d7a491b6e24024f11d3bc8741c6248a3cddb216a0f0fbf0f16d0f6f21f15c0e2

Analysis

max time kernel
138s
max time network
136s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d696b7e36018053c75aec9bdb37697d0_JaffaCakes118.html
Size

57KB
MD5

d696b7e36018053c75aec9bdb37697d0
SHA1

5585d550f1c4f7df48e39e5078b307cafe4dd851
SHA256

d7a491b6e24024f11d3bc8741c6248a3cddb216a0f0fbf0f16d0f6f21f15c0e2
SHA512

db950b8f5aafc2aa315e58e13db1fd5c01d1b933a0288f393950ba9d562deda47fbfa709504af998ca70fa67cf2a7067cbdd619aedfdcc27c40f4fc86a9f5f9f
SSDEEP

1536:ijEQvK8OPHdsgjo2vgyHJv0owbd6zKD6CDK2RVrohlmwpDK2RVy:ijnOPHdsD2vgyHJutDK2RVroh0wpDK2m

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d907000000000200000000001066000000010000200000000d98d152e62aea9ddb6744cb98dfaf21d65bb1e79444ccf040de0da0e55c0e9a000000000e80000000020000200000004f01786baacf7a1d2d6e35ac34565e66623b14a7c4041446691160b4a634908320000000a88fe8b89b5ae9de828e507648dde23df7793d6fee10e990cc9425fc80a8565c40000000cd225afa6b4624f901f110ec550ad78f859f4aae403323a89e10d6a78d563c6775e5f6836df043c4d951f49c7ad2f02422e192a3729e4c9e0d88fea1352d6d5b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000dddac5803dc317ebd19b5a93c6dcd9f4476b5aadbc04bf240ae1b4bc110a73a0000000000e800000000200002000000039a7a5fce112ed2ae1753e80f4c4cae03a05b20ce8a80ae541259c29191eac149000000023c8a1203bd8f332fb5ab58be6d15d4d539c508075cf112534be398ebb33899d09de4f8c5feea5f6b1e472086e984a8deb866fa76302a134402027e5687ba7c241181ce9d9b3236c24aee7be678692cc33eedd2343e22597577e3bee88505e865848504cb80212cc39cb27ecdcc2c152b3f8a57a3fdf84c66088a7b75e2d3caab06470a868a9fc3b52728dfebf0cf28240000000c6821fa4196ff9f395732cc1617376a90729680c1d34128c63ac621b8d1c38887598ffaaa3240544fbf80eed8775dfb7cab55fd120b417250211733cf38a8eea	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432057253"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5C09ED11-6EBF-11EF-AA9E-527E38F5B48B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a00f6143cc02db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2332	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2332	iexplore.exe
2332	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2748	2332	iexplore.exe	30
PID 2332 wrote to memory of 2748	2332	iexplore.exe	30
PID 2332 wrote to memory of 2748	2332	iexplore.exe	30
PID 2332 wrote to memory of 2748	2332	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d696b7e36018053c75aec9bdb37697d0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2332 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
71f62dfd10291bcef8b11c052de0b6b4

SHA1
f07c77282906ff49cccd9ccbff88646546cc6ccc

SHA256
f490bd622b7a0cf94d3dc0b3396501fee2b2e607c4f2360d8de244663ccd7a2c

SHA512
61116f19488050fa915f574950dd6d57dd901323f832111ada61ce0dfba7ba300990df7dbc5a594b249ae30a0d8a3bf7a09e1f63f44ef2c0486c549c51e7aea5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19e5d3b21adbc5ec962fafcaa80c6c32

SHA1
fd1749508caccb9150ab99144fc70f14b975a221

SHA256
5139be575db29f6db5df8a0443f7a3b41d24f25fa98828670c0d62bd80f5f860

SHA512
d3e0fdf8b657c7f663400972d199e5943d01e6d685d6663d02d365b106beb5630e63b92bf6770d5fd95b1364d228a86d8d9414f40c9c56eb99a85f188563ab63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3eef5db3eac44b73f535a81bdb732601

SHA1
24c2409fb9ee1b9a12402810c0eb1077c316bc32

SHA256
c1986a037bdd01c6634d93d37c3fbf625dd0b2c8c4d909977735ea301abf199e

SHA512
49c72afa6cf90e78c9cd02b452ef13de4dc5c5d2042f266e4043719969cbffb429e6a1386ff7b0c4047bd747ca279950d650912764c49b1a92c0076e050a8649

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9de20854f30edcd2ebc3a718183eaf35

SHA1
64c15d7b667b0b5e3c494e0c300d8628da0f616a

SHA256
1510ce5b9cdee2ac44d940b4087f22fc4e0730caa09ad418973d0296c036bae0

SHA512
a1c979d5fa15bebba7927ee76aef90e2a7a630a56181b8d4b348dfbad3168de7d459734b5970c87e1909f271d078969d9bda01778e2d99bad525fd5bbfe708ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddbeab82cada71adf85a68a0da604bae

SHA1
745923712d2357ce9e91ae002fddeb0e6df20336

SHA256
94d65cfb3a1658a93c45c874e62b22a1ac329e272bf2049dc5e31099146110fe

SHA512
722b8d19417320bb6fe9d3392c2f1c3e7b4fe0df448244671fb23a369f7db1c3773d75b38d914b34bc9f04dac59539b3c140e9146125451974c925c4da562d52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d3822f5749f066948974031c5f00823

SHA1
03d3e5997181ac60c40f5aa4eb365cb06338de60

SHA256
a8980fcdd46961303b4f52257ccd9b82d03ee372b41e2824e39252fb48f5f93c

SHA512
4b1c811fd3a1636edcfee2bf22884977eb5996e79202f8bf4d553be6cbc0f033fb197159b753674bd5f2b182f3033a660598558497e2abd7821b34837441a815

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c4650046385600b3c05de2978e9469c

SHA1
11ae1aae80357c05acad7cb57083448d7415bf0a

SHA256
8ebfcecc5de99f59404e68c4be16042427a59366d8e224c3511db98c82b6767c

SHA512
d0009fecfd704ca11b06fe5beac0582eb00ae521121a26f1a4f10f7a9ee40a5de760f34ec15d415ae63468facfcd3b14954a460ed0494dfcb51127bc2430a056

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54b959a6344d1df01e3d2d9502d889db

SHA1
be682fb38455cc10e0665cdb76eb7e3f0fa734e0

SHA256
ade51941eae720f71c57f78b45d01c937262676fef16a36a781352ef04e71230

SHA512
a52205719c9674fcde5e80bc32e6ee9a091413327dbae1e031af010520af182119a7c556da45bd8e00572d2e8182ece876f46f25aa11877550da8d47077db472

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e179e31f23d4425a4a6a53c632731b8d

SHA1
f3edd3bef7a909de31298866a614b5040d7ae0da

SHA256
16fa639065d817d14d6f81888fc2c9b636d8875c28a75b9b482189ac84d3aece

SHA512
fedc433c7f57d3278868ad1cda4896363912d8676ece4bcce603375e7f722f2eb4af09da77f09ca025e2047f2a5b985746f125ff6d0aa46aee0535af2cc2abc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bffd5172f74e5a2251c5b9b88d6af9e6

SHA1
8c4dd9f00e7bc57f73d36253d3bcc0e7af156ab0

SHA256
d8a1169a2c8c905e70cf17e4c0e2c50af0fc63f7c0cbc1261d77b4e66e9c7b62

SHA512
9da7932e02403cd86a5f842df28e68252fc7a786197a13cb3544f33eede699177fe1892e70e9a476ecf786bcff4dfee67764ba53f8fcfed5c4a48bb012e554d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96a20e70d046f67c29bb8a984d3e662f

SHA1
04810fb59910fc6aeff6ad313d94b822e8e3eeb6

SHA256
25d08191bbb2c7a67274ee9c1680d077902023cd03337da1003aecd7463374d9

SHA512
8e87b1fbf43b4bd341da523e43d7f9d4aec32d0f9ef2323f70422ae02235f99f986da27fda3520d3c98695d61a4fd18fb14f65cd46fc9820de1dcaf283a7bce1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d9517696a7a4679b58ce9b66bb1234d

SHA1
e5d763ee60e8d0b97206b67f000fae9e76c25a89

SHA256
7bdb3b03b49f89ec25399ca00fd46836cc477a4c5d38e174f607149c2149d355

SHA512
7dcf033d02fd652ecac35ff9b4cb3e9a69576cce6d66047d68dd2141df8cdebbac00497291500314d4f5a4b2e2532636e3100994dcb6d0d8cd324fba05c121d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c926953c95303e01af7d7d24b4df6538

SHA1
a38a553a6003a75e6fcb0ec43ffebf7c32e1e4b3

SHA256
0e7e5067bee58fbe1281b9dbf3265771e191dc0979d3732a2412260f27336719

SHA512
60be507b5d9b81b7bc54330e0ec1a228b821b699ca26d379499d2f910bc6627aa80332bf7fb6c540078086ef0de680ec2aa45880a3da2e179df182850ff2bc5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q0WBLVJY\f[1].txt

Filesize
39KB

MD5
87589c438a13a514081c8a6065cf438e

SHA1
0232902ae6526adf4822a40b0d5cd2c1949e4708

SHA256
ddee4df85256edd5f22a70f1692ade0f06d129fea8dd6d539be46ddfd8dd7a91

SHA512
123c5af5d99ebb96201364f7f207e550f4dfe364761f0e5162c93747d83fc6c831262876328435bea39eca4188cfcd9fc37a0b8a992b33f8ae0691b4b39a3639

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab739A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar740C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit