfbbf2

SHA512
320e7e2de9b5822536843e334d2a102e580a48d2a00dfe1c32df25b80c8be2e275297ed5dbc3f6c3d88b5ce4a60c53d05fdcfec5ca77bf69fb4af5f40d75fc35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77d0d4667745be298af9b52bcfb73c86

SHA1
d200c08d37bebe23d6109bc462c32c2ce09b6ef0

SHA256
be7110e454d15b9a552ad1e33493b379efef100fea64f95dfa537b06561d2d88

SHA512
22d4a295dc96acc58800f5a4aaf644b45488273d730611e8f1dca3cc84598f67b7fdf233ad60d59085c85dd10592b909b01b8b1405f55bf40ba6d26a04744855

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa8bade50315b21bcb23186e993257d1

SHA1
ffdd2e62987daf092a035e8a760efbfb95dc9d8d

SHA256
ad1b3fb6d8f8888000581f05882294577c0fae1ccdb98bdfd08c284ce8346d40

SHA512
66b24716a660b03652be7fac6b1901670c3d4a81db2eaf460e5c196ad2b3048803f4478f451e0306e5b27e456e69c59abe9f57adc521a4409d6ce6e2da92d782

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC075.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC0E5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit