59e4f57626eba5d983e4703dba1db7dd06c2c88d28c60b5a4fb71617674e386e

Analysis

max time kernel
141s
max time network
134s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

84189211e5936dc3c10d99806a5db656_JaffaCakes118.html
Size

73KB
MD5

84189211e5936dc3c10d99806a5db656
SHA1

e1ba74d999ffd8472ae974f36f57f8eb7cbdd45b
SHA256

59e4f57626eba5d983e4703dba1db7dd06c2c88d28c60b5a4fb71617674e386e
SHA512

a8a4c43b2595d13e109557f9cf3086c3eb25b2d48dbb2be46c9e26cdde10ec4b34893386b06585632cf3f3d796057b0f80573c022091f6a3fc08e220e0de05f7
SSDEEP

1536:N0gjEKZrOnZGrdZ8UqfLyC/S7m2/SVrd9y:+g4SrOnk78UMLEm2/SVrK

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b04f5769b9eada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{94CB1EB1-56AC-11EF-BCE0-DECC44E0FF92} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429410345"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000091907f7296c4bbeade5d6bf3f193e417a9c88178ae1422eddd96f90081be24ff000000000e8000000002000020000000371793aea7560b3ba98cc97afc9ebd190569dc0419141bf45fc9adc19161ca2b200000001269a7b962da167509a0c98b18cd4105182c607afed6fa56332bd94f6ab33cc9400000001df5d3d7b262bf3e1d72eb2da99a5d9531671e8c3f960606edcde1118b1ad1eac190c0ed7aa1e32fa1abb3958e047eeccc7e87d689a5f13df677bb5d373bdf0e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000e5f1d1c6c9529f3138b5c750c20ec9c444b99d301da4dcc45588aa31a0270b55000000000e8000000002000020000000a8b1343f167eea825db5d33a10010b75bab8e5cd539acbc00849d9fd2af15a2d900000004f0f22bbc714c61e145690416fff4cf6423cd338fa4e77fdc0ff7405211f4ac6ef1d08fc507451fbf7bb59100283833f58d0c04d99461b87c1d27fad79b5989c52bf2cc07f91aa8bf5bec565c0fe8d50ebb070d6d27b395f0667fe300f538f5d55349dd84ce2e70f954eb9773b6e8bd6931ba635d89d1af391ac5d2ee330329a62f75fd4dd7d3ececa16db13d9ba9f1c40000000faf550c19a1ec536cdcc560b5b20216e91d68ad72b339e13be6b9391c5e1b2b033c0a0ea18a960c469bc2621ed283561a079c7b0d0f3b68f5af1f1bab6aee7a6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2172	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2172	iexplore.exe
2172	iexplore.exe
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2064	2172	iexplore.exe	30
PID 2172 wrote to memory of 2064	2172	iexplore.exe	30
PID 2172 wrote to memory of 2064	2172	iexplore.exe	30
PID 2172 wrote to memory of 2064	2172	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\84189211e5936dc3c10d99806a5db656_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94dd061359f7b0dca1af13843a86e560

SHA1
bd53effbc7ce13597747dbcfcfffb82d7ecaa88f

SHA256
cdddae3d33591eb0f21c36d39f792952d6b202b95f5a2e10eaa5006a7f79254b

SHA512
710d6a2a126f0edebc940bade24d6f4b46cf76b958bacaa68675eece75f0d9852a142a81ec3a85745930cebdcc16db73b40c82de1a3eba3170f4a1a76008ed09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de6abb5f182b5f22da5285ed9ba6f507

SHA1
e3783907f0657a74f918f5f2fe29cfb645bc2d80

SHA256
cb6a2ee61b39d5e641c88985da681b71715b75d57166064e7e578e5ee5428d19

SHA512
ddd3aa4c13cbb53576a88265bdc5dd244c4674dce78179afa6aab2b65ec70c9126d53bc7e6ab6d53ed104cde1495745c17bd0e72edd1457be1c66cc154fd8fa9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0a32571bb3ee53d81f44ca70caaf36f

SHA1
ac4def33b3c56e3b84d9cb29b25cf0c9f6c8f4a8

SHA256
c65ac5990fde143bc91abc88173328258eb2c72dd49a785ba3153c1d27be2f16

SHA512
2d48ddcc40e6319959647374d805ccda9ddc711f90732bdcd43cb72fdd14c101390f4ac4bf40b4c4ba94b19bc1bb062b0d674ae5e1f8a8614e61cf2f864678b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a57dfaa040a59d5d666aba897478e78

SHA1
84a822b16582487049ce317662599bf71e57d106

SHA256
a94c70384fbeab34efe646492007cd107a50eead446cf8a62111b415f860c9d3

SHA512
3d1c3606325924c61dbc2b04a4d94447aef4a447e91185da80d6f7ffbf5f0157385536dccf9a171cc7f964a0eff6125887e2c9311ae567c0885745a2cad6857f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b277af4adf95eeca21bd2cc844c5154

SHA1
f8c3651eea88af43adbaa20347468f5e07607131

SHA256
7e8602a13f2807cd6a1c7dba2f0e01932642b2f186e79f47bb350e3abc9ab74e

SHA512
39ef499af4475136d97696a0959314b6c5bf9c1621b7eda7f9fbd38d5855968d3677888fa96e33cccd7657252a0495c9889bedfd253af9b1374ff536e7fc06b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b03972356894fb606e55e9fc1291d21

SHA1
766f5d9a4a6782ec7884178c4f559344d853e683

SHA256
1fce6c21987c4f53fe1ef75cc83469eee18159eef5f5dab1f614b49a9a83a07b

SHA512
2902c8a24ce01ab8f964ea0116de88e6de7ecf685d42a31a6dbdcc999337c17e1013f3251ece93a877371ce13e93f4659da34d74c8436d17fde10cfe7258e513

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ba7b847a139c4eff407254c3ff9857f

SHA1
0b3de34cea6f56d3edd37bad855d967369176024

SHA256
50e0c24f9fc560a0a37851252aa243c726ebd9b70a6ee5bf0e7b71f0c6f076f5

SHA512
bd9eca30f281ba3487d7bd57705d39bfadb49c7ecb253587ee88a0063e1ba4630c12f085d6fb5aa05f020f502c1e3c024e00cc708ce1f16089aafdd6d20f571e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b76bce01c75d2ffdcb2235220c49779

SHA1
c1830616b42001098cd168f5fb5310eacc326c59

SHA256
69728f544ffd68676806bfefdcd132962e806d81b1fdc318b13a56d8ba523651

SHA512
8bccbb63e86db3752512bf709957232e8a4d87a9405a9427cb384e68ce87cea7f19cda795520549cee102b72bfa62ab0be3e0b7ce640dfb7edb765319fb6a0bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
089d0803ab6d29c7d9224a56dc04a3bb

SHA1
93e431caac32b546d6b05490076eff2fd95ad5cb

SHA256
0d98afe86c4d5af3505533582428893c74c07c436024e059d13370619b83212c

SHA512
541310f3bbd7ea7527a2458f661fb1d1fe822b7f0e7bd4ab9b198d3a01a893392e98a62d1d86d5abc3d32f29885433cf26ddc5e94105615c9ec129bf761d9279

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b211e645297e1f6ae6eba41d87b64ef

SHA1
5611627e177da5f5ea2280311dd507d58a430531

SHA256
9a0f6d8764f806589a08bf4bf3c6364885b2e1cf6cfb752fa2961a84422c6a39

SHA512
e7b83f8868f5696bfe1fe9b7173788fda7cbd68fe7db33fd2eb207d5373f93f9b158a4e221d7ee5f9f3423e9413ff5dfe322e786689ac6a2a1ecc937db609eb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16052d1295c55728624af09d94a11405

SHA1
faf0ad59593410e60ca7ccc2c7aed560f934b1b3

SHA256
66d5a8d3c7e032dd31f6217a99dc0ef2dad945576991c71240fd508216ff571b

SHA512
071838e556b4c0214a43816bd1e1287a918971a11ffc86f51ee2d7345e28963fb49f8e20acfe106b99ca5357a6e8e85b0565ec9831c1af9ac61d3e7d6086bb7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a675e82a93dce65a44a688a0a330a72

SHA1
313ac073db76e2c6e9f98aadee1c9154b0d4269a

SHA256
e7faa0fe5253952b2d125c3e8330d6bdb9a4a36b4f755ce21613912f66d11a63

SHA512
5c4f252384ac22a6f99560528ad526e4a6071026fbf51aaa3a6421bd876ff25813fde2ac61f68fe42b3215333061c2b1a0dcfe37a5997f106cec5925f94bdff9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e29dd06e71c01dba95b9d97d3a79423e

SHA1
5fc88186f535cbe1b8af28fab03fba61fc76ad59

SHA256
e760762f9c7826ce5cc4e0d0d7ba65e558dc7aa851d87b8ac3b69f6319ebd11f

SHA512
f643b4a8a7e6f18ea69fcff50b4849cf9844008566254d3b3a65dd45926d52b67f0ec7e255647b2ad90de397bc3cd4d7013e08b3d1d853f739bd40fc82181c72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2924e94466156b94ac85604c04dfa45e

SHA1
8c3684eb771a29d1bd6b1fbcdd3e13a71c2a0f66

SHA256
d3d060ded54ad4ecfd7f7ba42e6fe08053960d969f1b85deb6846e01a27bf53d

SHA512
7b19ff9ca6d5c87c18e8d30f27710660fd68748241091ba3aaf856ef138a32111e30b5d5ad4fe3794eae31319799c49cdc517c219d95ee7a984b3884683a14f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDEDD.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDF8C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit