9bc10fa4211032e9519ce76e7ecd46794fb2e711374654023179fc89b1e28747

Analysis

max time kernel
149s
max time network
142s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 09:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

736ebdb3cc493c527b6410b090caaf61_JaffaCakes118.html
Size

22KB
MD5

736ebdb3cc493c527b6410b090caaf61
SHA1

18497e9cb3f06c19c9e780b8586823f41e1dc9ff
SHA256

9bc10fa4211032e9519ce76e7ecd46794fb2e711374654023179fc89b1e28747
SHA512

d3ffd91de0bdfca76c1b6744b1609b88486f8ac90262c6bdb60ed2f7ea94e6d26a6c0afa7cb2d12364a9a7f1538633e494a7854140213a16a40cd89bd59a96d5
SSDEEP

384:0DYzRr+8UMgLkxr87bOMvjgsySkY9CVIOVN:eYNrfg4xroOMvjgssY9CmOT

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428147159"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{837C4401-4B2F-11EF-93A0-E2BC28E7E786} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3004	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3004	iexplore.exe
3004	iexplore.exe
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE
2828	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2828	3004	iexplore.exe	31
PID 3004 wrote to memory of 2828	3004	iexplore.exe	31
PID 3004 wrote to memory of 2828	3004	iexplore.exe	31
PID 3004 wrote to memory of 2828	3004	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\736ebdb3cc493c527b6410b090caaf61_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3004 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70cace4a7cba0c42808720fe5a357ea6

SHA1
bac778c885987fb054414b5b1c6606ff533491a3

SHA256
b04f7e836c910966737901f8898ba6d0d47e4e9a276ae198afe483d2259610c6

SHA512
fcb74930f353c34ed2b5f405ba5180af69d9405f983d07e3ec33258dae9d9774f1e732ca8f5551104f25f4a76070b0c4ac253cf017639808ddd374198edc04a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b84dbd5cc64b3daf068de9bd09c1f41f

SHA1
91e561d00278f3924579268e73e24bf7948aefcd

SHA256
b7db919588811faea4023b56128caf7b9ce90be2ad4fd6fb31986cdf16b53d1e

SHA512
6f100a878e0a511e74fbd1af120785d9711e6918fff6a52904f15bf701bebdff700b382214f037537eb466efc75268d008826148badf81408b37d0be681ea673

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7e79ea880c3a446c198d088f462b7c2

SHA1
e906c2214f786dfcb6adf5f494b7053b2ef3c1d8

SHA256
fd73ef9c7ebe394ac034a46d04feee0bfad258d63e5227d70848caa6d0e020c2

SHA512
a591da01dcfe6992258f96b6ca1c66054e475d6df67c60cfbf08d86a3fde054c7eb55fea4e8a3ccc22cf6f22c422897341c4c57ef6904eec669e4146201a632f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87b8c9090514518c0766c24e2e6531fe

SHA1
7229f268f3d4e150c0016823427ef283414206ff

SHA256
458d1fe8858f71b6cf112edfdc1f76ec6149d5df92802cf59574828c140b2397

SHA512
3938aa553b93cbaf741008f14b94e0be81d8d452e2acdd6d1b903a15655621a40f8735b9250c689c123f126c13ee0575c3a98e00671665f85ea651c5eaf99d9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33cf547881ff41b073d74d12f994438c

SHA1
17c4c07a8ea723108176c2ebb52a8ed0472a0e32

SHA256
1e6ef1f6910aceb2eaa7c500a26ad1df919bbcca44b6afe9454dee068726957c

SHA512
27023f0a1a13248ed464b3f8e28d2dcd3764d88d0d5fe527e21ac6a92c90de0f5bb18b917526983b66bfe74db946b5ffe1a4ad658b33cf65a576d4c3be3d653d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a01291d69b3a4213154284ae7c08d85a

SHA1
e96087183275d1969f41a8c93ec244d7ed2d66e9

SHA256
9828e44b32c5225bb23e3526eeb6c5e64f817260b1d50022973b2e20fa8ec16c

SHA512
ed259bcdfb29a25883e8652f86079880dabc0aaca8b14c5b7352fd039eef6b13a02545dc8b72b55103f6a0fcf70d6cbfc0af21e6e8acc950d6a25e18cf807b35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1fdf325c1b0155a5e7e7b885758173d8

SHA1
1f32e87647a5ca4ddfbf9482e8b6ebbfb6df58f6

SHA256
f84ee720a106b0f865893f9db50b6907d11984ffdcaab8884b968aebcc264b05

SHA512
ea2dfc6959489b49cd56d18b0a94de28ff5a19cea41ab72e317fcc167f697117f80d9c0c5d23ea1107fc9891cf047998f403b8b804a37e03e34d1941c177d8c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08b6ffc79f8e96be1676616b39b80f03

SHA1
a1b2074c8d8bc92d96da2ec8f543fb28de7e02d2

SHA256
c39211d5fd4976f776d15fcd7a99b049e70b90cdd4fa967030d8e8fe59c3b992

SHA512
5bdd029973e14444eb34725a8cdd37afa79a9d6fe336e49756b65776c1edacf268e841c1b0911c2238b10f5af36a34d160cfab7c7ad61d9843e975fc90f12675

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e07956be0fc00ff219ec93627698256c

SHA1
6c70c2acf3f557c11673995caf8d51e87af06ccb

SHA256
9a25a6ca6f925ba4036364e84c951b5e3407d7a6bf95429e21ef87f8d962166f

SHA512
b8443ac3889a7846b676574ac45be45c454ef5667517fef32e59d2c3c164d65e46982b8766d4ca2001a590052b85bfe613d627cd2537e402f630b1bff36358a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dec2ead77cfd5aaf940bceffd1a0a583

SHA1
fbe213efce0353c45625944b251faf4a676124bc

SHA256
fb3b500c84ae1b3c42b026ced80916c1d622a12e7405fae39409e343c671cec2

SHA512
1078035a98fb190f685d91f25729c3beca97b9913cb7d67789674d7b5597d8da544e33952e8e06375f7b0add111a02d92ba721750636e4326ba346b9f3f040a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f95d9adff01ebe29517efad219540ceb

SHA1
0d2588de549159773a7719bd8b0c9008a7d35dcc

SHA256
c7844d5d3a522b5e2bf1ad2fcc3c224cd3a0b437e1bcf2b8af5666f119a3cab0

SHA512
a95bd591635a251ad68830399b58a6a2ab324536deeb131ea9caec2f7ced4702d0c498f9c5b78273d416e4d09ebb328e67e2bb1c02ea7cc228a5399930cbd86c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDE4E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDEEF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit