a5a750806085faeec23a5b20bf13b0ae366dffa27c9bb88715ad7414c3e4dc36

Analysis

max time kernel
119s
max time network
140s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 19:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0707dc6cb0325720e14facd33cc20257_JaffaCakes118.html
Size

53KB
MD5

0707dc6cb0325720e14facd33cc20257
SHA1

8dbe653aaa80e127f482f7bba120e4d2b3bcfb8b
SHA256

a5a750806085faeec23a5b20bf13b0ae366dffa27c9bb88715ad7414c3e4dc36
SHA512

3f3e42fbbc336e88f729e01bd788bf0f62deb11a761b11cb2d3b841fb0f7e72efe173942a95abd3a2528e58188101d53a4916b11129920a9467cf1830c848d8e
SSDEEP

1536:CkgUiIakTqGivi+PyU7runlY663Nj+q5VyvR0w2AzTICbb+oX/t9M/dNwIUEDmDn:CkgUiIakTqGivi+PyU7runlY663Nj+qK

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20e625353514db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000ec96dfa6ffd52926ee562501cfeb3fccc872e29adceaa7088644cb847423bdf2000000000e8000000002000020000000d9e34c2e5050bef03967cff91e6e785e456142a9ae56fa7a0e36164d5adc0d392000000080c579bb4d4b16cacee7f21e24da57dc9aa8237aefad0fd9e8d630ab8d9cbf7b40000000d83cb5245dad5f12fdbb658119a8cdf43ce03a56acc7c919c1d40e7147cf79176da41a57f2e97fb580d6a0876e7a2fa83839287c322e1711d25a5f8d205dbae2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{590ED471-8028-11EF-841E-F2DF7204BD4F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433971506"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000225e983d728d3878e27fb646de82840d3204c8c9f33143458007466a68a8e507000000000e800000000200002000000034c36551e4474296df65aa1f93826daa565df7a0e5cd7d840840baa20bf6d16e90000000265b5d5527b961467f83ac11015c657f0c8b7d75b6ec61e416293545bda88e197f29be3a21d2c28e8443d843c14aa24074d18be2a7d44543841265d376654cd04ef238a4ec70b01755d9b720d01888939bf94089023ca22b809e542549c03fdc5a3c3fbd4b0b3346f359ec336a1248a15ac4505bca9f1acf097fe00a2a191b6ffb544d331f40de594fe4e7db875189f34000000066881c3df8a28393a5ea486aa3e9dc026b7da8f568e1bd1f8f0c09160d2a4e81961367c3ebb3fc314d6502aef2f030ecfad2d3d1884e59f1d35a7d680ce13c52	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2896	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2896	iexplore.exe
2896	iexplore.exe
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE
2972	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2972	2896	iexplore.exe	31
PID 2896 wrote to memory of 2972	2896	iexplore.exe	31
PID 2896 wrote to memory of 2972	2896	iexplore.exe	31
PID 2896 wrote to memory of 2972	2896	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0707dc6cb0325720e14facd33cc20257_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2896 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f53022ad33bc8a3d7a1edf34df776b6b

SHA1
44493bf0701b89017daeb5f5ce72b2a07815515f

SHA256
90df005eea9989f1bde648020f460bcb520ee9792523c4cb030e59cebc52c9f0

SHA512
4530149bc0b7d9c1f37fb79f75ecc8b14d9941509f7994c15e10e9b0b34ac710f6ecc4449dc5d787970d39c4debb9c0cc2674a2b0863f259a856cbc252490683

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
809c770ea6dbf88acdc93c05caed8e53

SHA1
a9d84cdfb8d438d57148e21cf9bb4b0616b74479

SHA256
82e7491a0f903079fab2034a10a44d65890860525e5e80251f0207e8f69c52ce

SHA512
625d5e6679d531fb40e437481a3a4a1cba154976c0c014d8070deb4edbc08973ed6bb1c947d485a70e1226e1f588df91326d42f4eddbc0983a406fdcfafc6c66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15e96e6db84e326579562e9fa6cb7f7d

SHA1
d4e3390d9e654a64bdfeca75fab37f3b76cf53dd

SHA256
fdb7db92039da248b5b15959b93cc0c551f85e09115e37e5fb3e04d0b3b47f42

SHA512
0bc91bc0b35c25fde225dd70b2523c53e6b42bef51c399fafc7e61dbe64aec68d11f48da1c2812780ac340f304ffa171d56411e62854020b01c73971f76393a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f7b5b032595fc961486bd7259e40c07

SHA1
5021b271c6df976af6a9eadd2350c9fcb6b904f8

SHA256
b00f9d22a6fba5fe29dfed49d03e4d7732f84dfcc5b1d0341364b0859fb0d8dc

SHA512
01f524749980373ea6aed8f38ecef6bff385ce8b05e17248d414d05f3981ed078279bbfd690f089c4886ecbf9b11924e29c80471d231c3b58cde8f482d2307ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
055c98ecbbfbcd98abd5d6bb5dd97a72

SHA1
aa3c3967b01d11e7659922d4146595534bdeeefa

SHA256
7e96cf5c82504ce9ffe8f843da5e01904063f63fbd7e8561c53374a5646c2f56

SHA512
8b3d7b4f9bc6cf78b3e2a0eb7820d3713a3eeecbddc25feec76d4a337c6a95024ab80dc55df97fe955eaf7b7ae2abfe5f5a810dba8388c9e544f84f1729799f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35ca302f4bf98ab8c87ddaed36ac3911

SHA1
ea167691db53094165b506abe838edfef908133a

SHA256
e18619b73cdb437341a128259697baa55229c84f44b484faa19a13705d75cbc4

SHA512
09f20e6bb77f35a0d51fcc06034b78437e4d35520faecddcea630661fe56e7a1813454e85dda8066294ff77d37344f022b1238d0b8999bed0c69a39a09a2c017

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
554fca6e26baa1f2061979fd8a087009

SHA1
a7dd4089a354896adeefdef3997910f9d5b6f1d0

SHA256
2911a2ff781bddc9be38ecc4b32a282bac5c0ae9db9433540b5df4222bf4069d

SHA512
a0b56746dc200136f26163569ec681852dfc6d30e983887ade11c85e63a76b07f494137a851f24aea1df2cb3ac982ca671c25e45e846678b662b39a9de673aaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b11de7332bc0d93cb5b261cb50f103a

SHA1
dec74f744388b82cae1a2cc4343fab5a430d8911

SHA256
4ea308b746e4da2c90c21ea063c11a45ebe757ee366f897ad617bcf45800228c

SHA512
e9ea8eda32bc3bf20349f2dd2bed294715bcb45cdf9f45fb0154c2e92509dddc054eb047f4594c73d9a3624868ebd1fb50da718c482fe5ddad98e6328b8aa393

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7b3be8a3607f7e21b6d6bb5a2ce8355

SHA1
5d9bab472dc456335413758d36ef6d3b110f2c1d

SHA256
96326f8c08976cfc10c010b64776df6e3a772aa37349fac583523788d1af6042

SHA512
656d6d667caad977f15ec2600774e279dfadeb2cec9dd8d0e965e7c859dc33d3440ce180f33c9217212d1cd196d4a5460d7f7452bff6716cf360f2f8d0cde365

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b45de9bc45d01bde9943d7896984e62

SHA1
551baa6986cc5bb27245af3a7fc0c020dff7944e

SHA256
999db33c9eb847574c17cbb0df4bf399d1ccc31f59276fff2400bf2c96d21e1c

SHA512
2cf4c61f99bd343b473dd05eaf20359af4115143859106e5b89bb00e79723916af785188768471a87b0194bd1997727cc42103be7028973f471fe0aa88634593

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f90a230efe72c78012254c3e0280431

SHA1
87a4474a1de802a4ebb4634ebf9abfbda406bbec

SHA256
10a85903e148b5e240295d982297c977375a97412baee914be899afab51aac02

SHA512
e5e75414b52bd57476854768d7de37bffd612fee6c8b4d76a2336f9663ae9c3228dc1c7b8cc7dc035499f68c35a285bf236560ae56c5054c2b06aa3ec476afd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e1d75709563fca572cc0fc6acafbdae

SHA1
5b66f88096b5bf9f126cae48b12a3bda91785c95

SHA256
6357d85f6d70c7c5773ac8352432e5c76b799c53df8169f1199a682cd5586b2e

SHA512
5b9bd9cb7e53558218d8901a3136d3f4b5ab1e789ce476b4e598820e825987855ada9eaee00d5c5de42bcd1ac3735dd5c3f407dc5fe9158f4a9490b25473c84f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8297207d0c14d1b3a901c32dd3f7a752

SHA1
b811f1512e5f19dc2e8dae1b51483974c7f40282

SHA256
98b6e80d930309004cf6385b1477396c0cb0576acff11066085bf0c165c36ff1

SHA512
f93d7ec89b7ba3e30ba063340e21cc526ef1397eef779d91d851823d0795dce56dee0c331cf022b0c7ec474d4865aadb1f8aaaeb9ca8c3b6e84eb4212fbb2cfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1b474da91f4dc5c14f43474f443bbe3

SHA1
296f1746cd653a0b0c078adfaa11c8d13773f341

SHA256
8565dd919bc51140caa964f89ec0b9b7f4a1de8aa7eefead0e462e4d4077a796

SHA512
2e06ac5be7f478870564a4cd19e161b111ccdf3f5635752a2ad9e35658bb72864a265099a89fb76e3d12faf188a7142b6bff70ac17939242139c2e2785e1d6ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9fa31ead915e4f389897862ef852a3a3

SHA1
740032546a2d6fbba0e08b54fc842b2d2f85e365

SHA256
cfb716e1c85cffe222a4bd5e408ee91b763f1e9525e7e3ca6eb74ffa7dda7a21

SHA512
93f0ebb292ce09b9a1b8f58ee37aa01224d06a503461c49de68524111c8c1cf7f5404e6323d6dc6ec25e98f73729612afa20b39e54b7452a05977c52f1724d09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WCATT3E5\wt-logo[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1A47.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1A98.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit