1a718992f84ed8505b33c22195f1b00aedd53b423fc2ce6b8f2493a661d52e8a

Analysis

max time kernel
67s
max time network
148s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 19:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

976b6d1052bd30cfeb1893caad40e5dd_JaffaCakes118.html
Size

11KB
MD5

976b6d1052bd30cfeb1893caad40e5dd
SHA1

8f70aea2216ddd0bb8249753735f17b8559822b3
SHA256

1a718992f84ed8505b33c22195f1b00aedd53b423fc2ce6b8f2493a661d52e8a
SHA512

e2791e6552931cb4606ef94120cd823a4d6af8a7b999a908093d503ba10c3ad1c21076dcdce6cc5305afa6ac184918d385b82ce146b521e3bad5d749077520a2
SSDEEP

96:uzVs+ux7wWLLY1k9o84d12ef7CSTUyj3OlpKIoB9bRcEZ7ru7f:csz7wWAYS/GQzb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8E088051-5A75-11EF-A817-DAEE53C76889} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000682690ac5bf39f9fa0a690b0585983c9b7a1292cf67034eb752beb8befea6c36000000000e800000000200002000000061cc29af14b17a4e1ec0afabcf65ca0fe72546c0f507f801acb6a1b3246d22362000000030fb91a39831c804f83fbd1c17b91224412b7c35b4aa381b6ff70555aae8111c4000000087579b95d2c59bf56b2b97b14ceb09ddb5bd18f37771b3b9fae0b82420276eb294e9a8fef8c0bfd545a1d2919f0309f221de21d90433af92a483b5c1a0478d49	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000c549d126d41bceaf2727347b3cb6d005b07f5aaa45d1e99813a791eca99d01c6000000000e8000000002000020000000f4bd73ab04ede3a66e3ca279fbfa4b6a1c2d43464d9c54adc4e535f61a5b26189000000035ad83064ebec86e53fa2b9fad9c20584a0147cc1ec7243228cc7604a43f3be5a0d80f0f8c6d557db9337b2199f9c946d25bbf039456dfb9b0cf9b3789e529efe9d01cf5832a528503e6ca27dbb4d4f69f8234409b59a500c870242b90dca776c023936c9e71e23ebd43d1b0600ffb4c4bd9ad905a1367861d6dc527d6ac88e1b55c8e4dc3c51733b5eca69894d1a613400000009e21115e512e6d9619626a5bddcb83be55cf8477af0582f34d4c22d71efbba2f15633f63d4a395d3a4305e09c6ccd00e5a878eb6ccb7ba95a5ff6eef964299da	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429826509"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60c7e16782eeda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1736	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1736	iexplore.exe
1736	iexplore.exe
836	IEXPLORE.EXE
836	IEXPLORE.EXE
836	IEXPLORE.EXE
836	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 836	1736	iexplore.exe	29
PID 1736 wrote to memory of 836	1736	iexplore.exe	29
PID 1736 wrote to memory of 836	1736	iexplore.exe	29
PID 1736 wrote to memory of 836	1736	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\976b6d1052bd30cfeb1893caad40e5dd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1736 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c8e8a594924d5b2ebeea668debcd8f0

SHA1
d15f35541b36569346b348bb1106b4b085922bd3

SHA256
3a385696b56359a6406051893ccac96b29c8cf3931fdd841b0c852f3e47239f2

SHA512
973768d901ad1dbe52ca2130115b6303cd1fcb32a4833c5096d3ae1ddc775c0de7ca2cd25b9034233549c46e57610ff20f5d8c6382ab8a1fb197732a7fed1940

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de8e66886ab14ea935c091f0c028023c

SHA1
f4967d3089c6f4cbc0805bfea89b3424aa7357cf

SHA256
b39ada366c895c0f32ba49d55e50973be958f6ed64e3b144786412b70300d633

SHA512
89588dbb0b39777494515c89645bf1cf94b59dc6c7cf9565da9fca6fa86429926f2ae6e00d4f898f689692e8c8760b9b6767eeadf2997594ff9caeecc434929d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78caf25a78b15818962ca37626e66abf

SHA1
7aa0142b713aa44d29338cd77cba2d33474c1707

SHA256
9f2d6f1eed9c97e4c03bdf15c63309c6929dd689d648ed694d1f7639b94fdac1

SHA512
9dece7e73802d5141161431df6291532d198c843fca1681436de5a40eeae2b890132151fa5db464246d545df534bd6f80b724c0bb9754ce5df957a8bd949d936

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a3df4d25600b201354ee549a2c2e022

SHA1
09c76231a9c9c94e63f07e8df35c2eb75f4abce1

SHA256
70d32a59818e1ec72dc36d00257246e61ec5e0f9d2780deeaf8953c0cc11fef9

SHA512
44396412de4206e1f69c1ffe84cd68fe824a03633c13dc9fb197ad50a441cff2bc20f00bad581d13db366fe0a5fd813d6ea810ab4a2a149835f4db5d60420550

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d27f011ffd6e54c23932e2c39730b16

SHA1
927489ff10e97b80c7f58f79d04d98d662449f67

SHA256
b64cd8e65ba7f8b82f94558bf43a4e2ab52e10ab76b79f2c3aa4181a84ffa574

SHA512
3053d1eb1df806e299ce6ad31c8d9e2733ff7c98460dcad06e89a7d6d9c09b0da6cc46bf97b231aebee2ce18676d9b4c6789fbd3bb58f0055c77be5972a8fa57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf064598b528a254afa66b324bf8fa1e

SHA1
804ae9962bb6eaf99b45be66bc7055419a9eefd3

SHA256
7a6464ac19221d6b22bf28e6fd0d0d9153b12c37082b2390099e9e72820d2647

SHA512
1e8ad6a197ac5b353124554735e996aa32357baf1999bef22ddb7f26371749fec9b2cf6fdd51fb669d7a5ee8bc971a8b071344aac77154cdd77135118e8bdde3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
622e9c6300d114d70abf8bcc597a6400

SHA1
5c1ba18c150e9a20e1a52908a3c7b521ba2f2a63

SHA256
885a5986460dd5f0081122510b48775f54620607e117fdd13fb6f9f464c1ced8

SHA512
f74fa2d69ceae6933b7f570828942d4a296bf62d3277b4af4e34619390079ac0b048969a58fae8e364b206498b7d23f18d2c89b64a352352ef88d8997a01e7ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30babcfaf4c1ec2a4733fb6818ffe147

SHA1
7bc4db9a4f551f27b10c552cc5bd4e5baf949bec

SHA256
3f4cd47e53c9394a7fbe7a8d2944d4bebb1fa8c1fb3f0bc173f0aacd1bee1236

SHA512
1c1ad946f334bdfb2ac49fe9602fb27d83181b709c550575b3981e4f5be42d4297740a6ee294e2ca2421816123244b6fbb09418d3c77c2b197c015c8effb1925

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18076e4e44f7a3bc65814d3cab0eee72

SHA1
3f6d8a633c232e2756ee0f70a9df0dbceb9a7dda

SHA256
8b6851f5842516609ae86ad383ce1dc1caa85d541785323e29e2a93bd44df0a9

SHA512
b64732e1d09b2577acfc69c1a4441cba94fa780250d003ec7d38516da936e625b78ae9aae8472e8802401db1311443a3f847748bd845e26f837974a71f5dc661

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de0d435c408e7255f71a806b58a2775d

SHA1
af801c7d8ff7bd120b24588c98b9044f2f67a049

SHA256
a6e85d7cae8f2339a940db64907823096455e0f5f131f23e41cdff266df906f5

SHA512
8f2f1acf4ea136780b212eae90ffcd9f2288aff768229c8c7153be3ba0e5ad995626a3757426c0a036f751dda6aef9a7a7e46e2c78881c7bab05f886a6bfefad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d7a16dcf91038d8d53fee7d4e439c18

SHA1
d3f1d08f93731cba0e4b86ad8a1bc734d61383f8

SHA256
30225966ac0dadff54a4007f109495dea69b1cd9731466fa4baabffd5db1d312

SHA512
c0e60e016636b47076eea73d3cdd6191cfcea547276ade40ac2f0137e244f7ed2a7df69f7b4c4b5afea0fab2511cd8e31a2b3a2fdbe9fbf9c9e2e05e9ccd3759

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52b1c4a12d1921a3a12e1508705f5548

SHA1
10e6bcdbf786bca5148a8d9eca49c883b071cc91

SHA256
86193bb1a71f9721925820cd55e4fcb3f3766f4758b68156f3c1948a601cb2c4

SHA512
bcc1e5841a52a2cafbc9cf1675f5809fbf22ebbc51a5c58a7ee2a422a0db21132575caec7f7a7f7ce5ab38209a845230a0fe83c6c0a4fea8bec8a8760f49c2d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8818e5a654f1fab1d860375c8960d571

SHA1
7ac3f82d826addf7853b8fc5d5a74f6a7184df57

SHA256
67bffeec998fdf1613da504958e6190570648993a193155424989775398d8963

SHA512
1511b4751a765025331561b11f9a26f05fc44bfc17da3bad93836ae4d88e7cfda718b956e065cce4d5dfdb635da0dab55a4a58ab112fc1a00b05cf99057ab112

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC871.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC94E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit