142ac674f5b4da43931e03ddf963786273a6d29688dd55107822a77777919910

Analysis

max time kernel
140s
max time network
143s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 20:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75a1c033c9a9c9b36bab2cdc3603cc2a_JaffaCakes118.html
Size

81KB
MD5

75a1c033c9a9c9b36bab2cdc3603cc2a
SHA1

3cb5547e4f1af732c3a12be3f7fb4d6be516d021
SHA256

142ac674f5b4da43931e03ddf963786273a6d29688dd55107822a77777919910
SHA512

4dc73cfeed817b9334b6bcb30c013121e3bc1609cb65e1d40e9ad5f9e8c685fbc767cc69dcdf04d6cd3573e7959844545065d87d4379bf8c729ebc9b973ba386
SSDEEP

1536:SsSLaZzfk3mGC0zZ2wQzRlkFZWJRigGEFhH2csw:SsSnWGCHTzR8IigGQH2cF

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428232141"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000b4a737a26a56cbad8f39b79045d23a0f80a729f4ba88d813add9eafb83a285be000000000e80000000020000200000009dc92c987f0e0bb6e4f8aad5970862f2bd567f2fac90b5e250084d1e340fd8d890000000a0cd76c3197dd6b0ba30353402ae134e4213aecd86f717010a43d77b921a6810b659de0139e5fcacef852291c70e4cefe8f5551a3e1b9a60f1b568e9bf6dd50de9a00f3144c94e0c6d836c5b1b310fa76b3fe310c3bc898b34b3c1b67f36170eff3809476fdbc9ce4fc1ef06d0c9afe16ebb4d4e49166a2eaec5adca0cc3e560b865096b8ed6c9ffb9eda67c263ed46e40000000bde3dbc431916f54b51da0b8bc3e11239b4d7932268718feb32b3a6a23ec412f85b4876fb15fa4b0a784fe70b4f7786e8c4ad4f65132cf71abc976fe543ac4f1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{60B04C21-4BF5-11EF-988C-4E66A3E0FBF8} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000000f10b6d389c218104c9dd8f1431ad61701789b99a2c32a5522ffd9f6f78239ca000000000e80000000020000200000003abd0b41869ffd4fb4180d8ae30d55ddf48206540f7de0fddb35737e3052711d200000005c349a9427c1850bfdd7de5af81d98342799d94605b7bcb9306b0402a13dbdfd40000000f9a76622ad70ef5907f4b5fc505a3e3f64d334b662372d3ac66ab5d0217cd011e531af698d3e14798c4881a444cdb4c67bd7a8ddc5e150ac658e1d3eeca8c099	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a037394e02e0da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2848	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2848	iexplore.exe
2848	iexplore.exe
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2704	2848	iexplore.exe	30
PID 2848 wrote to memory of 2704	2848	iexplore.exe	30
PID 2848 wrote to memory of 2704	2848	iexplore.exe	30
PID 2848 wrote to memory of 2704	2848	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\75a1c033c9a9c9b36bab2cdc3603cc2a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2848 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3cf2ea07369d0589c058d872f61bdbb4

SHA1
8e7c8689d14840b814688a0efd079f53fd9417e2

SHA256
aa1b0aeaf6fb9455c7e8e83513e289365126d264f2c8a30b5c860fef52d9bc74

SHA512
74908bbbe3d3e05141c20e1f9b5dba5f3c316fd14ab0390be23355caba0c9f71fa8f2715575fd885df73d4a2ed393f7a118e135aea0bb1d1bf16955dce340167

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1d002c8f6671c2958f591b8821b0b24

SHA1
359b4fd4cda265d2896f407d3444973160162911

SHA256
3821dea16eb49a7a78bce12843baa4772e8f39b806452a74fa9597a01dee3669

SHA512
1057153593c6eaf2a038f06849edcca8db1eaf4c5d9326fe8814dcdb71e09ed9698316c0d832cd840afe10d91d80d47cdc2209aad55ad0a67185422f5d8ce13c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba652eebcdcfbf50f8527ac2673b9577

SHA1
4da0b69cbea14989db2a86eab8b4be2661e9528a

SHA256
d2ada778a53e8117637864e6f09a8d475b5262d491e4647eac2a739e6be0987a

SHA512
85e2df095d321bfa6a3d989dda32e9cdbd7ea7bc4ab035233c3cadcc3047714786f0686539603f1070e13381d28ec8c0b33b301f58f2d7a8c12e0cd20cfdec2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2b92d1d4014db4d9fdd38980a0c84cf

SHA1
5ccaa9f7ad96bf7a0041ef8ec2e8cf5337187d6a

SHA256
02e00cda45e4f530a5bf925cfaf3777555a7fa28aaaf0f59bcdb194c9dadefd8

SHA512
81ff8414ff21d08fc02ced416619bac53acb535f602ceaa689c03343b6d168c894bd77dea59126e2864b12fdf258b62c6accd84f8598ae132b1cea64949a3758

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb01fcbd81c66f910862c944fa43e414

SHA1
b9b46d1d00b3d874454b2460a047f6d225f27f02

SHA256
db4b50a5288281c22a4abfb9ff5a85f5d7e3fb6934e24a7aaa6bf19bdba60503

SHA512
022046f04ee83eee727a2624c11b18fd357c799e0d227a1327540adc3fdf54db63fb2233c484c0acf2a94edd0dece976bf8570a9307a50a842929f81c490b6c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e007c8ef68236aaa972b9b88c361b6d9

SHA1
6d3054fd31c5323d455e05afc177c9aa53c23a66

SHA256
dcc81ebd9c833a91d52f6fc26d97d4c1f7a918b5861da4307388900a5e5bdfdf

SHA512
fff0478792dfa6399c7c2774ec0596ae5dff1aa524ee57d92a2130ceb930850c529f262b7aa64c35bcfeca11e9f8355af3839e40e5924c06124aa2f3764e2e11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e382032ad4aba60df8fd0b7026bc9b1

SHA1
5b8e8da4d99584c08468d11bf1c1b6a30d982f40

SHA256
4d0769ec16fb7df8d97bf33d32485ab3ca529b6f15e69fdab5d88a9a01eb1447

SHA512
0627d908ab092dad6db11e9c30b12688a969cc8a9f1eb20c9d1364fb31945338fbae232e67ad676d86dc3d83ee12f09925999b2fa9915a73a1b5e58e29482f4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90341302e35b208fc923e5e22b5f65ea

SHA1
394e3d5ca3836d5828af3990ad3788599fc16b80

SHA256
062d6638a659c3eeba6343b60759d0a247a8643374631ead556519ffc363d64d

SHA512
f3995b9fa6edb1bb0e3f9ff7c42b4274ab1157b9c82faddf9f59411d68df431401cd5bc17b2e2abf1f47ca3c6f59bc4d840ee98904c181b97969e0aa8482e4e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3f7b59c13ab145848e5ea7c0be1aec5

SHA1
9a2b9f840508b1cc7b1e078b61614a22fc095711

SHA256
e12c2a339bb821ac64e8e59854210228ba57fe9bf52d2df01bf768e8b3c8998f

SHA512
85b087c41807fded0ec2aeeb5c74e86c1d960387a19ef4d1ecc3361bc475d1f1d1e798e2f662d593ab771c77a10528e40c6ca7a5d938b3409097891045dcd1db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22d216872910e6a76db226086f04b2fd

SHA1
02603ae1bea739f616373dd777fcb74fc5eb7424

SHA256
608f99b3f6a959030e4e23baa27e164afd7338c2c45e4a26bcde73819b06bb50

SHA512
680b2f1b9a6071b5e3401e443e84f21042a3276c7bdcf8655e33a246d5cbf0520b14165f9faee538316ef51cb63f9c3935e5843b876d833e72d9251e28f40904

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9bbf0daccfb27dcf18f11c78f8033bf

SHA1
dd0bc442b21768c50c4be04afd9c0ea53bd5883b

SHA256
9210ad143b0f9ce48a31528a2b5f6f796e7d9a3a1337d46136e2c8ec9f96a77a

SHA512
a1dba159a60a9ea60ae0b18ecdb84995c423c9f9dc9c6728155b9a7ecf9b03de515cf748f2aa285e38d796fb7a1c200deb7c9ee35611480fe54c646aa9991bbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9107b46fca0fd610b10f09e0da7e6d10

SHA1
1fafcb28c573115f928d2067b8f9f7d956666a8d

SHA256
40fef7c4b8539ff3d529ea4585e435fb3a31aa0af8711e40dff2f9a2d6683090

SHA512
b3287281d4809d763dc2419019dfebee831b33c089302229088565ffd2cef56ff5b3b3af70feabb5464b46eae6a884af262edd4edcaa86e63b64327e147ede9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0185c390246632d732dc21d5969e5f5b

SHA1
95bf82141925c242ae0e2f5f520c0087547b04a7

SHA256
faec2cd9e5ad1a806ad3dcda547f7bb41714baec6f144147150c89e4ecf8b29d

SHA512
222430b8f8ce98d944e7a70a18c912b29126202af76108a00a2518fad302b1226b37446810d1c201867ec9a388b5086163f9c99f4ac1e28264fd5bf7541d337d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b1e4cae37a24b30317fe309cab53f78

SHA1
195ec4e4823109dedf07127076eacd1017030cbb

SHA256
caa09e21f99cb0a89940aca5ddafa61018efa2e1dbe6d8ef7a785d506909074d

SHA512
9f0d654508fa020f269afc155d6845fad2841d87429a374b1bd18cc2dda3cc546520d479a844d3a7a799c3ddd8db6970288f5fb58cf0f5963c150646b84edccb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d35b2c4c43c26b07b746338276cb8f4

SHA1
ec4287aa2d08f44a3d0b77baf154b510128768f6

SHA256
8dadf4380e93445a8bf5116f0444b601b5b517489c408cdf3c0241a7f7ea66c8

SHA512
3142e0e0dc4e128715716b95ed6065c56472a30399b5bcc3f3e3e4ec95b896ba4eb796c032b9a5d493f065a2d30e2cf7f886e1ab4f11d14469b8419fa2d16899

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f886bd96962aeb8043154126fa53dac1

SHA1
2181897c915759a2b995475c3b91752435391876

SHA256
adf4c537ba39093fc6c86c2d508f575762161dddc09864e40e7e88109ce25197

SHA512
5a0880fb200f641376b609df4a94173478d86826a2f9c806402b7da19801ec5b1bbdd14f0aeb7e925f3cb70c4ead27ce4547f40f5a8e9451ed075a5ba9469448

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC5A2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC661.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit