6a9947786aaf2dd4e3f942dc72a1d724e3b26bbb85bdc65ce6274339593871bd

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0638f0e13d96960c6e0ed8e69f5f024e_JaffaCakes118.html
Size

53KB
MD5

0638f0e13d96960c6e0ed8e69f5f024e
SHA1

1f585e1edacfc0687b2111e30575093bf0495cc3
SHA256

6a9947786aaf2dd4e3f942dc72a1d724e3b26bbb85bdc65ce6274339593871bd
SHA512

83633c40f5eacbe287287d0e7eb6d006f9499f5e14dbedf0b96688fb16a4713e0911d80bf465be942ef64cdc2c23cbbd7883824a8eb77091de3c85f3c2fe176b
SSDEEP

1536:CkgUiIakTqGivi+PyUhrunlYh63Nj+q5VyvR0w2AzTICbbzoy/t9M/dNwIUTDmDL:CkgUiIakTqGivi+PyUhrunlYh63Nj+qn

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0c4cfc30f14db01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc500000000002000000000010660000000100002000000040ef4f0f98af5b34dcbf4f93aec74af1522a9e1f19d68484d1b2809b6e12e91e000000000e8000000002000020000000e77f758fd8f20d48ad7f502fdb9000331b1f1833c3f1c593df1e76c9eb273e5990000000bf99516fe7b1746a06168c612e3c2cb4ba9935d6974e5afd869bedc07fb14ed06e307dce26f0a2fd709c7a140f22300067522fe8c38412e70da1d9f6644a98c789e6710ccf7e7279ccb32ebc9277b11136d6bc0061e46fb476fb17736fa1046d7fba63d393d9a44ab47d24040a0d55ab85874a41b4321e5edf76f3e99ee2f48d63a6af64ac90cb7b7058877b63149c5d4000000030cef4a365f733efd5d669575737eac51ebe86e23a84d7ce393c6233610aef672db3815e7b4cc859fee1f7e7c2cf017e0a68cf5400671f0dfb5ed9630a015549	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EB9A90C1-8002-11EF-9C49-4E0B11BE40FD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc50000000000200000000001066000000010000200000001576c6bfadae3031b29676de2f89a66d236aef58af8c543520803526da597744000000000e8000000002000020000000b2f6f245a03b1ed5faf5cbcdcb50fa4df7dfb224eff2c7c4cd69f648bf97bb1620000000f428b3915f911601ac9bef5ce77b692fc50312304a50aa666d5cfdd62677ec6a40000000edb36af8381c24d9d91fe6b663d787c7a11b08bcfce8f081f8767f0c263c2e1348833e81c8d58afe93a2682c1735f3dec8f4d380020bdf445690ac2dcc4af154	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433955420"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1680	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1680	iexplore.exe
1680	iexplore.exe
1384	IEXPLORE.EXE
1384	IEXPLORE.EXE
1384	IEXPLORE.EXE
1384	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 1384	1680	iexplore.exe	30
PID 1680 wrote to memory of 1384	1680	iexplore.exe	30
PID 1680 wrote to memory of 1384	1680	iexplore.exe	30
PID 1680 wrote to memory of 1384	1680	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0638f0e13d96960c6e0ed8e69f5f024e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1680 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26f12a2d57db268def4d25682c9994e7

SHA1
115fc659749c536276d3f8c4b1bb6c5b46cf105d

SHA256
2236579c1e5f95f07d8b27e93c0845bc94cef4121521b8981c374e550bf637e7

SHA512
6c5469cbe2de8c9b034e0a882f52f86ff5bfa174e050c55aa0145aafcc52083024b7a1f6674373d93f84e13d2b4cca2b8115a34c81f999125b750f717eabdff0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9afad9b3d0b05e9dfe0ca2f5801d98e0

SHA1
f13770ef90cdf27f0b33ae81b3007067b0f1e76c

SHA256
c8c0a5a2590a67ca2fd5cf3a8e6bcc5059c5cf93debc23a0e7557211af6b62d3

SHA512
d1995cf209abd1181f64c92d67f8ad5c0435f50c4f6d29be261f44eb69c8ab21fe926ee66a771f23d5f3191da0c5ae4c048ba0f416645c09439c2003fc7ffe72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa6be73919e3653787ad05681fed897c

SHA1
38066f9efda44a85c42d6e8953d7444f6f0301f9

SHA256
b2c5e6c83cdd78c33edbc692b6a4a28f63bb0aedd0d57758fd069bf17f1fd111

SHA512
afc0f18a9c670847086c5c374eaf9576a7c9e86f27ebf8cc7363412b058aaedbeece56896456a62fdd86cae66e114282a6284f8e2bd1150cdc000bfdd0060bc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e54acf4b71d7463e61469180d858362f

SHA1
39ccd19e433f1b6bc509cedc3c94760b4cd47c35

SHA256
3e924dba54c0c8bcb79c9734a66ee32ba81863e954e50198122d76f4586d46e2

SHA512
3361c74b96aed9a53421ec5e98aaef58667d7491f4b788326442b0f6b83713c2d029b5cecd0211db58fd51278faf7b2b0b0110664d845d6f2bfcd1770d772d55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d31bdad9b345414ba247bd876744146f

SHA1
dc4d73223e9753e543bada1ea859cd816fd0e4a6

SHA256
6a8f449b5c421fb1a1a75ff532d5a92179daccb524ec58a3263c812c46a06fab

SHA512
da69ac28d0973daa3ad67a4057f953c3015abcd0ff3346db61861e5f164f1dcd05c251c1b0a99ae1e2d368e528d8e15cea6f3dc4219f11043ec0853690b0a1d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4593a6bcdd4d16c8d526def1dc2f843

SHA1
d856b360e2b8ac49917cdaf4b675cbb14e3588e7

SHA256
3e3db4ca71432eee99b2e647292e8efe484c68dbc6b1a2ad4951eb01fb8c67e6

SHA512
cee0e95c6e3359375e0578b61c796c0c1e3473bb8e5a29fdf86065850fa3154bdfeca25d7e536dfa76b8f8e5d94b204bcb44de808fd2e3ecf5a0307f801485ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
810d04a7d0ada4d4ff1dade9c80f9f70

SHA1
68a7380d695567d5a46d69f9f0a0caef700310a0

SHA256
48395cdb303925c344717b7399c294a18c581129df3a915b1fe5b69b94295150

SHA512
0b4fe80c289fdeabdfd9cab2db20a91fdfb99da5e3ed69b1223e3cf008cec453374024f53555987317ccfcb19fbcc32af38249117bd9ed16f21db042c55e35d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b876f853a347f4dee08a235bc66aca9

SHA1
cf6d7bdfbf688825e5275a5ae2182e11f14d7c47

SHA256
15f606ded34333d15cb701b6c6f8affb0ad9a549e02db61aa69870c88d455e67

SHA512
778a1d723364e24bd81d703ac1c5a43dfebf7a79e06cfb8d6afe5c1107b71806ebbcc92f91f3b7c8290328e2e2287a2ddd3150e0e705ddb92aa7334b85508d83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3cc699a688556f03a9f088245d642330

SHA1
c2656c9813f18235c783b372aa9be6677a9189b3

SHA256
cc4b48ae016977043626d49f729963a28336bcbb4468ee696dfa5555f349d5e4

SHA512
4db7f7502f9ef843a4a3fed3aea0310371274e0f4b3c3a7bef1e147f3fe6e53590c030587e884a2cfee8c009491ed6d4ea681c9bbd6472d5f3705c3fc123139d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0c42d8e560876835a9823107c90a3d8

SHA1
645ae5d1d7e704aa71b13f0d643f199f4322c9c0

SHA256
d5b0b1e19d808772598c0c404abb01a3ade9254a0db91661777ddfdcc6300848

SHA512
d384381727f3b647d99dc23f44d5ec259d0013a05201dc86c27181f84d007b6502040c3d9140b6a0ce7e8c2a9b83d1ba4577f04e2ee7426105fd09260c57a2ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6cf8c69d93c5d08b8e3b0e9682760ed0

SHA1
d27879f27f62e7e07bdf069942fdc0568dece109

SHA256
9c1561dbe86d49aa9db478913542b98f8a2a846738a6bf745b51aa8e7a105f69

SHA512
ba7ec0e8412a8d5a26d21f3322b9c201046ddf24bcc77e99d831ce5fd478451d5a4a563609475eceab42dee7349f227f7ab87354f88d57a87a895b6abef8d5f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4c816c5fc94f8c6332bc9a062a0af11

SHA1
a1b7d5f7746b63ab6a3c04ce621734c9f16ac012

SHA256
e592cf43e0717cdc79fba11c705cbb4505c6b77af3d19a809766fcebc81d8cad

SHA512
a9753f6f0544abab93febb46c841d342c5405d48bbca24d7802ae76c76ca70a3c9efc11bae094aa6102fd3c1fe1258b9b87de5d1d9166535e73dc185451dc5ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91dfe289e85c0f3f2fae76e2cbf0e8df

SHA1
d40bcae1deb4ca8d218e29573e077c411f6aab5b

SHA256
bee38e66d478535ca72a23466b8326d701edb2badc8a79036b828c4b1fe3d410

SHA512
75592c10b312ed08031d95226d29089ff06254a125259aefd077447da59940871b43feed026b1ca9b67fb3475e2c11de5d735bc5c9ec0d621c0a1fba55cacfb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
327464ac6d4061b2b975a8678fa6ccce

SHA1
4dbc10859f54137ef2e3f1e659144cd2decd4f0e

SHA256
351f2fbd04e40c11880de026b27f03d6e2144ec0b9c8cbf5f1eac931d3836291

SHA512
7ddac08640bd69451cfd51e76a4616029199aac9832a6f5290781010d10fd9586bb5451423a4a97068f1df5ad492f2d9f24fefc44966342cb524b4c883ae9a2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M4TQDAHL\print[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE92A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE93C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit