c3e252f5b92e3b88612ec0cf2642271e420ba19f38ee1f604a39e641cfb1fc5d

Analysis

max time kernel
134s
max time network
127s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

790b3ac13972d77320706ad88960f4bd_JaffaCakes118.html
Size

90KB
MD5

790b3ac13972d77320706ad88960f4bd
SHA1

9301653675b8ff216c4f741b3de8f0b3e5788efc
SHA256

c3e252f5b92e3b88612ec0cf2642271e420ba19f38ee1f604a39e641cfb1fc5d
SHA512

8033d7eb95715c623b634a7f16fb05ed45af23207a5670586dcb8612539f5b8f9626be55bf7e7d1b39ee15815c37de757e06d1afdc97371c78599715834ac8e4
SSDEEP

1536:wpxwExNaOcFRZXBqf5nIfGuDifBwEPwFuN+ZQ/WgJ5cBqPfVT0MMAHE5GFIkdU/F:hcvgbMe6Xo+Ikd/di

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000f5e68776110a3985fb811022014abe43c1fc98bdfb80fa3dcec9648f2a7ee0d8000000000e8000000002000020000000dc404840cd242afb1f530e2ff6d9e97318715ad41dff966670fbc75c2fdee438200000003be4f4da2b4d18642ac752f514ade226cf88ce6407bb50533f6116bc36670e9f400000004c55343e5c4240cab44b4a41f8b5c6980686822a87fe5f42dbe1c5e4aab4768d4763e1746eb2794be59cfc009547988b34f0502d4d2e57a05b8a2a2c4c3954f4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2EEF7C01-4E6C-11EF-8031-C644C3EA32BD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000001d3b6a6e4c3166e6f71d0703927e1fad9329a37a5dfcc69246ef6f29b3696d50000000000e80000000020000200000005ce96227c5d1c3f08f8ef2cac11d23d74b529f3031b326df094d9151239add2490000000e8a260b0b78ab3fdde13e244560fc123405942869fd14261eab21f221245cd97222bb8e0b4b9f9c0c1ddc3e501552c18919343451939d2ffefcb5112242712e2ae1e4ff8fedb80482bfae5e2caa660c6867d61be9fe57023b479c4dc81856bfe5f0e10ccb06b5a0e81f70ed83715963c00cbbd0a80859fb3e9d8129c894e98545c98b5b1f7e2ba2ed3535146254240104000000095aa6baab270bdd79ff7d2e38344f203d79e446055618292e05453e3b763be696e13518cf4ce6b04f356166d5b47975a1ebc2c12587ef2d61a010b64001fe808	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428503070"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 304c750379e2da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1732	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1732	iexplore.exe
1732	iexplore.exe
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2240	1732	iexplore.exe	29
PID 1732 wrote to memory of 2240	1732	iexplore.exe	29
PID 1732 wrote to memory of 2240	1732	iexplore.exe	29
PID 1732 wrote to memory of 2240	1732	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\790b3ac13972d77320706ad88960f4bd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c7942f35eec7c55282e2b058e5aabb5

SHA1
1f48c8864a6859c775cdcafb13458b73bae91be1

SHA256
d1833025194aab6a55b9d8e40b10bb4aa73df5c7e1bb21fc845ce63c9d95d0d4

SHA512
6f6fea2fbe39153d5fde39e5c7513b664cfbb8ba2869edc5a0f97ff7fddf8e288da14b8e753dd6dfb83b1e2762846eb71ad4c79fcaefc626b35d2299bf1aba81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a907ad97d9b3f85bae89d9ac9fa806e

SHA1
35fd7c15c5583f7ee654d47d4b5e39c2d3b6011b

SHA256
61165874fef0aa0860d9036975f44e95cc0aaa43b15cfb092444634b993f3bbe

SHA512
67cbe44af38ec581f8819fa03909255b4393b2b40e7da1ca4c71c192ef52708e5d0934278b6ddb5041cbeed4a65659150af5c3cd2e9fe5a2d4b8c2fd25ee6224

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04685dc95538c763a5f80f391dbe5fb2

SHA1
fe2b8c1f8021256091a265abe518d5a5d51ba23d

SHA256
2d913d6b9f5279606ae151e66f827c01eae12efcbb4352874f10bd6bcd95b9fd

SHA512
271cf98c527f05cacd0e6a38e8746ec3c4a3aafe48660e71885b6e47c0d37bdb8c4db7638dd1e5700702a8da9e13604dec032eac48a7db5a1ef82f0de966997f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7d096832ba08d687e2254adb92d3d4b

SHA1
e5f6c18eda2357af8baf6b242086fbd0a7f71ac9

SHA256
656c8a3a04a668a8d0a420991a73235e53b395011edb67f6f636e899ef6e1918

SHA512
baccb33b66850ef68ac9056a5c2db0e44208ef420327b26599ce5e89122c2fb4de51a1cb51815b34d067a094b9777bc8dc3a9b7f3d8d01df9fd92ab3db50f1d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
743f4ebdb95338cd06b3a7b6174630a3

SHA1
70c74bec7ddc1bfce346a0a9b4753f8779713d6d

SHA256
93cf0dfd27fe33e460ed4d41b7d2381f2df634ed7674a0181a93d09b87ac8dd0

SHA512
dd14d17fa475522f6197e736239774c958bd59d730b72fb2ea9d9d338043bcf1e6515731b8b6499d6165f30f7c9f3f7abdb85c3b2c40e42cdd2713a978326d57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e56e096a2854109ee2fdd2102749b75

SHA1
ecc412effbe439f99832596f90d1e3a4bc8126bf

SHA256
fa3cf24c8631b2630ef9fa8d12872aa8eea92b147cceeccd06ce9c0f385789ff

SHA512
2b6c3f6fc3ac1babdbd2f794592266b1d85f2285e9228b0d9849fcda017fb1f269d1773f6e62cf6a81649761e2a54186455ec1eb36d29b14192cb87981e5e240

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e15f0b98e0ecf441dd414c6f299e1b7

SHA1
0cd30d2435ab23725d4d6e8c0dcc4aad216be56a

SHA256
6f54a51688a09b12b84a627c8d3920eafce44f097becb164fa8eb876f1ba17a1

SHA512
0191bcf5f1c862d27499d61f45c0d522ca558884858677a4a512c54a2a1541b7c141e47ebac5302fd2707b8c10a141160184a1beb947d197539b7d74dda64206

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c882be620064854a0e0a4f7fb1bfd4e

SHA1
bf0621bb01250d8ea4ea11657577325b906d8a31

SHA256
40349f20f0af856fed81d7e81330fd7ea7142f4a034cf4a1f13c71d2e15c6d30

SHA512
a5565f7fe83d8e690806e059581540b4fbe0124e8d177c2ea4fe245a22d2caf4dad6e9f88b70a1ff902969ed12ae0e2a906bd8eb995fe2b1021e96b9fd357227

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0ad09671964e495688438adf2693341

SHA1
91f86faf84693bc382906c05a92f52b68836fa1e

SHA256
02e5cdc17b40b03fbeecce394179a1178abcc64f4e8c67532aa25a1322869566

SHA512
0b4d12a265673aef493543692c0cc117676324b66ab4ca78c089b3a2b06d62fcc26df12df7b76ad0813dea8b06712511ae17c703baaa2a40499232b8ca00caa8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34bf8481ba42c70b3de23135e4bafdbf

SHA1
5f89407022c137c376e9c4738f47cabdaf74b105

SHA256
573644999166b996eed7401fc1efcd670fafc7517af0cf0e432a6ea8aeade692

SHA512
17a28f8f8fed4b3af5a2f3c720e84262799fa24d0540fdaad96be4b76b7d904922847f5a11bb677201e76c6919f725b4d4c14bc1cacdb670f5229181f63821f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d45ba0ae06fb9ac69b455d5604eb5c9

SHA1
a4a00ea1b61e461ff0fb4ee79b0a3d2396c7cad0

SHA256
1776bdff163193d5f09f31593ec323921c8b051e34cc8d33e3d5e459155b33cf

SHA512
7f9667621377551f0c3e4981831f85a5a26c522376ac34462fc74410d99531ce1c48f3d839e71466e45fadd414f91bee845ae8fe6833c544518b51d1f3d87eca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96ee661b08ce7901f6ef7b9862a61111

SHA1
1f4bae19069ad77a5440878a6cfc2582682109e0

SHA256
1a1bbcec6a1f1d149d3def090025a5c6019704c1abcee9557a20c3e4de9daa32

SHA512
e5ad244a61e1a3b5de1969f3de7ca187382271738ef9fdf38596340d51ac7130a7afbea094f99fc0a5f9b50db7afe38df9aae746bf74b0e7ba6258f37ffe00ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
699cce2e40aad063712e607ccdce0430

SHA1
a159f2f9e85331293d5c0c9d6295919797a3f391

SHA256
8cafc39f78567787b1c75c1371263161f424bfff83234acc5ccf7c6d65d7531f

SHA512
59c27ff3c7623bc4fed73e306bb9a4ec12f04721d74597d79dde2e3688c1bf3e85cccc63a0adc08054e14decaed8eea07e33665542a6aa9e8ffbb7692e664810

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f91a40285aa41643b2318cfdac13985

SHA1
2b827de11597fcc84e5e01fe13ffd78650a68243

SHA256
934d0cbd54758c64cef068a6cdc43087afd49f930e6c6f1b836c5c5878291786

SHA512
786b0314fbc22ab6236eb74cbf02dffbb0ba0bbecb2dd810a260ba00a3c3069c77c73124e9a43a370eaad68b3fd3511939860e5ccc64ebc84a7d783273c35600

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
225a6202789977b00e3fa22930761c1f

SHA1
d01b0c92a134507b5b165455505ff72fe0c95ec1

SHA256
451aad6b60e0dc43d082b8c684a5780a9de9cc62de334122cc86c3bcff1571aa

SHA512
ca0173efc889f7755fbe79e0dbaf49a3e20bdcd7c81ecbe2aa91132fd22049a69845a87857df9e3a5e0ce173d54ef8711c73569844552c875947c82febd05844

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d60b66d2f14abe4af78861b63f5f056

SHA1
80f91ef00800bfe1af8055f4e867c6d2034b9688

SHA256
e01b7695375e23f657aa8e77529c3f306fd2bf18a84d0c922e1b9d857c9f1700

SHA512
8e0f6edceaf81f4d0246b6d06c81987e6539a22c5ca12a86fb89154698b5f5c122bb9bed30e292091a87a76eec262e65b64a199e1e7f3799c20af65c90d87500

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4FF7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar50C5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit