e10f8df47e6fd2a2cda85b431d78c860356896c998ed730054ad211b539673e8

Analysis

max time kernel
144s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 17:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06a79e7c0f4653df09113e879f15326a_JaffaCakes118.html
Size

10KB
MD5

06a79e7c0f4653df09113e879f15326a
SHA1

14f6be643bbfabbaf1d4b48fedc9372aa4782cb9
SHA256

e10f8df47e6fd2a2cda85b431d78c860356896c998ed730054ad211b539673e8
SHA512

4bf7e8704cab966a2380ab8a9d684d9f8a12504d675642a13186acd8107f7c589c68fee9e9267458d811cae238380f3010a08cb13f96794967cd5ae67d724af0
SSDEEP

192:61+/EbKPbbfydW/u24wM8tu9XwCS3doQAWavuvCIX1GoC0bOTm6+s:N/WUKsd/optvc1G70bwmA

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7725BDE1-8017-11EF-9EA5-F2BBDB1F0DCB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000003243d2588fa1aacc4287a9df4e41797f4c8763d89e46f963dc066ed20547d32b000000000e8000000002000020000000579b6e3ba6adb69f5ab514bd00bc9f485c3fd7c6a8da76f6b5337a290cfa375520000000df84bf2afea3517bf06a7cdbd4c848a2e12d4a5294b6dba4dc0a0f8d5e18b12640000000fd5c42b65b132b187daa0a959d734ed0619c37ca25cb650c2b7bebbc18392d5a4957d975ef18b1dd94c86f029579eefa4c59e43679e1932e35e5552aa687f2b5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b05ddf522414db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000008013cfdbb13b669b9c4a663bf31700ac671a0a8854e2d2d550353ba875780b38000000000e80000000020000200000009302a2a9d7a89ee5b6c471f757ee6974a24b6c09025350c4d2ab0e5cb661167090000000f395fe6b9837c7db626b03317f71e60086db24eedeb5c24680f5e567906e10972fb255d8205c5d2a30b634f9b537c1a38092ec24be938f848f41b79970d88b5472ee912d074cf2efec5dc4f46cda26d4f91182cb1c13fadc7b6c7c00e1ba9f1b9f6335b739abca0e4b14e6e91395a0271a969872b4182113fbe0b6bdf4e532a641feb8c3853391cdd3813d0a4cbd20b940000000cc6854a13ca733ee463d4756352e5ec86ab550a1a25b54d6a30db567a18242315b055a2eba0e0d9962715f0a935113eb63120904d0c5cfc2dc7a08b4215411c7	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433964244"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2364	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2364	iexplore.exe
2364	iexplore.exe
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2320	2364	iexplore.exe	30
PID 2364 wrote to memory of 2320	2364	iexplore.exe	30
PID 2364 wrote to memory of 2320	2364	iexplore.exe	30
PID 2364 wrote to memory of 2320	2364	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\06a79e7c0f4653df09113e879f15326a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
3dfd82eabcf323d5132785dd9d96a580

SHA1
722a04016d99906e5adfe60fc31d408f75d2046b

SHA256
5f35e4a72a20bf78ddbbc9d35b3a651a720f976f6f41d40ed7c053fb3f0595b4

SHA512
d6823149598be1e1e6ffc9f6fbab5d6c8eb7b064387eda1663800ed2b6b41da15fab73fa4a7859ded5b48bccff5d5dd9c7344a6a3fbb727aced54195cbd25130

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6fb56442e177e9694ca2c4386301256

SHA1
f39ba7b398ffd46941409f0d08465574e1587d19

SHA256
7d9dd16872284181643e4790b6b25c1373f8891e100d8951fe732f32ccca2e78

SHA512
02c0598670ac3fc0e363826f4b6d77ef81414449e5afdfd5122e2e530c259a5b00c3ab7472333310e8dcce136fe2259aa5c5fed0be66f50273dc555f6be574c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d11c7ea762364c9a9cb7b8cb9d4dcfd

SHA1
3b73cac7243f7d308c141fa11921fe5ba0d75000

SHA256
297f9023536fef9caf6a2f42c81be4319bebd561a1f884f4c013a70f4718caf3

SHA512
df451ddfee55859c6a8385da7f74ed2fb9445539a8489b7f7a1fe01e81a1f46876d1ba6d469adc56faf673a9cac809473390562833ab30503954b1b63c02179a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6cf781c11e18981938b9c0d47642db49

SHA1
cd21ac32dc03e7470213709f33bf89e67e017f4c

SHA256
4eff8b7c1f3bb9864f1b77f7c277d5b727dcc33ef06a8ebc8a63f4a3f85311b9

SHA512
31e35c4188f49c9307552038b0d6388a040d9fbdc51846e15a8e89539038a2065a0501babf9471c33f11541bfb44c1b350d038352a92bacb33ffaea5eec1fbd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09ce53d1dadff315a9192d223fb766c8

SHA1
ca5084170beb96338da4563ebac301e964d9a1b3

SHA256
4e48501577e9d47720cb6f76f661986474a7946d171cd12ada0aa8e44e23dee5

SHA512
91209fe88c41d53b861d104e38b6f52fbcfc0e7945de0a7b38a1373ba46a9c2f1e5db17149d9d056b58230c312e028b0f5474aaceec5842d737a0032f41b1f25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
986b41a314d2d7d3b2f6d483ee1758f6

SHA1
9821dbe1d6c5034277993c15a7a3ed0d849ee02a

SHA256
c51277b1e7de38711c2c2118842a72d5d67b65a4572a9d5250f139cd89a4082f

SHA512
03c7f9b5ebaaf3635e82294efcaa7daccf83720c15c9a65aa3ce9dd9b1bbd7c92b4ca7ecf4f598e7548eb7c09734a70c2db13d607a52f21da92d6fbdbd623d48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67905beb78c8f5ac2b616e1be377a966

SHA1
a258f663670a10da7bfa5c6e6973a4cf84754063

SHA256
4e0e59c7f9334338ce0ea6093690edaf16b51b92111624e75dad6e1bb9f87435

SHA512
4ce34f02e22f478273f319d2e4687ab532c43d2c8206f1e351f99924a3a2250fc81386da8d2185cf0684f16f3fe5f040d9e3a1eb367b4a12e29230948dc073e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9ce12a558a15ab233d1bc0873ca1412

SHA1
654cdc8a36c30f81ec7e882f14f877aa83b493a2

SHA256
5e4599fb84aae68e0b7df20ef36f3c80340cda593a087e328344bf992d3fe009

SHA512
ce0e4ae44bc4bc62b397568d1410927a2638f9982d6352919e31a0fa5778e32c8919465ef97ebc97950c44da2765208bea63df4e7c34a07acfc76f92f10f52a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f638351b4799828db5e5aab31842f849

SHA1
98fecc97fb4052d4d5d6e41145d5a6eb38796925

SHA256
9a79338b19a91ab98768349d07646f33a840f73ca11c74e8a8cfdef47a3438d2

SHA512
b518a497731a08e199b67529008f825ce7745cb403912bb6a356fbb27a0a5937390da2b34b3d4c39d8cb0ff5aa7fb6a32a601a2cc2ebdd6b5b06a8224abb238f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
915627844bf0d895bfa6363004399b8c

SHA1
fc91dc59bcb9f09d79a2610cb7670217c51942d2

SHA256
d1eb8094ada7c95bad3ab8abf409fb45b169c73a87ed0f58e5d6248f6ce32fbb

SHA512
1cf37d0fa755355de575315f0aeeb83945802f067f4be37fd4034a892659845135be4b4517f9afe5e6873eaf2a10e3e58b8b4b4f695e3d5e9d5224fe47f3d694

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
585af87f328aa8f40fbe02e4c3b4fae7

SHA1
b617fca75b71c3273040d52dfd36e4f032741ff4

SHA256
99d7d2aa4ad2f134a6a72166956783dab993b98d2502891a9cd16842f2a46a2a

SHA512
0a0abc02f29ddb379e03443a76ca66bb3f8779a59d761446fb2be537023fa884b02a2e6545464c26caf0f11e469777ee16b500c54483f6ef53c8a261595f4747

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e496d0a30248abd06a69147d9d4d776b

SHA1
6d19a45da0edaf418515f3662005c5daa90efab8

SHA256
44c0e13ff062c551f9f8c8073e3a2f867e2989277a65dba41f1c83fb532ac446

SHA512
d2dcf3f7e32405bb225ef9c9b3a919a56c416d5c2f68dbeeb62bf83aee1124b0072b2d42c644553c9ec6d36609304468e91d0b144ec9098906faac7c30a47b03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5d16d91962d95f6cdb749ad3400c97b

SHA1
6adaeca67c32374d4711cd230e4da75b0c071244

SHA256
35fde448ec976f8b3d5892f61c9ea4125e4d0d5032c495e28c18b7c957ba596d

SHA512
e437f062f79cab667f9c00a6024b86dd2e38fa2c2a05c42c45168a6bfa45cb0a910754eb87724cabc7d0cd407807a1cd7b71bca90f867782ef64f6d2ebaeacb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
498add3c273688f2aba20e4cfddd8b2a

SHA1
541fcbed580f0fdbb2f78b3f30eb3e4ab0d9150f

SHA256
a0da0ef151184f0b4515650fc93be2e33395a19de158475aa3a12a4a23822b1b

SHA512
c49e3c79aaad4723c4b018651509a1788f24417da0c57837a70fe2904309bfb442725308f3d36e114819cc1d0137dd36a3d058aa0556c51a20e71aacca810c83

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD1C1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD261.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit