7212b85844059ce2822a3c4feb58c93db5ef0c46b1b5ce8256a9af4a8ecd5910

Analysis

max time kernel
143s
max time network
143s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-09-2024 19:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e0e321908e171fe9c97ac3cf9e4850a2_JaffaCakes118.html
Size

97KB
MD5

e0e321908e171fe9c97ac3cf9e4850a2
SHA1

436952b28f04f13d952b0916b0a7e348ae270052
SHA256

7212b85844059ce2822a3c4feb58c93db5ef0c46b1b5ce8256a9af4a8ecd5910
SHA512

2b582917eb31732e628d78422aeda6f221c993d36b7e6167ebdbbb3b05fb9dd27599cc3da85c70847dfcef104be4889a5c056c18f024c8585fd50a33b7b87d16
SSDEEP

3072:hicaq0wCDPGnqEZxMEEE4Y2EqOOO14RksPd9wTVL23tknwKEoPu:kPQqEZx/EEhu

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf60000000002000000000010660000000100002000000085d4ef5bfe170cdf059244a736ffc49f552d886a6fd3f0649773273bcb44098d000000000e800000000200002000000045c3604292f719fd4659a14df959c4d149d20abaaf5fa9fc1833db4bb16177ff20000000a185524355509431f3ac09e69a695cf0758a346dd8dfc147f82480be4f9deb0140000000760d4391609e880239e147feac90c1a5c900b781f104a06969c560e7a817dba333c52d6fd60deeb7f94d94c91040edf55b44cb52e0d8d0068101ab9727436b64	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{074BB9B1-72D0-11EF-9303-EAF933E40231} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432504195"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf6000000000200000000001066000000010000200000007b6da0dfa03fc930b3a7bab5457e9c65e9df24e10b38704af523d7c138a02921000000000e8000000002000020000000d9ea0086571fea3f3c3ae0a7105325418126ad3333d05ffc863674fe1285586190000000cace0d9f037efd37b9e37305fbc910141ab9a6074268d3231e293b2dfba6ae466fd2b1430149c1fef4d424f901117d246c92603597d68d183f3940d522e56243a1aa32b64ef42a94d3de5a16dd1a27bbcb44be8c9cfb65a4644d07be5ee94f51f1befe642337718790c9d9c1b5c83b08a9bb11684abb945852a5e114dc3bed3ba2ec69bbffc3533886e87e505066247540000000cc67e565a87468456b8fbdd9881282ccebfcc3da2c37ec427dc1ff5617caec4fcf66fcb4ec757174760350fc161f3fcf791fe2f7f9feef4c84cc57e6b8607d81	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 204593f6dc06db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1992	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1992	iexplore.exe
1992	iexplore.exe
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2340	1992	iexplore.exe	30
PID 1992 wrote to memory of 2340	1992	iexplore.exe	30
PID 1992 wrote to memory of 2340	1992	iexplore.exe	30
PID 1992 wrote to memory of 2340	1992	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e0e321908e171fe9c97ac3cf9e4850a2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e18239adee0ad78da0f8593ab85c41b9

SHA1
b7f547a79bf31310488d5368345eaad1fc1d7b8c

SHA256
5d5b9f9a3a2dd98e54a8f4159ebf35a155b6b56574099b476d318081a1bc8ea0

SHA512
b37aa2e14df2250791c18e08f918e5866fb24b5067591e29c01699d66fdd744495df25b440a7ceb54b45717c7dc5a6d58467eafcebfdc9fe6c08b1249056fadd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ffa409940ddbc4c12d9d5c6c5327fc9b

SHA1
5124edc52e6c033bd12c67850db0331a32e25a97

SHA256
6807e9d4137f8bfc1f24bdd55b23b12d70fa85662f63caa9030fbe5ce4b5d2bd

SHA512
cc2dcef47aeddf1d70a7be42545d2dba8b4a5e6f4fee9e9aea752ab50ea69ece0364457d13a725d60ec3602420e07ebc447e561a96cee1042f907fe8e95b2746

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c709150956bae7dee4ca2a5f03a793c9

SHA1
fcefa11c2a4e6962413262524579a554b1af7848

SHA256
4444f2d99f03c801c8e83d30ce4ee213f52bdbc07ab9386f8153f1083d68a3eb

SHA512
8b3b1bff5495e4cb0397d1179e027964d191fd53ec5c7c7814910552bde796b03e04a39bf36ca9dfe2435dbce40423d3cabe9c8dcac495ae27cb4db75bd0fba0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2dff42ac354aae44ceedde686f90b50f

SHA1
9fcc8b70db5d83566f3bcc9deb0392269249e525

SHA256
e4bfcdc510fdb8368cb558157787a1277fd340996bd7dd3ea1f14aa8f522d4cd

SHA512
42fc9cb3442d44423a7f827a164740851af7d33e37983045815fd018ad61e0b5031ad4e2a2a0b620c20427b8d3247a8e57af9e84eec7440d5ab234bcfd8021aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93bfabdc34c58c1b7de653b893820a86

SHA1
98745814b61f3fd2730d8057e19463afa0f5add7

SHA256
8746f2392a502745af1800e6551b0abe4399d3ae4cee736c2da0e6ba1dfb778c

SHA512
39055bbfa1665f0a6b93b5699f0a3e690e54e2bc7ded14cc7e2e0058d721d0ef14a809b2668c26f10e22794516e4bc5f21386105b61d1ea0fd42a25b4a9e609d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f271b0f92f23d5178793fcf0fb08fa0

SHA1
f322a32f7f166564be90a8cb30be205e5ab16a72

SHA256
70bb4578cfd09ba9e343e04d15c8b104d9a85f267a8290090874f814c4453f1a

SHA512
b3039b537d12efa0cb991b38614f910c48fe3dd1b3c9c511eff09c4580135d32a92aeaab8b9b4cc11aa36263910aad9cc3897fc93e8676989875a68628191f2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ccca632a4a8cae0f1ba2ee1ae2d0a132

SHA1
d8230cb04d28a3e5839840e279726e796921ee31

SHA256
2177a97ce7a19536776c71ce319489a6f5f776541ff5d47bc7750404b3c7805c

SHA512
2c65bc48efa47ab0f2022895cf762367f416369e0fdf8c011e730050d8b981592e3640f40cb614bd7c1bc6e1f008707bf25614eecb234c8927d1cac649276335

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
499d7a5004f49ac54d2dc0a8d37ce7a6

SHA1
ed836ea183265713f6a6d03bcc775c0d389bd410

SHA256
1f077ec944fc7176aea7b56cf8c708b4bc8af2ca76d4a88fffd7a2c35f7b4609

SHA512
f91d582a0f6bb3fa3430d33000d8f0e4590b4e71e181119f39968f08c7f6f2b8c4c96055a30d1fdb7c18eca4328c6bfe1b12836fabc32ccc30089b5841076e9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6982afe278be94079aa5f2947d60d7fe

SHA1
aa503e6dee8bec431ab28434910e5f65f72edfe0

SHA256
ba858e8d3356f925d2def54007a5520c914b82aa1e6da3b78fc715e135772c8e

SHA512
d70316df9275df94fce503d4ef0972418799c55d6b7f4a7a977b905597236b2f9ddb0d7d6d73f14c3323cd0cb708e607ba1c82ffafc9f934a6dd944e625f8c4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43bcea3487e375cb5877268b9a76c5a6

SHA1
d8fff43981edb79ce38ce54cd45cbadbc927e2e7

SHA256
931b42758e3b61ea2595fbd5c6ab8509cbcc31b4586b055d0715b8db32f6279e

SHA512
82f73563e133fd74c2ff73d7c70ec2fc32ebca163dbefdeaf5858fa872f453be698b75cba10e554d7dffc3e9fd46abdce115463f4b1a9557773423df65452340

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27d26386a7314a624253f6c19ea8cb58

SHA1
37e4b082eccccf83ef8c91b3dc3e4dcb98b8fcca

SHA256
f031cca23048ec7d32d0d66985e44b903e08bd46a913f129b658832cd1800030

SHA512
9fb00bbe200af2be5c87e67add840c3ae5f6cec691bd50b2f569f8dad22adb91898994b1b7abc3e318d42521719cd002cb028f452026a13c473e62ddbc13d3ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff204e1b3a2ff36af3ae80c04628c5fd

SHA1
661e8cf24d317c091c0c3d582fa089a64c76969e

SHA256
266827025fe3de06191431a603a8222a7b5a9a88524bcc10c65e7d85c387a3a2

SHA512
d6b5ab60be21ede5e99b12e0ee9d24261cb7d500504394509a8dd28380281d48ae5b083f9bdd8a6603b4f75c4ccca2f114e6b4d28fb97e72b98dd6160515d3cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac7cc8657471d580e74404479bda9fc2

SHA1
c7a195b0c50ccc1d3af1abce3aa594c4069bfe45

SHA256
b26266e5482287c3a6b49e7bc7585ad4135866270f2899f42c2ebac1825a65e4

SHA512
ad32df33bf2daab391bed2d2126f52e7452da8bcbfda4d04b8a7d448da6382aeb9ef4098de9c48f87bdc16dcc04a4e9e04a59c953a77d740d432b47522b765f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c28b43a0b184296657407c09045fe9d

SHA1
bf1a9498486ed5acc2fea4a65714e7cc0c2e8a02

SHA256
79366498aa3bcbab75732aa8ce26edb3394fe7bc93a9b9c214575bab23af2cd3

SHA512
1f15759cd53edc71f784b1953e20f2c168f5bc02f15366401a65307d797afac15a3327ab90d5155b3d24c7ecde9b07f0c7197172b483aa6668b0eba3fca9c046

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5e07dc117a31d0636290f692c16366f

SHA1
2d8c051fce694dc9c5737b7c72cd33362246f210

SHA256
dc0831cdee58b56376ff24436749fd0d068824d57e467128ae77d225c3b610c2

SHA512
9bcc488ef87f18d2ff943c2a1d5c306684360d37b072ec39bf4a7dcec1255325a513805cf9fe8c29118f64ee162db4e2224c5b832e9560faa3daf35c16ab7bca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5d0d1498c5788a6060b9822da1358c3

SHA1
5a296ae672841c6d7c58a60b34ed0bd65b878249

SHA256
03079ccf469598252111a40e6526830fd9decdba2e27cd2ec9eb48456e8e9fda

SHA512
73d022caaf9a14b97cefa7bb4b884e677ea020f7592ebf6b1fa8feaf2feaeaf9e0e2fa687c8fcade514d25d045d72849c147e20f5f5ac56d9fc2393525a2bb79

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7B6A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7BEA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit