6cb65685fe1bfc61963db60be2150d27c718e0d9f9b37fe4b62b6f24a905d893

Analysis

max time kernel
141s
max time network
141s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 15:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e07603e1312406f9fa8f13b9e4f1f0db_JaffaCakes118.html
Size

4KB
MD5

e07603e1312406f9fa8f13b9e4f1f0db
SHA1

bdeffc92defc34d5f9b13bf56010e29af5d663aa
SHA256

6cb65685fe1bfc61963db60be2150d27c718e0d9f9b37fe4b62b6f24a905d893
SHA512

9d34a3e62feaeb39eea49b76f2b0a549360c34f571a5eff00f87afd691e62e10cef47a45286c3b3e14f9c5b34fdad244424f3f1c389a903533030661a27ba1df
SSDEEP

96:Tnn4J+raj2BldtQZMMd1/ddSbUdddybddQ3HcldddddddddddddTA61q/mjyJ4/:bnLajQF1MwlR9/

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AEBA0271-72AC-11EF-9F7F-EAF82BEC9AF0} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0a65283b906db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432489013"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d907000000000200000000001066000000010000200000007ce505c866cafb5617a51b122a3737330db64642c1717d3431735a931e58b168000000000e80000000020000200000005a3bf1c3b25af7d22cad950451649b245582d1d03e095114980b6c7891a4f5ea20000000b8a51f3d8e6b574e861764942fcb6ab39ea5f96605df328ab9cfdec7cfa541624000000093686eb3683fb71207b8b5ec4cace328f72109c8c65edd6c98b0e7961654c9234fb07cf05bf684588b19fa072079bfcbd485752b69b78ac0fa8e489cb7ad6e82	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d9070000000002000000000010660000000100002000000075af2bb3ab24dc7eea229a3c19c193aef752dfadc4c1d5fb2d7000918fdb340f000000000e80000000020000200000009c8a473fadb804e95ae0e24722bc4e9875387715831b04b797c62887bdf70cfc90000000664958baec1414a0a2b0ba8ae2cf3fadb87c7d18556e375c1dbf4594d07eab3e8bf18b6156ab982d0bfdf1224eaefa3a5359b8d51706564f6c004f3207a14f680b3dbe44f988310dac5436e6a111ff1883cc29979f2e2e902abf71f4e573021edf612ca3d222d96b4239bb07c48fa29058be5f8aeadd6feacf4af139bd6cea20608287519abe153d5b82fd1675b69cbf4000000068cfac4991db9efd6922ec6527d0afea5bac09099c9ac873aafd02627e0ab4e7d8169c5012cdf9c070e79f213f2efea05fe7735a38907e972b545acdc683c4ed	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
880	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
880	iexplore.exe
880	iexplore.exe
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 880 wrote to memory of 2808	880	iexplore.exe	30
PID 880 wrote to memory of 2808	880	iexplore.exe	30
PID 880 wrote to memory of 2808	880	iexplore.exe	30
PID 880 wrote to memory of 2808	880	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e07603e1312406f9fa8f13b9e4f1f0db_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:880
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:880 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ca9f1bfe3ea47e99320635b6121b2da

SHA1
421359d41d5a4351ae342be88dfdc4168d711e2e

SHA256
028f17d194d56e4133afdd5dcfcfb9c0a6e665a97028dcda1ad3bdbe0e5a36f3

SHA512
7a293a5eb0765c58bb6ab8934f24b7866c3ebfd762aed5de01a849a96ca75cd1696d909dd7f3314d652057bfc1ceff3a4d158e99b54199376120c661f7297f50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f7c268a1d40cd7b9d317f138a951f30

SHA1
59ef0cf275b7af0d4c7fef397e2c23bacd38e6f8

SHA256
985a04ea997d0ec71a1b003dde83201c6d44703cbedaaab0412ecc225c76b42b

SHA512
0cc5779dad69edef27ff5ed6557a6240ee2031bd61464fadbc13b31506039a05378cca31b6ba4050a51550d9151f1f4982191e11a6dd90a7aecfd4d11cb7e3e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
280d8d078258d6ff9440f6683cea615e

SHA1
41484fd5426f484472ae56357708945327944853

SHA256
093bd44efcd5648ab9f8a442657210cde3f71f316d8f620997f2a1a489682de2

SHA512
72a90c7ae140551e782ea750855362e0c8f47d7bf6577a944dea8c7931cee8adcb43eeb2d320c0c58238ac6e9c7f1c70b89bec046cd9ff5eb3d985d2ab69a824

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc36b0e076f43ebadad97c9fd35be29d

SHA1
6d894d4fe3c38b01437ec307eb52056a2e461942

SHA256
37aab777de5e2e69ca404118604074438dc3d5f44337f8bd56f4832d9eda7b4f

SHA512
2d61fc8799e65da5d5333e14fdf3772c732aa0423ca106a3b2318573838a552b4c770b1eff414516473c8e9e6d5ab9d0bc5f7bdea1e7a27587f9531f911aed4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c69fc6cb4642e4d195412aefde05fa5

SHA1
ccfda174114ea61d3aa1d7a43f72d8e9e0a22b87

SHA256
a412e1affc4c2809352b3313cf11734d13fee0d8a9e48f73bd8c1096b3c9054b

SHA512
bf9c33412c6f1cac427cad55d3c73f7061538408059ec3cf8de1d605f29f0d4681017ab58d7685e64c9742182d306c9e762c9c5d5e6e08f943cbf92d4d1d3f22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18a18c61cac6930ab134745b1fbd85ad

SHA1
edce2e9d9f594cb850728d85814f7400b2a04827

SHA256
cdf21a8bfca2a4dfc2b52f282f4df2a6ab28c1029d5bcfcb970bbd4b2b0e54d4

SHA512
54a04e4387626474e796efd228fff1a7e1b9d32145242d40c65a005b7a5b486f244b090cc6c439b3df63bf45d1c20cc22f47943a96b4573c71eedda8bce9bcdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4454f8ef1864b713daa86f29ad170dc9

SHA1
c0b2f9f7f8961fd5edbce340356762eadd53c575

SHA256
09642ce4e815697af88e7bc80816b4ce1891174372dc48f501ead060d0f00a44

SHA512
676ab27142aa0bee1165b88b44284f12872e91510f894c4c13ee3e3a51ebc3a12a7e03f70f097178e4be2b93ea3d127b739cafb90f49d9f5000be20acf9f91eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87857f2c72ca31167e6d818ee0ec204c

SHA1
5bf4ea47ea8b1f4f45836bcb23bd3d5bfb7913cd

SHA256
2e815c92338f005a127c5cd1184d8549c8647e1070ebf6be834043c6c8778287

SHA512
6e92f125da89cae6a3819e19afab7570212eeb9de6d8b51c0f2afa3c3a936c96d3708e169af06f9d9c337791f5eb548f5a2f0337c6bde218311d05c0fff6f19a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b1d638979ec9ab87ee3d690fe9371ff

SHA1
839285fb291f773a774d7cfbd26b4b42ef34cb65

SHA256
2d73e0710236f78a46cd0b9336a90a6bda5d91b703e761d61ba43991dbb70a56

SHA512
179c9a64cdff397118b062c3239da55f6f5cd4834ca8d3f9e126970210d4637afe8cb3048d06fb0117c98b65b6a77607e35830cac7471ebd9f9aa0e1ad591563

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
035f14801a4f7b8432cf6ac2c1757b9f

SHA1
ea1de02001c7f079b580457943877af737fc995a

SHA256
8b3dde30741f1909e96f0e52fe68ea7e9ed14d5acb29edc02ca6dd2dccabf89a

SHA512
a1f9c0679d8d4daeb1912570426fa52e630805910fb8e8b8955959ecd5f023f8617c3b1a017be7dd5348687a1fe4d12c50c1c65bcff778891cff9adf800d6adc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3bdcb5e6c870e6d3bd89ffae8927ec55

SHA1
5d9c512d7c7f15da63c591aeb1d55ac67df2b2c3

SHA256
1e6a672a8942d512b91605ea852cc1503ec54ca788c007bbeaaf044c03b5a224

SHA512
8c37d287434fb7b1bde21251efb4cdfd5d2755239b0dfb03ea56b29a45a52e0779b39a003946fc9caebddc7911acee0b7038ffcc27a49392a1fcde68bbc56ea0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f70b93a8e0e9d2763c3c114a8cf1d2a1

SHA1
a975c271057f2e3c65cf386d965a21bde9064ab8

SHA256
79c4e3559c3405f280ff934503548596bea5c164744786eec1d2ac111ecb074d

SHA512
b12a2452b754b6a4fe53f51c7ec13820e2fa5df857a86f9e54ce29043472ee3ac7bda81782bee98172b73431f9919777d69aa2306a7025c251b315faa37ac387

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26511e87114aff7e54185120f8fa2235

SHA1
f71b01ebb913e1c7ae7bfccb7096afd03148e50f

SHA256
d7abe991a33d5a869d5d922426bb8ecae9a0000905670a67f77f305c60ad16d8

SHA512
7c7f303a131329512891bd685be85d2b78b9677d07b85ab786c850c302fc799c90431b19ce1d52ffe7edbe9ce3c30db7852ecb7e988e320251470c18d08246e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1f121093f507141c115e0530309fcc2

SHA1
87536af7d2dd375505475ab73f7d744984b1c6d0

SHA256
06ae167e4b934b6d62ee981124ffe31ca49faee5714a36a567ce6daa6d7a5370

SHA512
7a57b51bab60682fb8077fd1aca429178a68909efe79cb611e14733a14f7c633b4919cfcf7f8eae5d014b32a7e5c4f0ea87cb4192acb597f7db8a8b1e91faed7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6acbd844391e84b43177528238dd4164

SHA1
cd1a1f7eda0bfbe698890fad3f59eec6441960de

SHA256
a5be32ab157baf980d68421b105c93cad38948593dcf684cd0f9a8b6945278df

SHA512
fe5a4e5600f6500f5a0b42ed6b7045bf9a9f88deb103150d42e7d945a1dc5a7f4a1f7fe66947549d9c91cbad04114a6bc59764ec58171ed252bd2ffa2389bc6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6D66.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6E43.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit