c1ee28279b967252c114d0433abeff51c62881d0fca9d726feaff0725ece987f

Analysis

max time kernel
140s
max time network
147s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 22:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75ea5ef26e7b396b0b46e379246f96dc_JaffaCakes118.html
Size

9KB
MD5

75ea5ef26e7b396b0b46e379246f96dc
SHA1

5eda30bd3061fefd485b361ac9ef80b7e52bac4e
SHA256

c1ee28279b967252c114d0433abeff51c62881d0fca9d726feaff0725ece987f
SHA512

ca30ab17ed6cc2b05a93e783a37c2ef33d9d5469598dcbf6aa1469c9453d82b5b3935e11d00793172a3188326679632e7bb3bfda233d07b4892a268e8228ecc6
SSDEEP

96:SI3sIUbP8IMGXKjl63GL4X9tw6cNFb7sjIkfrbS8ObGj2wve9s:SI3sISUe6olrw6O76IkfCbaPve+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{29658E51-4C1E-11EF-920C-D692ACB8436A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0b1b5172be0da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428249658"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000007a8a024fb9ee85d3ade1e0cba53b590006cda819eee63062621c516642c59f3c000000000e8000000002000020000000b1926f10644cb8a3bf8ab3affd0b01191a345d75a23eaa1abdc824859cabfbb620000000f79e581fde74bbb9ddc645e6b961f7adf4942141ec2e4a4501e39ee1c8aec069400000001837dd5434ffb48eabcb7209cb6cb510b9000c3fe933eea5834ccafb2714119e847752efdbb3087d89dd8918b5652d54893687d7ec2a688f846a5517d14f2b87	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000fb65d47052d29c4183fdafe5178b98835d2fa9ee624d0b29632f14def70c6833000000000e80000000020000200000000562bba41f74ec45366783a64529ac7444ee444407a3f320d90a3d896b8e19f590000000635cb427990597a01191585c1021a3a43baefaa11527cb01a1ab286b546c64860c43616593363a6b3257e1c0a7c3e644151de3bb20e6e4da758b69f0562206143768b16446ee0f5a132ea309c66d233c826b9712d6f501dbdbc98d12e882e280aa7404b2143a9f9e36c630595cda51d5d44f2a2a9a361d07c3796e118a0074c7279ea600c70c7b3f859c423159183f5a400000005305e8494d9c8d832c9ea9487e7bb28a78bb9f328df7ad266c0a3814f1a1bd3fd3cae522f3694f7e8b56e7538a9a952a3ca2fd2c61035f69bbed6a538edb3a85	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2064	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2064	iexplore.exe
2064	iexplore.exe
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2700	2064	iexplore.exe	29
PID 2064 wrote to memory of 2700	2064	iexplore.exe	29
PID 2064 wrote to memory of 2700	2064	iexplore.exe	29
PID 2064 wrote to memory of 2700	2064	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\75ea5ef26e7b396b0b46e379246f96dc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2064 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c580618a813e34328b132669ccfd3fa7

SHA1
f984877c17e323e354653f4e5e5898a4feee47a5

SHA256
1969543fd6fae9af6b00dc556f818c9ca780d547d3a8a818ec00f7c4655e62d3

SHA512
00b61d36e7f20c830729ab2498876f4d42c815ac176a76925774e4c6c692483d836e06d2bf19788945b6fb9ff9233217267e4fb1edee6cb7c0bf56088fe9b5af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ef7132f52b7026d5a6313253b22bbcb

SHA1
8b1a895a502069e2f8717f5eb2194bd18f59488a

SHA256
340db4772f04237128951b09c3886c5b8482da2fcf34943d658adb9ffe42a11e

SHA512
7a84454fed9de4d85247807fdbaf5bab904bcf1626f00db44d3f5a01424bf35f4d3f8c45190755c9a7b7dd57f53253892c9729948720bcb179738ed52b2b4f92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16aae9e8b3c5495191df9d88d56f7b02

SHA1
ee804a057a696f9970890f0644633e22af329588

SHA256
095b0c6cfa9ebf78087dde5eccc91a1a62d8c085df0d6beb33d63bc623788dfe

SHA512
59fd963ad1026d5835ed56500052821ff43566d3950f09ad14ea4fb6609e030a70844248b9e2bd57bfd51c4cf0c868b47f09896ec99832b8adec63f99e6041d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d44fd8d62787537b619d0d62eca67322

SHA1
7875b94c78df4b7009bef89dbf6a4a2ba298b883

SHA256
5f82f4cb69c02a0fc6f95692b6caf05c6ad49becf5f2c9e95fbe3925a113b3da

SHA512
6f0173b6034fb52114f2affd048b6e1dda244612a218e245e4e02b7eadcbe6603176994842845807b86b76a575696888a45fc4590971f149af8f52fdff6a4551

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43547315ef1eeea38b3e25a52036d58f

SHA1
228f55c44eca4c6aba21517a644184b3e6059ab4

SHA256
f4d79f340f4b7a68e7a4a5ac7794c49c3e83c5c1ed89e57024a300833e27275a

SHA512
b19b136edde9346763a70de31e5fb251a7bf7b5ca7a5e3153add6961ed36530dfaba486dcfb1d01415483386a4549a65f1ce82feaa4750d8e2a6d9080b323ef9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8492855e291abb842875aedd02d4f689

SHA1
2833d48cd1544b585bbc34446f6b4e848a7e6d04

SHA256
5fa4fceee7cd66afff825ef7c2e4ecff680e5558fab39651db71f27f23cb3e84

SHA512
696e5181ca00559f2d5bab8e85f74cb6bbf76ca88d3ac271b645961929814b3e19ae015840dd959ae56a4e8d8d076b725e7c027e6c3c11766dfcfffed933b651

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78a3d923d47cf258f710952e21f657f0

SHA1
22bb04b4ed60698c5a9b8a562f645e8c4038632f

SHA256
9e91cf3753072e70fbf68c602ec4e3218cc131c5eab1025d9acdc7696dea6158

SHA512
f7ddc57b40c6a284c98f60ae981597da9bb86d1b67967d5ecf02f0f80677ac9cd001f78dff297fb8313192e5793f9293d40fa9458342fe0fd65bc59c0950f969

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e0abe85a4158353bd0bb82d78b837d1

SHA1
78eb9c1653362933395012310eba72963294d84a

SHA256
45670adb1875d7e11d5023bca8d625a71edb30462c929ce2e9ca1a1624814a46

SHA512
f73d1097b226d818ae1d4cfc994c468c585e7c39351970ecd7259244e526f7bde979712cb4620ddaaa02631a466e215d7a0c676a0a43d05278357db1b13908f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd95003399bfbcd93c85c0c34ca6b274

SHA1
9b7ed1c312317e2216a6cfc0e109669b77a03350

SHA256
7bf7ae549120fe04770e3a690b9dcdcfb40aa4807c2d3009cd0614d08a0f1e5d

SHA512
35315ace08d2df868a6a29014050ba6890eb3ec19e5e3f0b8cae7d48b4a7ee5057d3f7006acd5f977fec57086de390481cb84c30bde44514d132aab2c6db31fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51c416c8e30105a2145449798337a5a9

SHA1
735b0027a6b1c8fb7e6cfe25d541d84be6434343

SHA256
08987584cb4196167cb786b3e2f185cd0c99bcea8cc2e75b0e5e60f8977a4b10

SHA512
ed8bd437732571a796f5040e19de234e758a52cb4851578ac9d1efd81c3638ab415759b3c5c582d059c6167108a6414b7fd1900fd954e24b759a4ff9b33ff9f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc5f517b8003e97c82b2bba64929cc71

SHA1
c9c9e8f560bba89a4c3548094ac0d92bb47ea40f

SHA256
cd6f56e42b1ab02689d8ca935d8b4e1a2d939a6d308308c8c2ecae46ee8c3242

SHA512
47cbc6dc682ffaf6e46927c0c90c046c3464a84891444b87a24480f20c48a5d3418aa549f1fd5f8ead8cf3d04ff966170f062ef40db34f0f3b45658e5ec00bcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b57751e631b838006c46e7fcb2ed0de

SHA1
c2f9cd6c23bc9c699dbb6b7bcd469a666ccae508

SHA256
40baa95b52d7158ebb33d789934f5b2220e6b30431e0b00df3042fcfd937656d

SHA512
8e1eaece57ce5ea0aa10cc92d6ecca3c6cf4d9390105327afb8cc3f066e6564d851802fd5f0d13904871a161fe3a1e315ecbade2039f24666a44894ee66a076e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e767ade850e6421e3f3c4277b062c56e

SHA1
c34374618b4f06e84deea2cac7efb686d3196dd0

SHA256
ac24446e044a8439965b44098badd47958b2179c586b8883645f2312060e6f38

SHA512
fafcfda25cc1d3d5d778bb9bf83da1d347c874ec1e5d7da33f8e6dc3d613b4fc40ce7588a7ccc42022468bb1fe9d7fce999f0eb5b0f29ec1bb30f2e22fc86038

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1070cc659dab735c019e0f605fc3daa

SHA1
55f2f83e2ef6bb39f617d4534c480e83af8e221f

SHA256
cfd86e9fc418f0e00b44b8d03883ec0fa57fa33707b7d79f52fafdf872d042b1

SHA512
301bea0092079a7d2399bb09b796fe797a37537436df3d1950d855c161cb2972dff009c19f36ecad30ed3d71fb904c5c49b1f2c6ca82c9ac8d59afca017ebbb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7139d54d88212f9a686adeff5f392f8

SHA1
527ad74eaf5c7cc2f906a4f049cd1c45c3464f0a

SHA256
e619ea3631d3f76918e863518537a36f30d45f88e6ad2ddb001394dd635b7934

SHA512
d4ffd77d6d1af4b942be3da87e9cf5e98b027f91cccecbe6dbd2d688347dc10e21b329311f66a8b612c0882e8b2f94bfe9eb73b1efb17836e70bd59329c7e7ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dad64847711e5465d3937ce09bbda3bb

SHA1
75c809eb73d84679a3f56ab14107b2718d7c103f

SHA256
9496b04cc8bdb5534e91648df57ad743402ec187911c4ce9bb99e48e8b9eb48d

SHA512
3c70c340f69a7214bf8c2513e825a80b541322a07dad40802e626e47fe4fc0ee220e7c1f1fee2573b01c44559907a76963227626736372fb70b42753664124a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD461.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD511.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit