43a7eb5057c545d1fb610870bd15aa4fa194aca89d1af07f3c5279a8d9bd72b9

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 03:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

88d0e46ebf2704f88efcb1f28a11c14c_JaffaCakes118.html
Size

7KB
MD5

88d0e46ebf2704f88efcb1f28a11c14c
SHA1

5c5261ad54f96833ccc2da63b054166d19fd885f
SHA256

43a7eb5057c545d1fb610870bd15aa4fa194aca89d1af07f3c5279a8d9bd72b9
SHA512

8c74720e801d31a6b3b0344544152e5d4dd9893ace7261ef1ba44f9cf231b73750eb7353b4af8e59e151d8a86de1e1f0b06542739cb9511cefdf19d493a3408f
SSDEEP

96:uzVs+ux7bILLY1k9o84d12ef7CSTU9zfUY9YOH7y0jFit3cEZ7ru7f:csz7bIAYS/u6iEb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf710000000002000000000010660000000100002000000032e5419ee30b43fced245fb61e2a64c106a731a6db883d29597d5d143d676260000000000e80000000020000200000004527b0d25be886447ffa0a0f5f58555ad106d1013366522ec65d34aaed5485589000000079ca49e5845b7226255a82d7630e517df27e786152b6a179caa58cb0833732a2110726cc092610eb1462bf6ef686a6540b18ef6608d4609419b484b045f22ab6c2c5150b329a3b8910265ca511e4a84b8cb80f0ed4a7e86378aac71299d06836ade361dc6c93935f0606efd39ba34aab31982c9156e70ea2cde63486f6933e3cba32dcdf08752a407f740c7c62dc4dfd4000000003f99a700bbdc4a079fc4909f874eaeae37784528d02deb45538324ce4bb5224770355a207341474246cc079427020e1fb56e9a1f921b76cb504add76f5fdd61	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429508599"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5CEA8311-5791-11EF-A850-F62146527E3B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000000e24a3a3eca6b9615793f4675ec750c2fbddec55178e350c3067b850c92b8826000000000e8000000002000020000000f97f856067724ba8d015cb0051217189cadf5124f061321c6c10267bb09ff49320000000e36e192a5a5bf30f3ff9113e251bbeebee36a9598eed32bf2256440de838f8a94000000046313338f06467ef9868d26918be39be0833e8b7d838efb696b9eb65a26761c58f4adc920158d6b6a8c485d8f80014ce6652a9bf9bf5e4fc2a75be9c7b80fe0a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 806cee319eebda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1016	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1016	iexplore.exe
1016	iexplore.exe
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 2060	1016	iexplore.exe	29
PID 1016 wrote to memory of 2060	1016	iexplore.exe	29
PID 1016 wrote to memory of 2060	1016	iexplore.exe	29
PID 1016 wrote to memory of 2060	1016	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\88d0e46ebf2704f88efcb1f28a11c14c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1016 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
533b5a9e061b1e862f205954a401ef2d

SHA1
5773e0bd7bfd141265ec1563d6fa5e5aa0584756

SHA256
875c0021f2742ff376459040c7b0ea531332f91426f30a37bebfc43f3c01ec64

SHA512
baee72f08f78822c57e787f1573fb5922cd44efb180729335b0078b93679743e0347a723c3eb146351d80c5cf74c7b8bce7ace0d80f7c696455c167e4cea0456

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9afc4bcc6a59766c818775330fd8eea

SHA1
e781b10222525599fea870d7ff1c6b52954005a2

SHA256
ae10c9133d0fcd5b0c5e9cf0cf0c5962dd701c3000cc807529956e997abeb476

SHA512
bddf9249294d9e367a362bf717f9a14f9d1b11289f04570e109f9ab2b7a1cb6654a9d77bd8aed16e5e6268ca3de6e3209bbc32d0369e3143b9c74b8d966e9948

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce176d5c99f58948c648b8188cf6ccfa

SHA1
8d8615eec71583187a79784fd9c40af19cd5d0ba

SHA256
d7bb9bb58bc8c0a9ff4833aa0a39689ac96975126465da1967c3e5f3a3ded212

SHA512
d35d6bbc4289dd0765f8b05e56e6382692dd8499dc6c89680939ddc11da3d4321a2d5ac5316ec2398c657f1e9b338c635db9710621df3f9e7cd9f6602b59f0d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ef770f3c1e03ab847db8160fd9435e9

SHA1
2a3f94ae81fd43bf6e427c5c41e88d5a1bd823fb

SHA256
38a3bf4b2e0e776a98a02a07f1b02c5905e97c7b8b819de5758ed056ca449d31

SHA512
d3a1508f351b95c9868cbab0cab0fcaf5d4aa4a98fa1383df050d92f4eba2cd087eb46344262cc25b2be6e6fc864a8ebc98d89ba65a76d3739e7289c71a01503

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc8c44d2993b708d6efac906e409f0b6

SHA1
473016843ebcd08bf4bb362d76c4bdfbd896be3f

SHA256
ea0cbe3bacfc5f540721382e540a2e8429665fc4a2dd5252e2cb8ed0ab0b9bfb

SHA512
46dfeb147cb8090a804d1c86f62af30e2259fb5859edede85ce7ce97a8bfa5c3268753bfb5fc92bcf31afe1751f735ffbd9594493496722d20bf452b52d7061b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa39e992968ebe86e43a418c55883866

SHA1
84e6c7772b268d6e84953a58c9764ef8e9d043d7

SHA256
4447a0e91030431609fde046e437e5845e066d2be880e5f46ab4b1b872e711c7

SHA512
0b40d9abb337672a95003f83204e75c4432682a2d12f87e6f7a27fd8518fef180520e459d65b098e0e9090a297d840b7c9e987246ce0db8c70c6d591269ef363

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e0e8f9624041fd5df72ffdda2c5f6f5

SHA1
0a03b45888388b38a854b8eb0411ddfc2dd8aff9

SHA256
4bda0ad7bcd2307c0be6732c7d5d6322f3fb98bfaa245f15c014099def59a530

SHA512
d5a8ea417569a5993dd58fd949bc004a70e1340d5a686bbdfffad7ca8193295a78211db80097c4e0584ba61b75a9ac967f9076995e8a0ec39166f4bffccd4620

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa6b99452484ae7a6a96e4dad9253df7

SHA1
e9d77958a9be3083cd8e1b4bba749941b2081b86

SHA256
b47b022c6900b1486090f2be7665a46caac17fd5eee7c96e2b717c7846d735bb

SHA512
e3d78f2b2dc6dba99a4ca3aecc632486666f224a16b9cd7b69fb68f039bb8195e79171fdf54011a76cebe16b2e25bce5f73903ba06a6aef5895824dced4c4fc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9e2a464ff2b05315e8de85d48925562

SHA1
20c2cede1fda3b371a375017ec46dda7932bdad8

SHA256
669393ff2387c09b8bc84888ca9cea891c8a75688f36e5cb1c529a34d6be2c34

SHA512
7ea7c7008eeac9a0e745b9badce03952c3e6a3afc3d1dcb0f424f223f983e4fa2a0f8933187d91582d18341493e19dbc26a2db0f911bec776284f44d02b95e75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe038869e7cc0b527f072498ae6e2a89

SHA1
01edaf4f13a2ae1477aa2c581bc233073edcdc3d

SHA256
1e874181ec503c11b46d8cc705dc26568cd31145e4201543233dfcaca5287fa9

SHA512
f1c626a9df5231ad5fc3c8fdd8d96b664818d712ce1852b0720f75dc0364a91687fed52b7a93ee0ee8972361782564924fd494e561572744d7b8dda60a9d7031

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50748638776adf312812af0133e74dd0

SHA1
2da765be0aee434cbf706ceee5936d51b1412492

SHA256
a9f6fb2804073140dedc477dc92416bc45c2684b6c087b3a9fbb70ecbb6d0b58

SHA512
c83da80322c0efe4e563e15c4535724a55ed41a669d5df9e66404e6f909cb6d1906b8aceb6aabf848872dce111ead9bc1c7c7d93912627c4fa249b44aa631cfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3774785b3d2dfa73d428d6e29b282bf0

SHA1
e909b68744f0d76ba45269c019769fe272262e96

SHA256
9635adfd1dfbb1d70be8a91d9ce3f1737f08754d44e2924582a95361f0ef1f8b

SHA512
6dda405a01201f058ece5d33aafcd428b92efae8cc5ba91761238f3895f52f3ee18f618c2c45b7be42a40585f5ba050939b8589551615477f560cbcfd918f251

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
518591083bc77f245cafd16496e9b688

SHA1
8e4374a669833daeb1b74f9320485e3b30414e4d

SHA256
498fd1d15ff4738f5acd2688a7adc74c0540d4b6d0ce9f89f5b6c3345f52ef6f

SHA512
ba831c3bbc1ee8830567684eda732f565b581aa8cd3811c4eb720796e5144bc7ebb7b5805da17baba05c27640f4f81d6362de56161fd9f31069c03ffca8a171a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2BE3.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2C83.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit