5557d6c9332ea7d9d4535ad69b035e6da5d88be8183f8f9e38dccc012d9d4a3a

Analysis

max time kernel
136s
max time network
132s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 16:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c93204d7589486b9ff7b97e4eaedbb08_JaffaCakes118.html
Size

460KB
MD5

c93204d7589486b9ff7b97e4eaedbb08
SHA1

36dbf268f9368e0b19cd7d3fb06deecc6561de9b
SHA256

5557d6c9332ea7d9d4535ad69b035e6da5d88be8183f8f9e38dccc012d9d4a3a
SHA512

f291678ef6594d36f68f26524d0a1c912503e019ee99fff727c7161bdddfde883dc43195f00895605aa581d083841bb2ea3e03eb0d3e161aae2baa65feb3cd44
SSDEEP

6144:S0sMYod+X3oI+YusMYod+X3oI+YesMYod+X3oI+YLsMYod+X3oI+YQ:l5d+X3W5d+X365d+X315d+X3+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000e7c53754359c6fdab00ba290028f7434895c3320512fbaebc84c3c2da229b599000000000e80000000020000200000005b98fe402776d25c17fb2d510e4b5f88f9fa733a92b8ebd950ea982912986fe6900000005122de0b0a1ca8080ea385599e982735df332e0d80916dbfed2508791a33b04bde26f90a0efd416d849306b254b1690d5469c7fbaf8406ca6961f5a714cce86d997a58c24e043cebb125030a2641a6fcda4fdd52ac0f1545d059ec28fa20f3b46e4f8da087618fa8e9a557059a1bd122cab62ae8a27de8a82fb897d8f5f6ac8401894dd96131712a5f6cad6f1f216b3440000000f9eade45b373a806b79a7f66547435d7223f3d044dc0a97d0b91b8439e5fea71febce80c62bf92fb4e6fa9d970f47d5e057fa9f6074b3801240e902306add523	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c000000000200000000001066000000010000200000002448cb31b9be82f56949e49697476530565c2bab50ea5134dc75413783394149000000000e80000000020000200000002ed3817799f876d3c781e8523ea3e6f8320a6713a905429ce2eef0809550e4f4200000007397659ffbe1371ef4857a97b25fae10e68e9b3a13657f6d6bc62358207930a94000000088f21195406fe15133a832abe8e1b8a5076ced282b80cd6f9a1496b08e30c23de2617a4f9423d4e00f1b35ff5049959e9a2c96a8b43951f0aff9c378b3dd3262	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431110915"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0A7F5EB1-6624-11EF-AD79-76B5B9884319} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 504a8de430fada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1780	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1780	iexplore.exe
1780	iexplore.exe
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 2336	1780	iexplore.exe	31
PID 1780 wrote to memory of 2336	1780	iexplore.exe	31
PID 1780 wrote to memory of 2336	1780	iexplore.exe	31
PID 1780 wrote to memory of 2336	1780	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c93204d7589486b9ff7b97e4eaedbb08_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1780 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d48e50bae5101fcd7fdab93142aaae48

SHA1
528cebfdf5b1bcf783ceaa82231257a05847bf27

SHA256
abedd1dd4a0d96d418eb0fd90b3c6a974643066fc7514eba636b5f76589d0a91

SHA512
14ee92cb2d61f0fea32db448e7eb4e88b47fe9385e92e4f95a884ffdb2294cf955960b14127e51662c4b3bdca8e0955b5c73b2085d7115202bee6fd1960276cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1d7a5e29930b4b3d565fbf2ea5828a54

SHA1
272f4246071558d1188ea4544eee78a19ac9852d

SHA256
8de0a7b0d0de29499dda0038b06f8e5ddd0373ea80022e4fd4e27b20d65a67da

SHA512
8cbdb5ec7627698d3a4ab1d1f4c37f2404ae98e9645dbf0ef868f64b7c1390f3dcb3f7532117b970ec02d83d0b15ce6dbd9d18a3522d069b1adb49e573ab722b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e0edef29158389f3238a75400c0881d6

SHA1
82c448dd85c7a923a0f6ccd20c791d8798c0d4bb

SHA256
712d90197901035f91f6331eae4c48463bd02c8a8d05731cabe0e355f25bb5d8

SHA512
b4f8ff21e4d05976d2b2a0a1be43dc2154f1d428cd40bdd7b1eff99bf8207731eff5314e9577840106e8314f73ee91039d1f465c3d84668f77fdd34e12aafab9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a8837589618bb53c8e015816453eba9b

SHA1
fbaed854247df2a76ee9d1c8db72425d8bcd489e

SHA256
8815a6dfb8f5fa3b79833e113a23884ab547e99863f00fdd119a7143810a0af2

SHA512
50c0411dd3c7a10ef4ddf5b173e90afd17fe97004c3fc4789dfe120b272076812b1822fe3cc2f7cf3240985a652e4a1df73b47d06db2fffe3b1c09788e87022d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a2a5fd4f19cfab5cd9a6b0741ae27db7

SHA1
2952afa1e9371f1d1546c0f76db1960eacef9707

SHA256
4e9e37c376b56ae7c32623889b8bfcfefb946163e555dde96379d337a435be7a

SHA512
70c7091427641df83cfad4af689b6635e67eeb8c64406750b7549ebc810247ff7e7f0685564e7a1db0126afe086e56efa95bfc8a5683e70e4aed15b147fb9f6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
360c22897bc50a37315df787bde19271

SHA1
8d2e5b7ecc7bdb0609f3fbf978846ba396e37f33

SHA256
27cd55f833d9d338db5a12089ed05a1a26de21ca5d577b4e75774ea32bf525d7

SHA512
7f072fdec438d028811ac6cb029143339844adf68697c256f51dd8e865288b060a414797bfd0b6a5a93a4570d025b82553d05a278c68f7fd07dba3013e892bc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
443cc8e5724f18475d05842c20b4e646

SHA1
3210ee3593ec4c449c6300efec48076780da0aba

SHA256
0603144f9637f63010f1daa91f409e001679bc942f3989ff3aeb84e20f69fe6e

SHA512
c159fa71ace6661b4bc71cc61435f1877a39906b3cd4bb21cbe64bb9229fa3f09250deaf740db13a170bc7d7798d98f7d57f9f1d51e1c6809b922f2c5c2b2919

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ca478e99a082a45f72986e2988b27400

SHA1
657d7e86bbbf4375567653a83f50276ae32bc113

SHA256
c1d5e5e94d186f1352d7b5907960e29470fb1a1ed92255cdf3712674b1bc72d4

SHA512
c1af491756780bbf648ffc7defc519edd578931bd8eaebf23fcbe6afa4a55ed1f20e24cc340a4a10f0df2d234dce648becbe44874de7c61458d7a63984b13447

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ba229ff705b14bb8f7819388d26c36e6

SHA1
0a29c070b2fcfd5ca8d2cb68bdab485d01c2b1d4

SHA256
0daad70a3fc16128dddc8eff874b4bab91a3e2a82304fe9d45a7c20078e0ab5b

SHA512
69637d1625b4df2e8a2238b87e422e7b4aa7b04f4061d209a8ca8c07539eecbfe1a241d82e425594765aec2a756ca4a70457eed98b68d6fa09f91a7102fa0dd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8c4d3054608b7ed74145dcf3ad8b94d6

SHA1
336893b34f163cce9161a60a9ba5d4166521d991

SHA256
11323948e16706300c31b3183888970696630043157df7dc3df1ce9aa2294487

SHA512
dbe3f28d65cd7e9c0ed0a6f54cb296a7e06da6bef0f5bd75c52e3d5e27813ae4942e35ffccab3b24b77d3dbc5881bd945f34010ee794ff356de1b77af98fec3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f6b19a1b9bed65b46e6c9b27669cab2a

SHA1
ef4134cdae29ab40d6971c631e0d4708fcb90aca

SHA256
5c46fec20b802e2dcb241296506c0c6153e4424c840d8e7d51e24a8cd71d5934

SHA512
9d77b0dbd779b9184541c707322f541616ec3d6d2f4bc7253f27dd0fd1f883f3c761349cc3793da6ecb78da7a8797de52ab3600d0702b2ecc669bc2de6596537

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
303737cd83f9d4a0ee4370c4691c46de

SHA1
87f907a11a7529f3f88fa6fb1257a7a0f5c23c1f

SHA256
19a460f4394a1881a94b6f7d1181fa72e159cd716b8a120bd5db3531ffe1acf4

SHA512
37e81979bf8a92761b498a130b81af6c0f5d5b7d03b5ddf85316b507962696e9c06162c65f91f85a817072a91b0ec2b29520661ae392df63250150954b3ca6c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ef3e809b1f550b199dc3386e2fc57a28

SHA1
b710b635f43a09e3906c0e55bc1515f7ad39a850

SHA256
ab4c25c0aabd35abe1e46408e7eeb1502cdf0726d16f4ffd26cce61c64285a52

SHA512
abc2f5f1d835fbe432bd29d159669a5847b83fdb11c68db50c44c5afdcba991bb2a4d2e03fc97cd1c1ed9497a3fd91b84deb78d6f343b65dd34d56fe4de1bb27

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD8B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE3A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit