bdb667d7968e81142b9922b1cc7062660c8afd8693e2a23b1f097d6e735131f6

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0622149bf0eaa87a4db7e00b3e1e7df8_JaffaCakes118.html
Size

9KB
MD5

0622149bf0eaa87a4db7e00b3e1e7df8
SHA1

a39dc8d34197c68ef57623139e0463154bdefb9c
SHA256

bdb667d7968e81142b9922b1cc7062660c8afd8693e2a23b1f097d6e735131f6
SHA512

bef43e21cb764070867d4c40897951c8b34a0d5e86bb97082a1f2a9228d6e143f30818c1874cec342b86a80e36a400842c66f8e87e8a2c26cc32d64372b62b50
SSDEEP

96:uzVs+ux7xzLLY1k9o84d12ef7CSTUSGT/kPsjpUlVHcEZ7ru7f:csz7xzAYS/vMUPHb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{514277D1-7FFE-11EF-B233-C2666C5B6023} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433953441"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30dad2260b14db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000ca441396ed71b1bccd47aeb26ae665d5cc30c8a29d1e28366d5e197cc57a8b5e000000000e8000000002000020000000c13dfab34d099383ca1e4d57cda39815dd54d33ae55e8e821d437ae3ac70bc539000000064a2e0493ba3f29e0a7b251c0668b60fb53ae7f588efcb01b4612648313e136958c3534c4a3fc13a097e0d8145f923773266ba2465acc42a9ce5400c99a810394b1b3d4ca6b1c939475324dc646a00fed025b8e341cef4ba332934c7cdcf88170ad419441a504e4ba399701c8e161882a2d9ddea188862230731f0fa83c91a7f622b86ef4df92bb8d0905e8dd53d1b104000000054439cb662dd28dee24aa6affda06a8a18fe6ddc404211a9de9e1cd1295423680ab5820a9a96dc28eff812f7fd5a6ee4e1818c041c35d0fb1886a6acd0c97525	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000f922e12369a59ab60618b8fb9f94836e997e8b1fffb298fb978dc05663bca238000000000e80000000020000200000007d0edb6e9afae674ef926675775c0322b8291bb546049e075ca37ecc5dcacd75200000004471161903ff67cd3b64240b62a6d7bbaaa3b19ed3cbbe1ea8f3dfdd0926507640000000ca6298ff51b2c2f34b3b1ebab0deffc274fc91c7de7df93f3d5f6fd304a2953077a49adf8d5b5d70f5f10adcecab748b5a803bf64b80fb6630728f645c5789f9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2212	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2212	iexplore.exe
2212	iexplore.exe
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE
3004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 3004	2212	iexplore.exe	30
PID 2212 wrote to memory of 3004	2212	iexplore.exe	30
PID 2212 wrote to memory of 3004	2212	iexplore.exe	30
PID 2212 wrote to memory of 3004	2212	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0622149bf0eaa87a4db7e00b3e1e7df8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
209e58971c6c666a6c5dc338ba557483

SHA1
328fd4e6d63fb2bc86daaa707fbf7287fd385a38

SHA256
6f91a9adfcd974ef2709fe6fcf23f573222f123c4e49e8d9475b41ed67bd0cf9

SHA512
f95e4e81cc26046f04c096677346a91df1743ef24c0736d4f86cafb00911deb0983519d7ad3b00a1fdef57c9a8ca621e46dad9587a5a3a1cc1e805d7d79e1fc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94377c2776115bc7b8d53f15a6bd2931

SHA1
b48c003e749453e06a2d8dc4478be52d4cbe31ce

SHA256
f6df0d7f9eb0a1828170585c76d1f0f6203f9e5fdc9f95fdced57a767dd93e3f

SHA512
ffc166923a9996a97c190cd71852715d3d0fde3f27fe9dfe4582e3d6e34042f93c8550c54cc3f6437f3f7d5f8891e542a070e9d57fc820f775865f1cf011a337

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d15bdeb007ced53cb5aae3f28f3740c7

SHA1
bd12912cb511fd958538768ec43c90337527835b

SHA256
8ba659c641122f2fd6cd3de33845b46bc6d8de3ecebe4bb7cd0195a5f8abce52

SHA512
ae7e7a45b58cc3ca99cb58643a3a27f1690f6f1d154b88053d46d0e0c1ff9dd9882f750404e4b24865698a6968d29fdfbf45b81d9889c9dd9a77b97e0259026a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91b5a703a819c02638abe157745707de

SHA1
cef267558094de929b10523ca21367b7fcdc8b4f

SHA256
9abf4c4309fb6a0202ef1753c22e133ef8b0d16f4cb7b0fe0092caf53398884d

SHA512
43190ac9c7d8d397aa98c92342199dbedd98eb9045ce646bec999216aaaf3b29ecd4378d8fd9627d8e3b7c53cbad0816bbc902d082db46655bd2514d3cf36c78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88750ad59af38b3238eed1db4fa6b2ca

SHA1
7a222146f656d35b0d302892f2f24cf3fc1a238b

SHA256
60cf68e33e9b25cd78b2c2adbdd4e9374013b66ef0083ef31f19dd194b49d2a3

SHA512
ea28fdcfda2dabb7f5d583ea0a9e82f785df5c0e2aa88fd4b3e88723ba20dfe8bdabc16ab69a5a737a81c8a7d767a7c7993e530f247618071475ff5ea3a0500c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f620191ce5077040d2bcf675497ade38

SHA1
1792a3d2d6f151f24db380d26d99b462217368c7

SHA256
8dc8dd4c25954904676a51d33226acd5759176ff2795f39a5748894dcfcf013f

SHA512
671a1b430aa845bc27b512e478d3044bd808960db3afa07933ab768cab0990ca50694394aff7aec1aa610579416ad3491a8379df0a0e2d779039bfd7f4400bdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab85465ab03bfe827cf1ddc40166dc73

SHA1
5ee8ac9e81e38ce8e55c648689d4fa72d1728bfb

SHA256
11478804c824b7fdd95ea39b01d09b3a28ddb3a2c631cd5d7b9b0be7e0077c53

SHA512
944676413c3d61b5a61825383894d94e94d5b6e50d78774a59ca3cfea1e0318e252eb11e7ffc8ba71c74e1bb27e58e21f2f9dc61c9db81907bc97c8d637243c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ca48fe0c66f87690cc8829c2051b7fa

SHA1
a9ec79673a1d4d760f0691543ac09aacb279c301

SHA256
cdb3252edf16db80609d2f16f51cd5e038885a0c2ba66d3ee6492688b3917cf2

SHA512
511aebcfb29a9a41904bc23dc72a98c469ea4bfe3d63bd9781fe00780cefea6cf7b3f275b3edf35426d490dd630ee3f55557709852476cd8d45dd797b565f5f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
013e00cbf07d1b78155c6b8b93137145

SHA1
a3d8193d20ce961d1b46c12bbc096e081213cb49

SHA256
233f331d04d27b1ab5c771518c18b55fa029fc69cc77a68f387bf7ee46afeb91

SHA512
a94e3f8aeb6fe3ff61a0ad65ec00b3d1a364616cd59699fd7f475776758ea371d49760d8754a753efeb2dc928599d5c1d0505b3dac9b6e7fe02559b3b63cd745

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f1c0a11801395ad12bdf93bc04b675d

SHA1
6a7ea1c8c2546b8c7bcf22ac8f7e69102a368333

SHA256
98cee6d3df9b6150edb09f00a0112d88983986751f0bd53a8d5801f9493a5a5f

SHA512
08240e0e172667f0506c17254bb8c443c80be1883470eae534068ae921498de9188dce846695909bd7d469c8a62fe58c2f5423a43ecbc14c9de7271931126591

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94fad80e31075290a9236ef179274502

SHA1
69e33126b1efe3f37959ad4ee79519dd69bfda47

SHA256
62363dcabb6f89336c449bc3cbce67b6caf72c903be7a763e0bfc3ef5b140da1

SHA512
8c3238c3bcdef5c113b960b96e0e5bc6647818201b4176dc8d84f6386d18ea80ae4ea0480de0245e5ffa49d60fa33d6b2914aa68bc59af940a749db2f0bb0091

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5882588b4b1c62ab140403572d0ff759

SHA1
1923d8cf591ca11b0c27d76fa49c35a2a1dc3a8e

SHA256
cb0704641c316e9a6fa8c5492ef7c5ee38581aff82d78ff438db9285b6ecf930

SHA512
cc4534511de3bf360e315deb62465962f3a1b47dc926480fc43cd73976f0743ecf75abd7c3c4157cb8fa4518122712fbbdfb20b2e1008b5b53c8f509c026f77a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0569e91df080ed7dce1d19831c1f188f

SHA1
354c3f38431a20bdb6e2919ef49074deef789575

SHA256
afae0a616d684088f8484626e3fc7a793aedb1e94d26601178ca8f38d7fa5106

SHA512
583371b61e1ede4d1dab6b6875066e2200a1112944c875e2a2c805a5fba70700b9c50f527adf9cced0f2117287234e9e925e0b6821946a46acd8f941a0930a93

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFF97.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar15E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit