84143273e61d35517a02f69371bd632a3470adc398bfb928e7a107e647b5697b

Analysis

max time kernel
142s
max time network
145s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 19:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c97cf3c3831396a1a49986b08e9e1b80_JaffaCakes118.html
Size

95B
MD5

c97cf3c3831396a1a49986b08e9e1b80
SHA1

474c33c9313ba7fd39a4e2c2821194676722e06c
SHA256

84143273e61d35517a02f69371bd632a3470adc398bfb928e7a107e647b5697b
SHA512

7f07cbb0cc27ef0a62b1a8fb8adef9cd3f00ce839864da5050c3a6baabfa89049f85e2e913dc8640ba961d76acfb01ab613e3d4ea4299a22c875c87927f0b5c2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0f15c4a4afada01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431121856"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{83E5EA81-663D-11EF-98EA-6ED41388558A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000a6b6d2fc0fd48ce14a280ecde52ee4673f32953b71908568710134e0e26cbba0000000000e800000000200002000000083cbe39b2dca914bfcb1cd34cb5dadaf009c09c06e1fa42865bf75f648a03f8a2000000029bc83936514651f5aa09e44cefef2a26243046ff1516a53d22663ab82a3fc5d40000000fce593e97e9faa7fa2ddd1c0a7196a08701f2aca4a82160be16f93d5e2675cd917e92192578bfc319f28b685613f97472472c46f7bef2c9cfe5cbf31005eb73d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000002ef9a4d9c13b065acb3e789ae7f3e8169cc51d07ed7f5d4159830ebcdab44b11000000000e8000000002000020000000adf87c054a8de544509dee8a957a4b5c30ca28a446ac627d0e8bc77f2768856c90000000af331a63558619555b6a58053fb566a3fb456274bf2166d6fdabb8280e6e693824dd6a1f4df87068729b15a216b19f483fff9e82f6b865d24d3a777cf68170231ea3a6740af84676a9ef331f7ca0c5875045fd6e4de633342b404931c1cc64c46ff0cb8447e00f26cd46719c9d986c9db9b0130f7abef0bd31eeaea88f2ea72a778ad8bc62641c741513bbc07d4698ac4000000069337d03f38d6e2ae9b949fc20b5fdf7b4ca9914d99027371b640b1edb9c49ecfc67a825fe413f0cb05ec6fc2a8c1d04240fd0b1b077e63ec9721dff9927b6c1	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
976	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
976	iexplore.exe
976	iexplore.exe
1748	IEXPLORE.EXE
1748	IEXPLORE.EXE
1748	IEXPLORE.EXE
1748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 976 wrote to memory of 1748	976	iexplore.exe	29
PID 976 wrote to memory of 1748	976	iexplore.exe	29
PID 976 wrote to memory of 1748	976	iexplore.exe	29
PID 976 wrote to memory of 1748	976	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c97cf3c3831396a1a49986b08e9e1b80_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:976
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:976 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
8b6e6b023f3574c7caa43215f828da3c

SHA1
d3147715ea49aa1b9edf82d87d6a1dccaea89ae9

SHA256
f824838adf06acde15f4b036fa9e3c282bd08ee33c0e7437741befb1251586a6

SHA512
cdd461039ce8d99e4fddebfdb5fc8e3bb758a0359dffbf86c9cd77e276e503597b73a0e13874ff3e603ee1543b1cc974d28e140728063dde841c1cd9bb3547cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea8e4bbbcb74b22e94b67401bd26f38c

SHA1
2a849d38e78ef31f27753e5eca23d5e2e2f8cac1

SHA256
385b80e495f5c2a91d4c76c5d60323efaad905ef2854e3489648067d6a1e4c73

SHA512
c698a7b27346659003a7d2fa666ed3b07889fc0db6c2d15d7a0ec061f774cd16c42b4dd64a15c2b9c0b562e31c4f8384af283190ede97f9116df842c0ee294b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e5f12a0f8400c4af7031014ae89a9f2

SHA1
7267b8d694d5f69533de44feb88828073af95285

SHA256
c80d14b928e1fc2ce4ceeb70f2a9c67d311410cad585e8df658b2f9ede271436

SHA512
0a9f26377538d88f10ba40da1b335e32616793dc343d8fb7851f5e34c356a9df076e022c86c3afbacac8c57432f3f83f3e05fd12827446db8bf0095fa44b0ad2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ae18bfaacadf9087ec89733bc322c0d

SHA1
29ce506206af18c08ad1784f0ad1e2118383a982

SHA256
d5c76206b8601779e0b70d848c64bb8e061074f71300f0777e1a3336c7bbbde6

SHA512
565b27096433f63bbb95bde378a8008b76dbf22932b46ae0d5bed28a7aa1f7e2278b0c99b8aaf2610e844c32716562b098892178205b79a37c954ed4bd341a7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c5b665b08ccb8e727efd5b027efaa46

SHA1
681673d78fa351271c939866c90ff0b2a099fcfc

SHA256
c7810c6bdf941462f6a664f4473086dd201465d3ef978046d313621df53d5265

SHA512
756306d34b902fa1470e009b01e7c9a4c625364ab1b3962a5d3326999fb07352ba5167f09934a68311d9e5a1ac1e7cf71b7fcc9f86f977ba456f443681cf0319

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0ad26574ecff2ed2f9c1bab39e4aa5a

SHA1
b8dc1155e7785b6b7f7a4c9a36ca139edb27ba78

SHA256
442b05c7715b6710146758e1f25d486e6564e295303165c62dfe2584f3e99bcb

SHA512
1c28c8a5f208ff87ddcc0036cfd8b071ef6bd4d414ab0eb5768c2ca90559ceec2e6d5ad5e8a7e5d00c78822a8df4adb431402140d7856b87c5b39b10e438cb69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a09ac93d67edc7e6715cf5b3c659001c

SHA1
aee509b4b31f47bfd24581298a5e72243faaec1e

SHA256
5c34a5dd52bc3deec16ba3abec92e04b387b41772ec16703aa15a6f8af1f7d6d

SHA512
e33fd0b6bc4bffa529b92760abd2ba0b8b46a5b2689d63f01d3e318cf40a38236abc21466281973316660ff3c71a8977b888c939876e16ec0b209fa5a944a1d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7f87eb64936725f599e771dcadbab5a

SHA1
6119218d30955d4f9dadfe8ba7dcee7c36fbfcc3

SHA256
403f074d7c3a155c27d6a8a71834dfca80d4dad2c27ad9e46db7bf7ea90ee3f2

SHA512
29208fb0050a057c4bc139b980b3e92ebf3b870ef708e306346c9334f9fe33e33ae88021c9071f582b8731c2142fd221bc0f1728021a29e54a28b339027caf6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
138a2d5b224e9fd00d284d6cb785fbb8

SHA1
02c6e37c3fae52b2b8e2e5baa4313de9ee92d39e

SHA256
1adbb2598481df1bc384610633b10d4d21c2b8f19d47b4a292bc8ecc69049cfc

SHA512
ae32539eb7249a9917b2691c2c1885401eace352c5ffeb6ca24be4b0e731a7d97ef2ef6be7b780c0368616ab5b1a4db667b45772f12a5014d195126088e7c2e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37420b09b08189da848e953d644bdc35

SHA1
9f094c76f3251ea687345c354c508c1b6e54190e

SHA256
2c1aaa33be2d205dee48415cb8905d0fccdb5904721e9d7d59fad57bca6cf690

SHA512
11c670ec37c9686b96f59158dcd7739bd7b6388a509c4bae525a39d3678d319f90d6b931d1a56fac97ed2f151b20a9dfed0f3575669a6bac4526b61b0a311567

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0628ad94f53bf5a775e526a00212c9ce

SHA1
98be1c7ee35bec6e1c2dad054febd3bed0999149

SHA256
599cda6df8615203588731dc3f1b09f29e69efb6894d36bb2cb0522028ae6a24

SHA512
9447fc9d5c05daa23da624b4c78d16890a64bb7126a300354077bbdd26a8effd614fe0579332d13c85b63678cbfd07be6f0b5049c91511e6390eab86cb8295e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
fead33fc5fef135b2c0ae15354391580

SHA1
893bbe01e18118961e016238bee07a79d0b21d94

SHA256
2dc395c9841dec38be1d4796932b9a80070542934174c6eb96284d9d83601705

SHA512
e8725a19b5556939fcbe21a2551c76c3e9a113bf77fa9b184110f66144852bebb030a32eabc935405d4ef97884b480d41e25f2899cafc49553163e6d16ce43a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAFB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC80.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit