e785e32a889e7154446496c0a7b91febd28d1d630ef183a8f4b9993b296b4db8

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 19:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70f8ab658f5266aaf76e329143aa53b6_JaffaCakes118.html
Size

1KB
MD5

70f8ab658f5266aaf76e329143aa53b6
SHA1

a2f7b931947935d13556387b39c7bf2fcc62627e
SHA256

e785e32a889e7154446496c0a7b91febd28d1d630ef183a8f4b9993b296b4db8
SHA512

11962461a1a85b92f019713e6db063a885fd5946c51167eba917f7c36395e65e7a2f61c007979003f245adc9e62ffad027c443d1cdfd68bc7d82d68307bfa5dd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c000000000200000000001066000000010000200000007383f6386e7e2d22bdb8f44aa411c67a9ed861645853a0d20cf177398c2080b2000000000e8000000002000020000000cefaf3bfa81590ebc102fa7e4267f0eb869dde0b6737c972389f2122955ab84b900000002389ea3056786a90a7f32e94ade2201c19df030946c9d241958e35b5e4a5a6a1790843cde9c765da7f8428b948cb10ff403843a08ba5b5361f5dfc98e619dd1f016f8fb15008cd5cc938e8ea657f00596e2cbc7617df8d235651e20fc6d705bdc3b2664bdede93c50d4fa52922cdd50c389f36da34fb3a6de1d1ab2a657c18826acf2fec0738ec932cf598c3405e1d8a40000000ca143263f313c50a97ab849a5315a2724aff72f588a680e7187ff62785f88db8714ce93e10ef121476889083dcb5e872f5681f106e03497483d9da31c821ee35	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AF0EC871-4ABE-11EF-B3C0-E6140BA5C80C} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000dad716131649c547f23e195b8b80f9ae9eceec9417782415bbb3f5d4be59111d000000000e8000000002000020000000b0d1245f26c9c5866704a7fbb5d7b056ef5a371ab19ff5e396e49e2877a0e5d82000000030de0d2ce55eb9b9ca32c0cdf3b28c4c93244aed66be07ddaf240fbbe0aaf49f4000000092be0b75886ed6e1bd6363cb9ea215f89ba67b8aac50f5d529445f22c4c746d47e3a83438f664d208ed81293acf77b58cb5ca3a6b979ae984d6427b1a431c55c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b07e8a83cbdeda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428098699"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2236	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2236	iexplore.exe
2236	iexplore.exe
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 3060	2236	iexplore.exe	28
PID 2236 wrote to memory of 3060	2236	iexplore.exe	28
PID 2236 wrote to memory of 3060	2236	iexplore.exe	28
PID 2236 wrote to memory of 3060	2236	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\70f8ab658f5266aaf76e329143aa53b6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a73042f5f4c98a43a81f5c9ee51885f8

SHA1
34953db34d11ecdaf0bff466fade1a75271b0ae6

SHA256
124f17bfce4618c90b2aa701371bd734e7d71a86ef264e38eb72a5cd6a3c0188

SHA512
6e3ab1bac33ebff9d2a5a7b6820fa7bffb5bc4e78dee4221aba65d9bf9872dadd03f5a9b88d4cc29592b2a57b20de81240b26ebd21b0f3f0e75fd7d14f68f3fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
535ff310f95172645b06ba425749ceb7

SHA1
0f9de7aa18aae27713be1ebc67cc15ac426495d4

SHA256
16d618865423d187c678af2a4bf79b6f61516f42d404444e0f5e160f736486b9

SHA512
12ac447b2e267e28bb879d4a2928e882cc2d8f539c0a4409fc8a09faa99da4a249efeddef5b6ceacab6704bab2148f22d4de60f12a19fcef6a3b8a01293209f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3d4aa6e0e93a084379fe2c460be1a906

SHA1
a44ca3b956627251b870c55e41900e1f4e1ea409

SHA256
40c1700e46672cd1058b6345647681f382ebdaef3fed47b0f3866118b483ab43

SHA512
05ae6765f3b12033e152fe236f06dee6fa70e35e7f112e92335716ceb5b9aee7159167b9c5562187f84368c6e8e6657f4592c8b020a3e125280310567a1bdb95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7e6326ac308d500f7c3584cffb1d2989

SHA1
c6779ab61bbb0b845b16ece9e68800b898267169

SHA256
f89db0e32607ce2ac8d4e7d91626e0fb7db13e2c1906852f18a57bab0198351c

SHA512
1a250e61d74f92299e158c6488acd8c051ff4e59a1a06a4013bdf0a5f96b076e0845559c625c2265f7b5d31759b1c780886937fe6f957c4e4baf68d4640e73a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
09fdd59e51d8b434f63f2f646a979576

SHA1
00896aa30461c9048530dedc7a1f362fbc7d1771

SHA256
2c265bed1b03622e86a15a68b06e34c362e4fc400889d52500d56c84b2d4550d

SHA512
368c26a852ae27fe749e2a0cbdfe608b16984cf8f48a143cddba96704e2a97af9a8f08a34c6bf9cd2cc2ff3cffbe345a3ae8f62e822d4e4262c742bd02555e8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
fbf9cdd9f4fff41f2b801e87c63677ec

SHA1
1c3eca3e396379890273af450be7c53730fcb72d

SHA256
cceaa847230ef9302cc77bf119a0bd9093a7e26b07025e2e03b4b7e184d9bcfc

SHA512
7125cb4442b817ccac1ccebf8c7735a8812db3d99d88118c1a9a89808411d08ebbeae177c209947136aff7cd12ffdb907988c235481bd78bf1918d4efcaef03e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
30cdda992588af561891223a2fc923dd

SHA1
837032beabc74bc17b2d75c0f69cbf8eca172b0f

SHA256
bf33b23e07e2222623113cef67799d1170439f56eae08b31eeb4f5582e6f4383

SHA512
3f8843fbc032399437323703b9eaa8ddde6fc2db09d016dec792d075514f823d77d7670d04a39c51c7d4e14897c6d41c4f3417934a1b65761714c9601355ae54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e5487d61c40b4175751f00a746a52cea

SHA1
4bdcf65acd1da61c16d7e6fbedfb0a32658f1531

SHA256
09b1490ae4d6ad2275f9e8abacd1120e89ca226474f63b6cfab90bf23cd64e69

SHA512
fb4641914ae871bd505e959fdbbc23c5edf2e2b370ad09d651408d6e2d26de44c3c78acffe525c987051e1d451ec8a0ac7deb97497cb240107f76f7d2343bfc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
abd456998b43837311299edaedc2803a

SHA1
a7222dfa7dc65210b36361eebffc5e41d3dca62a

SHA256
d1232cb3dacf24ea1203acb53b9e202c7199c037356f38d92de3e2e1ad9481f3

SHA512
a7d64f995254fba43d78d498a98c0153270e0d030c98faeacefd8a33a621623c3608ba30efe46346464d46a1d26ab136a33917187f2de249f3b0adc2fe7707e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
92e30f98169561006ecb3dfade20ae07

SHA1
c1fa18aef5f03b074ea5e22a30fe367c93f3824f

SHA256
4aa46ce2d715085f6b6bf91a4293671e5e0c12ad0d96f085b30d71adc40123af

SHA512
d93078a5e79700f89f143cba33b941d29581ce0bd07e345396a24735d480ed06eb032e81ed74d1c7c00746679b16f6b55735dbeecb56239d0dc858c987d09b3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
69885787c1bc3a3abeb01b6802ffec1a

SHA1
ace031a85509251621bf14a612472e5d7f64bf7b

SHA256
45f15ab460395171365ebc751e42819e6e7b15505bfc3a74be2593e38a84cd3c

SHA512
fa8fcdb24716068c8e52c2ee1c4a741d94dd6092741dbd31640e0370a2b73ba1da7a8b62b4c54664c92e8c48d2959e89737bad250bbeddefb64a68579e51c712

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8e03d7b2cdaaf2f0a0cc957c0a6a9517

SHA1
4b6aaab4dc6fd9a51b3fe8cfd1ab65d226071d89

SHA256
9bee2326f09ec9052afcbec1b1ced56e6c73faf4c50dea5434e54ba8a37ae0cf

SHA512
dcf492fc5758c2bbfa2e13ae14ab44531e49c7a243765a4be75767ec7c5ddf6ac26e0866325132c50d39d3d4fe5e1e0e8d254b3d20984a5668032905b6caa13f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
20d4fa025023b0f50c14be833338cd41

SHA1
bed35ccc5956a609219c0062fd00db24276c4c50

SHA256
94fdd3463859b47ad0ca1540c34468cf8a6ad1acfa7aa674a64ad685c68b6a73

SHA512
6ce6864fade36a0893cfaa192c65edc71a9a668ced2cd097127a18affa7a61566b6bec2934579b2308c343e90e3e7d0c2077799524157bd1846abb928db76b12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
be01dcc3fcce56b8db5ee93a1b1cc5d4

SHA1
0ffb8231ed103d2ec5a8fa02ea1bf71270584f65

SHA256
8682da3831c1bf4d553538e6a8af038ad22a11ec5696d836a8a67eeb19d19acc

SHA512
dc52af8a788d13737513285cf740aed3ead583b8199f526a585d4b2ab96da161f3d0c1c2f57dcb22480d43315c42a43a5d6716214acb3c17845563f8028a496d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab64FC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar65BB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit