199264f103bd1c1b9813c75d3c7cc1f3a08f27e548d6bb22dcec9d8b9ea61535

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 17:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c9533aa4158611f72c5f023672e46cce_JaffaCakes118.html
Size

7KB
MD5

c9533aa4158611f72c5f023672e46cce
SHA1

83766a3b06d6f2185cf33ddfe4ada4fad3945c6c
SHA256

199264f103bd1c1b9813c75d3c7cc1f3a08f27e548d6bb22dcec9d8b9ea61535
SHA512

e7aa43ac69cf42346d56c7efbfef281d87bfead7af4c9c610dc2da9455c83647fad3e410077490f5f3b95b18f392bbda661f484a25d7fc67fae3626faa1a05c0
SSDEEP

96:uzVs+ux7c1LLY1k9o84d12ef7CSTU1zMcEZ7ru7f:csz7c1AYS/jb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000008f43746d0999e10fa35d611f889c7a8266a2142a1c0bf3c0d4c99ee250d7598a000000000e80000000020000200000009686ebb11b4a88f56c09ef4e8d53e3cc698578b04b344a8e8a14d879519e483a200000001ffc93eb127dc6df76481d283875f4d0b24b4700393ebb837a0f0b8aaeaa653a40000000787626f3e30316602dd2af276ce15d98eb8cbaa0c22abd10c093b752bd19d07dc90520c1028936ca7f1ab1d2492465f6da7d957c56a846af9da9bf23edf8b549	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10c885d43cfada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000593ea3c52232ddeca3a0a70808e3c4106da1dfc835cb7f131cc33f918f24bae5000000000e8000000002000020000000328bcbd2b75e805f652cbafc481cb327d48cf926ac0ce3d401836cd7e648bac1900000009f6abb4228467f20e6a9399304b6ffe9e2e33d7673a2f49f07d247d9a5c33dc36f6d4c6a718d195a9bd1e981c46a2c80aafa2b294123f6ab903172f839c332c72af4cc3bc26c626540e3170ff568d40c4c73c84778e5545d5e197fb4bca5af4e4bc0ffb48586811decf8c53bc3a5c2532ef73ae7d742db4e5045bc630283f55b07c69d782e302d7ebb27f20e3a45600d40000000d57be7915ae759d2e37f49509620ba6761390612acf0cfc89cc67a136d3bf323ac30a09a367c4e5a915cfd4a8f03ba429995b600f03db2f8ccd52bf03cfc4bae	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431116047"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FDFDA7D1-662F-11EF-B190-DEC97E11E4FF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1172	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1172	iexplore.exe
1172	iexplore.exe
576	IEXPLORE.EXE
576	IEXPLORE.EXE
576	IEXPLORE.EXE
576	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 576	1172	iexplore.exe	31
PID 1172 wrote to memory of 576	1172	iexplore.exe	31
PID 1172 wrote to memory of 576	1172	iexplore.exe	31
PID 1172 wrote to memory of 576	1172	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c9533aa4158611f72c5f023672e46cce_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1172 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33001771de2103c4ad5185b844a05710

SHA1
4d35f9eedcbb47c768a6aa284e9482de3de15d41

SHA256
639dfff78f15be5464d516d1a43c04465965f84733818efbb714bd678d583abc

SHA512
7691f3a374fdb31fefde61c19ffc6e255803fd0a496bc07d8585c7c20cf8bfe593c67ea47f91bf5c13eaf8ca945404770f00417372a146296c109a73214398f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d735de09f7dd1821c6d58e32912d275

SHA1
092f9f75caf188b2409b30748a6bdcc5eefcad98

SHA256
65c263c480db037924d7bd01a5a2b600ef418e99ff989c4ff61c1585661397dc

SHA512
993917201681a1ed270839a8dceff061138237bca5d0191281af5068ab04dfcaf09eb889aa45bea8022987db83326823feacaa4944298e96f28fafc307316444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
943de0bb2ad712e9b47f57d7a0a91542

SHA1
7e44e36f4c8a3c3480e0f08b697a16e9dcd6fb93

SHA256
41062699b8544217e9739ab48a41f988dce40409d7f9b15742c140d52fac7c6d

SHA512
f737e87dc11236cd25d10530239c7693f0a9ed67ba8e376369f9f4aadd6c6349da1705f99ccb83838f26546662f986f97248f12b34fb157c3bd79c5679b75bb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
328baac9a2a55381c95bbefeeb8c305f

SHA1
971002a94fb5d6b85c07fad2aaf0313db70e2a84

SHA256
faa037496e442e19bb93edb7c15981fc6077b10b90f720b648e9c6a91b8b8338

SHA512
ea7775fe627f26843de660dfcf08ca448db0914ea86ad31755bd98885f4e7c1014b477aea4aec2e65a4597d7680da5bbbf8e3fdc623febfd9087686dd06ab6c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d59efd09ad9b87f8e780880c0d014ba4

SHA1
1d6a33862552f8eb0242c1ab5efa58c7f5ef5a92

SHA256
3cb8ce137789394532459201d372e97db65073964577941906f0c28f8a24e43d

SHA512
ab866a7d97add1b640d42e164f1a870c003b603c2b0e71747de9819478bd9eb24a96144b61ed7a2b7badbcb219a3d03d8d4661533ecbe97119c3fecb00231a26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7486b3cc0cb261bbe1588835a0fe2b3

SHA1
c602f28dd03618eac821ea719d7af55353391c3b

SHA256
70b31b32da840047a2e2704b8d7525ca99946d60e358833cb605b0e39c180f2c

SHA512
1bd828a75bb0ed4653ed4a4e46b8118dd293b990d86fa0fcafff9ef8bab6d729b60178ef05ac97eff94b8e8ea0d840afd6a8360e53c919901a749efd62f40bff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd1cbb72599fe784bf86643afb128c15

SHA1
c29b4518f9bb8bb4c699daa272b06ff74ef017bf

SHA256
3040fd850f4d9a82b0e8190ecc932a4177a033af61a06e225c89767cd589f478

SHA512
dc78ee6953a091e9737a365917c5a8b9a8f9efb068a666608cc90c6974e89bef9aef1fb81acd431ef9e14154b63b6dd37db3b2c1184bd17266da9c670824aa3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30c063202005c6278771dd9c9697f5e0

SHA1
6953b417fed264f47cd02fa8ca08f91717612b70

SHA256
3840a5eecf73df843a290ddcd07c16246a0d298dd8aa1b00a70958114026383b

SHA512
4f8cb61a1e381973960c688a26418407c058173a3bd647001fd963bdb2acb72a63fd7799931c754902cb9322fd4fb9d5688ced9f0500746cc54ad459291bf6a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a42938b9171c4e863e0c694e3ab2b39c

SHA1
830224b8d7f8f0d600e79c40853144782bd4d722

SHA256
5b375f3a9e9073f0fc50f3a0254c720eec57c5673d42655f44a7a933ed0c1f64

SHA512
0b49c819addad72454ae3e2f4a3d084645dddd3f2a5fef8e79698004282aa76aaef6dc5ac07339f6011c0b83109434ffa82e9179336650c36575facc0dab98c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ebf966c9be096386af267655526bae9

SHA1
6cf542da5f6a188be8ff59c5684e698ffa6faded

SHA256
2b2d0a3513125cf812a7b84a5199cc5d3a3b3c6dd4ddadc33c92d1d528f8774a

SHA512
7590ce8df04fc4f01c6e57dfecb9dfea697e60a7eb47c8c90711280933bca9775b4d76364796ab534d87c518b9e6b546ac1ff7b78f6c089724934d4784a15762

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6ab84b82cc2de519d4720f7950f9f98

SHA1
f6cf99853698dbde09f0946fceaa6a7fd057f32b

SHA256
d34041b1b4a19cdba65437dada8270365d6df4ec3de5766c156280de8cc27b6d

SHA512
d5dcf9af91fdaffa0892255349f8aa88885fafe0b91be9e892fafc0b0aa735c7e098306c48db7be80e2c3681fbbaa8360d6e524674e31b18beb8be51dbca2c84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
951e3907cac4b4c83f6b6a05faa8fab9

SHA1
6a4bbff7ada1eee99cdd2d17ebf65bf1eb01bdb0

SHA256
73efd809571b36b89dcab3012050564fc64034e521fed13a048ff96d4c60b71a

SHA512
713a44286659a3e3eb24d609de978da635718344da1e1a2c0a42a8cd6cd8cf65c1de89e1937bdc28885f9a3c126cc502951a5fc270f00675a5ed5ab773adec33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0945bb6fa51f11fa76e742b67283dba

SHA1
194145741bcd371171a5bbc6c6a13409124be94b

SHA256
1ebcefc9621b7d0d4b3498ce1e1bba2646d150f779476c6f1d60d941ebe7f6a1

SHA512
250fa5546103937378daee4f26dc444a7ee7fb835e202ab7395fed8ae55d011f79ec1d7e61a6a631d27af0c40de3ec4c8faa8f48ea2d5a042e92ddcc0f7c783c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2718201603dd220d035d323c1f0a226d

SHA1
29d49d97352b730b0b8554e3bad7e01701cce727

SHA256
8d6bcb5b7a25b1fa919b5d398e477a05cc1cba986bc59904f3c886711d39735d

SHA512
efdd133341018968193365cf5fb503f4e02d6af27c61372b0e545958ea151e76bdff0b6b20e69e46a660099e1a99eecf8ef5b2fe03da5cbb403f81c17d2f6f55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81636b81cf5949c077910ab882ce7ad8

SHA1
4e9358fe9357a4c9a4ac14d40a809d0b2f18e239

SHA256
1077c10497d5947a4820b92a27dad68b0354669c1f173190569cbdd8de58b08b

SHA512
25f08d84a6e4e8660cfd75859359bf8a59b06ced99b49dd3b28d8d349f05033699590cb600853eb61e4d678b50ce42905a4c4420183795951a6c0c952ace49eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a7c12cc529d33b27d5097dea2f3c740

SHA1
8395715cad7c82ff8c46b63838570b50f1c833f3

SHA256
c21c3217c192217bb009bd94fa1f48cdfdd5d5f29e191069232e2f2d0dd3ac4d

SHA512
5f39bfb1bc14421f5ae2ca026195c44e47c2fc7a477a5fb62f80c3325474eaa5291c3f798aedf629a70779dd4fe8e2269dc8f8d6d6362c7ceec906d387c66463

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFFB6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar64.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit