369e317861f407371231dec479db38186c865606a9a06836415a1496ca2059fb

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
28-08-2024 20:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c793b90c3c5c785f7a38c8c0255f9c3d_JaffaCakes118.html
Size

16KB
MD5

c793b90c3c5c785f7a38c8c0255f9c3d
SHA1

956666ce127787ea9d88ec58aba38078a8da3baf
SHA256

369e317861f407371231dec479db38186c865606a9a06836415a1496ca2059fb
SHA512

fad63910b3c473bf15176f1fdaadce48c7a755baaf55c5bd0a85530c435731051da51816a73fc88b052f4fc4adf308aa0385b981bb24ce23377d8a3b9372c02d
SSDEEP

384:FalPrmyjZSERzuNd4K3nxrJjsVL4ouN8tC:aqAxvSxtjlZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B1AC0941-657A-11EF-832C-4625F4E6DDF6} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd0000000002000000000010660000000100002000000081c9a623c0529cf2b8c16bd03565f18d3bc0b237b9db76a1c134ff4765fb6c03000000000e80000000020000200000001414763bc2a7a31036ddec63b83328da7da2bb323f75d5a7e241a242000db60b200000003900635ef625d643a55d887bd83216fbec4e678b5dd8add709d22b9c034e784240000000a2d5e0d3287ab9d8abf3db238b2cf5496f38d95804da59207601939b3ddd1fe36e02c40a4b2068fbef9a06edabe3dfe1bd43e93de33b9daf77b00b0441c63416	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431038179"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000cb60cd83bf15cdb3f5b7e3714db8935ca2fc3dedd6c1764301005ecd45694ff1000000000e8000000002000020000000406a2313b240840039b54ce98c3cd72c695fc89b13e5d13cd5e32110457a002d900000001866649aea6b84c53197cf23d59bd5d0ac3d93aa7add6818be22cfb647a3bf28cfe797cbaf5bbb3e5c4033653037187bdf9181bfdd3e0ef2e0917ac53d08b8706016d232587449d0dcf6e16a83804b6d3b69dd1b391530e577647e44d40027830c64fa32c98a77c6a4b789204f62145c9446aacaa15f215ea5b94b08cca7b6b2e3803aab118f505b02f36b0133fa5c1f4000000001aec675a73ea197773184889f9ae0cc91c28bbb7196fea6d88ac6e8d6b0adfbfbbad9d8a8c64c3f1d164dd8c979ff45b0065f5a5ef84621bb12dca6189bceb1	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0f4957a87f9da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1484	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1484	iexplore.exe
1484	iexplore.exe
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 3020	1484	iexplore.exe	30
PID 1484 wrote to memory of 3020	1484	iexplore.exe	30
PID 1484 wrote to memory of 3020	1484	iexplore.exe	30
PID 1484 wrote to memory of 3020	1484	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c793b90c3c5c785f7a38c8c0255f9c3d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1484 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14d5df4e4cae83d3139176810ba84e21

SHA1
a0ef3afac59a12150da69b3d9468958ca3452a8b

SHA256
6687dcab4ce9603ec2eabb6b8e1b1f449cc4f09b9cd4b10009ee915f4e6df8e2

SHA512
732a91640f2a827cdd01029ab7e92d1da6be7b51522105aeed78c7b331b1db014fa801e90ae7ccdf6fd40b6b6dd281a848f819fe6f8b2f8187c91df4103d8ad8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
361ad9c755a5c34ba298283541d3bb58

SHA1
443d643794b29014b3800b3340fda70579051c06

SHA256
1e6aba40f01353454de4f29166782c7a3ba7d19d74c4eff790f6e2092384e28a

SHA512
f8b10d75325b8508fe21c90c8e92fbf282a3081bca093547696e211306641c64ec1029dcbda3c9c16022bdb46cedf1a74723ca02c5184e5afc8d14558d352d97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aae5e2a9a07bb0d1ec7aa47601779e52

SHA1
0c7881ba5a78226cf6140c33b53e36384cbeca77

SHA256
d3f879f2aa90080632427d8326c3e1485f95a634f6aa232733a8cb750ebcfdcf

SHA512
bde8cd64d3f61f4de6f60210f1678cfc6ebdc7aa023b4edcbd8c9d755e39e599c99867960a93b93d43e456a940b7d966136f447a512d25c3281d1427850f8f2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d40018c9d2866434126ab5937cd396e

SHA1
86b3b3d226d5e3b7d49627daa1fbf55dfaa99259

SHA256
c5cb1aad0c8eefae8646f15589b79dc3d831edae48f75df51c4b51803e530c3b

SHA512
03532cf3ca1cb15695b72ed86cb03a0f24823b9d8e99efc8662b98615edc343b92cb3ccb826023960abdb55221c7b82dc36693ab25db4bf62e3efc1798b7b0e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7d79080c73dbda8244ff70378e32dd5

SHA1
f0fabd79e7514909e9fc6251352b8729e213acc9

SHA256
95a5f731a4335ce880c9215637467f9c222a07e65ee419e70dcd015695b72292

SHA512
a912ab0053a0b0933face6225a7994bf09b1b6a0134d32126d840b48be674b87fea48faacc5f125b4698621e3728f05ee8d0cfb04909508d11e5cc389c8400f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86767233fc6137f2c6919db7f608da1e

SHA1
e97e0bdebe7c8ec284167626bab7cfc12df1b840

SHA256
c5816d91616ae6c1b2ff9e1d50f62537683abc49153c2c2ce47c4757d13ea57b

SHA512
1239550e6101ce6caffa63ca475e4374170bb2b9d422a80c81db659b10a432a0c5fc43fae00b186c1fcafd533a0948f95e2c7a5f7b8e67a7ad740d29252fb815

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe4ec4669a0a9d2898bf04b9b99fd834

SHA1
5b98bb415d455b1d685eb2e874e5d301cca672ab

SHA256
e2b43b0b5b0020c9e31841a62a4eea95010ed5c0c9d37350314a217a3d501b19

SHA512
1b20d98083060a63fd03ca473176cbc1b3b6bcceb2a5ced93df6dd09409b52ae3cf803c1ec5934d3ba72594630986ca63c40e7b57edea20269998d2601d9d15d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c690c019ac96bfee33bf4abcba70d1bd

SHA1
408db5000da6835fa1299bbc1ad46044a36b6e3c

SHA256
9d8cc1238b893dbd0801914ca93f93c169c815d00cb325987d903ae7ffa4b923

SHA512
91cded72aecf99620853db035853f13dd788da208b88dcaf50644174017ed88b5b03fa710090c4bc590b14b4eea68aa010a51a2aaf0afa418e75b8c8e21cecf2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2eac12a7c3eb32b5375a918c0bf9e8c9

SHA1
065fe432ff4508dd517cfbd143d20ccaeaf30d0d

SHA256
9741436f0b5565a4a9b4a051772ec626f4def9fefe390afa06038e71284e4805

SHA512
93701d053994a9e9ff0a4f62f523352f95dcebe0b5e65bc9159ebb31c8297b9ed1717bda7291449203b97df40f092050f02b8fe269dd96769189b47fa4e39b81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76b7f16f9f3acbdf8c4ddab4fdb99950

SHA1
b3b09503af38f808409a597b93f16c02e8213935

SHA256
d1b55e70332a9cc63f4c5a2787cf5413e810458e4041c4a7e1de7a275585399d

SHA512
5c71f7a237ba213fe844f2635ce2600f5dfde7152278a4095a95ba45e099edf1954ce551a9316251a574868059969f1aaedaff7b043715d61c9edbc9ee1eba2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82e983c45319ca09ba36b0f420e5f948

SHA1
ddbd29928188b66f565247f76cd19d19f2c6246d

SHA256
94337c728936397b0b7ee8c243e2004f5388cf15069d2ab9c97d728b2fca70da

SHA512
df43ae57c9d6ed8389f13d2534e0143dead9fad7955e84b94f42e22b5cc7a5fc776e9c13db5e83a721e7de095f3fb0c9625cabc6754bace59884f04611de7050

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
067e3b9a90e0ca31ad2d347ef31972ce

SHA1
888e75cb7006ab3c20101b36a7097caf42a129ec

SHA256
891ac992bacc4169831289806cbccea1f218e4b6a5f17b7878da3304dcb89967

SHA512
b580dc0dc67dde6f54494b9b46498a7d43f809481b01fafae6b8f80da7a6c3efa9f3950e6ee01ff1ee084075999d49e7fda2da35f764885f2cf31355ef35c074

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1be024a3cc539999c59cca221f16b381

SHA1
9fc8147e35365942735deac49f3421d3bc7010e7

SHA256
07d680013a4c11b851fe6289a6ca54ccf3119a3a50e61f44fa721eea45f3c21f

SHA512
0a53fccf5857012f0ea7606e5412a5f139c15b55c257c1eb81289e8be99c0c2bb64d22e64205b91a7fc5c662f25075737f47bdc720d229037a525e6509be851d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84c0d395982a0806737b699fbe0d74cd

SHA1
340cf4e839f01662ca58da58c13ae01fc5ff198d

SHA256
457f2b720398512eeb69d60977b30457f082246f4a2c5622ccb528074b72bab3

SHA512
f0d91647e2f84247f6fba9609dd759b5c624ac548e7eebf88492d7180054b5b2f29049d69ede175068435a303d1b7205c178f80c329e6e52617ba1ef51c7d67d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f07917a080d6fdaed1f9ed917a45ffb

SHA1
e7a2f6da0cc120b6ccb286ad65bd8128a439e2fb

SHA256
a3469bceb3cd0ac09ef68e059836120fcdf0582945659db1755cef270ab87ead

SHA512
ff78ba86f5fdeec4d8d8cf5055e62c8467f13d28a8fe7af569524d502d51b567d8668b7b6111917adc2539683697a300a1b3f386a5aca6b4d1916bff273aa2f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC303.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC325.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit