a0d1daae0729abe668665b5b28708b402204c2cef97e23063eec0c9331206054

Analysis

max time kernel
104s
max time network
135s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 16:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0693e20e9843a46b1351cfcdb22fc3dd_JaffaCakes118.html
Size

34KB
MD5

0693e20e9843a46b1351cfcdb22fc3dd
SHA1

d60abba40ae22e6cb09bbc12c331ff0b7e04eafe
SHA256

a0d1daae0729abe668665b5b28708b402204c2cef97e23063eec0c9331206054
SHA512

1e7d9aba01ce7ba4240bbea73db34a75e66e7e3dfc471e0705b6e9338406ca35c71457078d160a2f65fcbdf43980e5571c47b3be6440efd5523ede729e08f136
SSDEEP

192:uwLnb5nZ2nQjxn5Q/cnQiefNnhnQOkEntICnQTbnhnQOg+cwqYTcwqY7cwqYQX5n:rQ/Oivp5X5pQNrQi+npB/

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50cf43212114db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4BE48741-8014-11EF-9704-E62D5E492327} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000009003e92018be6cde1482f605d97c370b8af9edb4b3eb706250967acad343df1f000000000e8000000002000020000000388d4b16dcb5c913b863d4d51031bf3755a32ca7a8ac044ba075eb78b5f838ee20000000319caf211e8ba5cf5563e22db4015e03af981cfc9b16f5b9a45d31a99c2afe5c400000007b3644844e86dab98e6db08049105fff6106c6fc1141c6f189c6518d60f0680570023675b0dce9625a700b811be7b27ce215f038306bf1c3baccf080771a8e93	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000fc83e3828a96270c251ec01aeccfd4d4e9b560a86e8c541b601ef406697dcf71000000000e8000000002000020000000634344624cc379b62a7f23ff1c797cfb41296329a6d35d9d0d918700c098ea2c9000000006f6a7eb3713a34a070b240b036b2457ae6901f71911f2225456070cdda54336bbaa05f173152e91f751d4afd00c06aef776059f07b1ad2bbfe1de66d125ca185e4aa8b0658bd42d7ed3a4b8e564649d6f70d366ab04db95a116aaed552f660b4ddfe4bfc6c34785fc5423fe73e1047eb3edc07f6b2adfdb63e11608570d4e5f2b5486ccd2013f65586e618171e9fc2940000000176ecff93536a3924fe549628d63a83904f50f6ecab315ccbb9129fb5ed265dbef1f0a3a3eb259bdd1db222046b39b4e402568bd1bb28ed6d65e1bf71aeb553a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433962883"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1640	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1640	iexplore.exe
1640	iexplore.exe
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2760	1640	iexplore.exe	30
PID 1640 wrote to memory of 2760	1640	iexplore.exe	30
PID 1640 wrote to memory of 2760	1640	iexplore.exe	30
PID 1640 wrote to memory of 2760	1640	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0693e20e9843a46b1351cfcdb22fc3dd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1640 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
480f103590f77b3b01ffccf689215a82

SHA1
a51c97a8ddc983e7290ebb712ccf99d5cfbe1b01

SHA256
a1f8117722fbd713cc9badbdf3114a9ce8e930a897ed21980cebdca6a4572da7

SHA512
9ec561d06138d279260f4d348544f7d16103dce84a6cd8c81865127f1d094d7ac0a80da6a21e8c32537ed4aef0ccf04b5a932d3bb8bb1b5435b6b9d282490bef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85f2a870f0c134183c70e2df7890f493

SHA1
a2c82ec9fe58e4a1c89da8930958c0f2e8fec143

SHA256
7add2542840235e9ea25069e4ae8ba9371083e776cfbd3ea22f643bcc3061875

SHA512
1a0d6ad8410893cdd3f037c7604a6263f91e89f55ef475d553b089bae91f4885e158c4fac4ec47f73a562816bc1a4857550af5be3aa1063c99d98efb877a3251

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1cfda6f9dd68710a5536501143eefe83

SHA1
d25ed65506bcc2bf0902a04cacc5b7da3d6b0791

SHA256
2deb5d3add9c40c06e0d2574b6a6a11c44e794a094d3148e6454fb5626be40a6

SHA512
f8c714478033d3e6790caf31948a96aa1e3624b5304d430c94f4092ff36eb843e930cdf2a1698bc85f15bb68e15f9749b5e0c59b1349343fdb17bf48f56f8406

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc2af860ec960aba0b82d1c05bd0931b

SHA1
41a15619e3bc155d2d932a1aec809c849672ad02

SHA256
59efa182bba861efa448c8abac07d3ea4e60f4250a61f67bfc9030632f50d4c5

SHA512
f5834357142919f2a567be52ee39518b2cac9995c9e618892cafdddaa8cdd4391d5ce9c730a3f35fec3c3e801f9659714f49e3320148491cb1546530a8d1d779

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d091322621816d08de1bb874d6883f12

SHA1
5d60f7c09c211db42de7897fe7a057b0769d8b3c

SHA256
758f0f3308295bec61b96d43f500d494aa5a4ce9d3268f2023882596d2ade8c2

SHA512
08d7103b12891befaf59d61c384c009568a69d8dfbcda9fe9bfa43d2cd4c16ebfc5c5cca77e9c6a2236cd2c53db6fd378bec410248204eba7cc2434964ee1df9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e624a8e5f61081083f2ff141d32a02b0

SHA1
2dbf93ea8bb0ce9e29f658e5e5ce6ffedcc0974f

SHA256
1beb305a31f6899cf6eea32cc213eb18af5d37ef753f77f128fd776cb733a356

SHA512
7340cce5dcece3b440855734f23b8306195df604ed76d0ede1bde6dfa4231fe6dd00c312c4d9939600e961bcffe692ed098e75cd365b17d89ce52bf682badeb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a97286abb5f45003365367a679dca317

SHA1
25297a0f49dcef9f9705c97ff8537312fd35750e

SHA256
41af9d2b15c613142a94c45a0ce6496e7464950b0b88bb653b467424ab2ddaec

SHA512
9652bb43324c431280a075af5f14962e543b9a7ebdabd827943ff1919752c1346bfeaa69f6c81bc467371cccf531ada6706503175fc516c7636fd4227b0e41ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
154bfd63c9773885c7f1309df2316113

SHA1
559edf1c10c6cd12063b902953f7bb62475d1707

SHA256
45f176da04496819b240588f6232482452dad22ca6b97cd8ae52bdaafd003050

SHA512
0277d233ea21db69f9ec1d64a4f57cc77a373bec358f878e4d5e37404a442de8cadac63b71a976f1bccc41fb7e483754086f5a3969a9c703b15a3986ff862253

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a16efe3914fb62d5eb9a0f96c2e5b6a0

SHA1
3a70d33d435967c4f20670e8744bd2ab6bc20f0d

SHA256
d31e97afaa66f64c5b7566821a9be528e53f4f905eff00f9f24eb16e0991e9ea

SHA512
a1f1b630c2052ac21fa1e2dcec9d4be0c6750834cc81a5ddac004218eb24baa4776e40b401566f9254811ddcc2c61e05f37f1fb3583b71f3d19af50ad631d8ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
febe54ca79e82be36378a7fbb5dcf71e

SHA1
fbbe4c9d5d0846cd1c27592512a1d6573295377f

SHA256
49cd80e5fc02fb3fb714bb526319d7ac07f85b9e55b60fbbd9eba927c57828e6

SHA512
0250d15eafce89f258b2dc268de153cbaee02fa7116b4951c075a43030f4e163cebbe1e9f7f969887d73ee99aceff2a8de4adfdaa09085a73962acfe18732c1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
969b5792cf3fa442fbb0016b3f1f2050

SHA1
d3338aa439de306be86c131fb9a6992eff2c2de9

SHA256
7bda4ffe0a03842667393fe3026684e62bf07c544cff89368f6d74e737529d10

SHA512
e722ecb26d8a7b1a05518a9fb8086699a4841cdf7d2bdf515a3bbec7b40b6c10fc1e6138af531723fa2a56b0239b88558d9872b22957a24af78a79f8c3858298

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3674d8cc235eb0fcf26cd519aaab3eb

SHA1
5afb6e8910554ea33ca3cde516d7d3d55561f229

SHA256
0365d9acf17d2f8eb98b5fd241a427571c41412ac2fb99dba2b69b7b454c46ba

SHA512
b7a5f25af25f691fd48a83b3e58806436c80a865de0faff991211372e5b2bb298bb80d96d2707795278e535150628920eceb78debced6668a406c22a731671b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c4e22aeff54047f6f7e1c8d40e3cac2

SHA1
8c7e7610e7c266deecd3701a0ab3e0f321a88fb8

SHA256
90128cb5fb3356d2f4c83d2d1eea44e78951b52e040f0c454f0e7b0ae9bc3454

SHA512
b5c6f378584d82e20879cf377bd63f23b6b7a0938d5a664960ec8a41b06353ea43f10ee985817033548084e6acc704c288fdbc0e991ee50450045fb67b8083be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27a540813ce5e4632f07a42588885924

SHA1
475ea98065a5c1f578423015157fc138abe3b753

SHA256
be2791e984c5ebae33df6684841e15cbe66e01f41eaf80df311839b9fc9fe545

SHA512
5ce514accbd9bac005bda845a1fcbf4ef959c9d1246e938048cf4baea59e8ef230f580506a62fcfd1d8d30d7180e714e451271047beee1cc386921bf2ec8405d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d05a701f40f9273fd8cc1fc946ff7b16

SHA1
ab2fd3acf2a6b8fe3fb7431cab4db17c0c72f198

SHA256
afeecef79b505ee245cf88053737a5e6de3a922cf3a00686648b0cf34938a19c

SHA512
e33062133a185eac6951fcd50814dd2b970b181e2b728c35dea36f80ef65cd4625f949c42b5ab7badfafcc430320852d6139aa80946c67b4f0c37c8ad576af0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD81A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD937.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit