6be0297c2e5555cb1abcfd0c61a43921016c69af593a9a3fc2eb9e1792d7a418

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11-08-2024 01:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

888dd1be51d6da98a0b2b8a26df79e0d_JaffaCakes118.html
Size

6KB
MD5

888dd1be51d6da98a0b2b8a26df79e0d
SHA1

2a4c4c8b1acd2990fea40b3be32d2eba6f6a6531
SHA256

6be0297c2e5555cb1abcfd0c61a43921016c69af593a9a3fc2eb9e1792d7a418
SHA512

f63bbedb48744aa467a06a110fba4507630bd615f77a1616945fb46baeddf90d21d00a7c1e7b0dc65cae37d62a1211eb484b076a60e05fded933756a7f7dafbd
SSDEEP

96:uzVs+ux7HofLLY1k9o84d12ef7CSTU/5/6/NcEZ7ru7f:csz7HAAYS/u4Nb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4350B3E1-5785-11EF-96B0-E6BAD4272658} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50b2703292ebda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000a2121f58792d416a673e1a7312857cd1ebe208fc422155fd7559825de32d4427000000000e8000000002000020000000c5fc62644ca26f7553e0f9aeaf9c5a2646ae1f760f7b5a0cbe8eed444c3e97e4900000003e3aa457c442571dd376337e2c5859359d8950c713606a97f4e399da59d81dbd901d7a839dc9e073b314da57111a483de4ef07c4fc989d3de9f10e5d0c54c0c481755e2ac98d866a1fb676a5edeedabbd9f25e6e0a0b69664ba470be324689d077a7cd7e0a5296d80656907ca4126e0d7136943bf092654738b02485246d10a040e0fd7afb40bc8862f5893274e6c40340000000b6229e89b24f5109f9a56b70a6083eab8aa398969792189bdaee4d4df03b4c9fe2c8eb5365ace5d57c3e5e9f766f14cdf1d33c7559feaea2fa96b8c79e9eb822	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429503402"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000e8b73137aa6171c01c84313591845416ba3aaede343db64bfb95c91a74b7d10a000000000e800000000200002000000082f45b52e018fe44d21ed0850a092c7a09e8c39013c1d3ab2a915f66d2616b5420000000d44499aa34a1a796606b39d9d86320de1bd4e69c95314ac65e882739db328942400000002677828966d6751283f47686597c30f43d375a59a180d720ea4f45a9ded6c7e318ffd2d8f1e0e5d0ce3f4effe4b82df97523ab282f9a4f9fae7145f94c6cdee3	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1976	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1976	iexplore.exe
1976	iexplore.exe
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 3048	1976	iexplore.exe	30
PID 1976 wrote to memory of 3048	1976	iexplore.exe	30
PID 1976 wrote to memory of 3048	1976	iexplore.exe	30
PID 1976 wrote to memory of 3048	1976	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\888dd1be51d6da98a0b2b8a26df79e0d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c625f9403695bd6919a4eb0411515152

SHA1
b8c9a30c81b00f3a7f7f430597cd4a1d5938ad0e

SHA256
73993679bb0b24e2505829ce71cc80c19981223fd8482e87691a5c3ed6fc7a5a

SHA512
0840d00b19c4e60148b4adc309dd43199bd058209a08ec0c1cba3e429645f23f64ce2cc58878b34b9711134e3d70eb72c78318832c008a5268dd4f6999f662b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0fdb3d0522eda83494bae253cd4f8139

SHA1
8c8bc7c2371fdf2f94acdf08758e2bac1eef1012

SHA256
4f5827c20afdfaaf43502f1cd5ca1adfe11e90450cf3929de5a648d59cae7a75

SHA512
a56f99207910e8155fdc94ae0219c2fa0493e7d2d0122d572a65729e0e274a242275a1cade2cbcd2a1a1c10aa1ac079f09895d197f8554e29224b85d8cb32166

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7ec32632d5a22f9b28a8258eaa358ad

SHA1
da48107f009612ebd66bd9165d6a21b8e19fd68b

SHA256
f4ac561aa72d0b06a667d4c2261cdd4d00abef05818642f5fdcd3243145ed0ef

SHA512
16f6e9b2b4238a180d4fd0db9970891961c3873239cfa1b91241175891d488b7588bf10e754e37db46391db125fb3175edd85359bfbe71f68d5cdd3b4bf64918

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0d256841d29dabc3adf833b7c49bc9f

SHA1
96ecc0dc7f4d524b7c051aa97974e09f0d814d7a

SHA256
e95d9e4efe6f6a53755b4a6b7bc243250ec878e21b9a10bdadc40fc9c2038bfc

SHA512
8654733ed672f3a67deb84fcf675d48cb1fd48b4c5e80014a97b82d969466d8e336672368ac276bea9605bc4c44f9faae7f9dd4537d49ead7ae964d6b3b90cc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87af4bed20f34ff9ec60889e9b7f6ba2

SHA1
ced2c72e4642450fb1bf1e8b9fb4d1ac45389b8f

SHA256
53c6198552908635f9921ad9de88544e37ed890345b6fd8ee772ac51bbedd504

SHA512
807568e842adc2ae487374c25f5af0dd9e45f920d513f3b0f495c41219521551dbaf4f121c50ab675c2f0a93441abf99273d91260c97d09c6ed32c6bcbd62b1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3992d19488ab769c3378739a4bdcc99b

SHA1
8e46a7f011ab8bc687059f5bb618315db4880076

SHA256
944ed89cb637e65c5af92742c7e5dfe9b873b685bc53fff888f38be4e91b0f7c

SHA512
d1f742e21b94623f747f1128bfdcc5e3978eb4d8cf6e0547a72d8ee7cabe96c3bf774e6764efbf022cec3ca4f8a03ec6343b92bbc59fe8527d7d5f163d50ffe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1919f46149aa4e5404ec267b05af4a57

SHA1
898aa3c2f54e3a8941683936f276186d3912e804

SHA256
6233bd8ead3e23e7f119ff2a8a1d919625e9d9690cfd789439bb322af441c251

SHA512
e5685c9518dec2b25fde84ad06b8069c291db55a1679c73fc81b6b94737b32989f18e7e0a61ebd9bf54b3738c4b9fae6e147d93ceaa6ae76e5016bb34f895c9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
089b7c0036fcad216fcc6ef439ad86ee

SHA1
af8cb3721313410031088dabbbfc272a058a64fe

SHA256
694558d84501da0dfab41a38a415c452579192eb242618689df84097c88d0205

SHA512
d12579cf5104cc0fde0c9583b09eae4939dc23e1cb0e7d3b8a0a516af16f093136648997b19cc0ac71dbee7ed871b5de3bbeaa85fd1bf8bd660bfac5c0b04cb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4875028e5265eb7ad93bc72cb0f2d693

SHA1
2a74e1655b94c9cdb2700b256621fa42fa3a8b48

SHA256
485925dc57d55d70505244d486d1e9bca8fa8e6f8e1bca6400eb5597053c1468

SHA512
1529e24a45c55b6b3baaa98a915eceb433a8d697873152205d6034bd3cdeebbff6db4828060a16a244377fc5cff75faa3a4bc18dbfca893a02e6753c7423ae10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a04a91d0bf791f9f07c26689d8169abb

SHA1
e91deaf0ce681b4b447d94f9dbc528bec9aae38a

SHA256
97c093560ff1cf012893adcb6a81002ee3931d0baae4906f3a887cb860e11a2a

SHA512
68bb5c3c8df38de28bc1fb03531af33d10e53384cd11e4eee4b7233ebf7a870f9d87ef02ab1415c74d16a1ee949cf2010a27f30300286b00a0a86f1c9cc43a71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1212ddf3ff6697ac69693f472caa6b08

SHA1
ffe08585d03dc6869c4682b88033989d9056e7b2

SHA256
74fbdfd3fd12e0ddac2980adc12c712700ac6594d4a4855e390cc8beb35dc66e

SHA512
b3ae66a16168db113a37b5f05c9c7aaf74a86f42b41903f6bad51daf84359f39ebe11adb47add6e0c332ad2005c7fb501123d512aa49a4c5cce428058a1819fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7d68336b9b8482b0d7a3c98b7c037ff

SHA1
7cfd8b0888fcff60fc3f684630196d0f965ab55a

SHA256
70cdc0a182d395fab7d9250aa9611813e7a77be366ce3887705a1ff959e09a2e

SHA512
274bf04853a7bdd125b7fd08d540d46522a59995aa04f17f435479b7e5a4482f8754e23eaae920db840b5520b72eedd54f76d7de83d0aa7fe300b1b85a114ce3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbee8a09f5d4d7c47900ed58ff9bf870

SHA1
07ea259457d1e8c54f028a399d3cd8d20ea1ac17

SHA256
5835eb7e0b5a69ef404d1e283617fc90f710b91155338f6d37ef00f2b31c8275

SHA512
9f79cfc15733de34cb0819311513e85c36c0207c96a41cf802b4af6e5e31a1301fd2ead3fa5845897316ee79352c87f84d90ef6934913059e9ebe57b661d3b29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c0a047af44f6a1ab6ed8ad79861c3ca

SHA1
b92709b48da0e91b5174d2659d84ff6f77cfd37b

SHA256
a271c27708dd73dc5dd2a21f6a1e4fb66b5be12d1f5515085c1b4ea5be07a7bb

SHA512
b81c902cdf40c74ec9cdc04204d3900188142f18dee4e4bc77df2bff6809acb7bd5e74601f7e5e5ee629cea98cac7901947f8fa927b8d1f72984af57ac17c051

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab90AE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar910F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit