78c456e157dd60c151e3dba4b280c0482edd34c56f7699ea0fb566de8e96d334

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01-10-2024 19:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07097830b51f251ebbbd277fb7dad1b2_JaffaCakes118.html
Size

9KB
MD5

07097830b51f251ebbbd277fb7dad1b2
SHA1

6f4df8acfc11bde7f939e02fb514bed499f34f6e
SHA256

78c456e157dd60c151e3dba4b280c0482edd34c56f7699ea0fb566de8e96d334
SHA512

268f4b75dc3588762d11c0b2c02926c5c35abb70157fe4741456c412c1fb2d0336ac6dd41c928d292dd89380140a1ba232b16726fc337688b07b111beea7cd01
SSDEEP

192:rvUf0uC/QrPF+pcpyVZXzGB2zZTiZYjc1E:IVUQrPF+pc0VtzHNiZY4C

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0af9b793514db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb470000000002000000000010660000000100002000000066b37ee0087e6dc9f1d9e304c724439c1d4e9be5b49fee7a8c24121976fb7fc1000000000e800000000200002000000072718ab22ea74310caba08618b462620a005699632def9d1107fcb0e54187032900000000fddacae2f8fa7c4730cab12a38c1530cc148d906754fc9bfc9683a0c209e5754af26eee72047c7491636473cc67599c030b34ddad356e3a8baf326080f54707529eac018ae2d3d97310b623eecb5f4c4eebb0592888a947d2060bf63ff953fb01f1c77384f641cc33c5ac33cb695c87b7cd7f6b7c44c4f4eb80648733d68fd0858e71613fd92b428dc8de7e6f361103400000005fa1655278288044b7ca5c6fd4a8022d2c3279353d8e542229760af1c88c64bbdd2b88617818264003c58db678195e002b6b525f08e2cb221f0edb208fbeec73	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000002e6e5ea6f13975c8021b55ba98a18949ed72f6ff20922d921f54cded565668d7000000000e800000000200002000000033e85d6159da537636ab538ad36fc62d9c5798ea61dc786186980b154a93ebf020000000e2cc9bb34f402263063622c23615beef127ef3e93c40226c1380756e190bcce640000000a6147d46ed7fdb72259b15ac20ccd90e8dbe7e1eeadcc3e509a04b51c4b281c60a8d5435cb33a27b8132ca61f4a53def277a41787fda2770f229dce68e47677a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A39876E1-8028-11EF-AB2E-FEF21B3B37D6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433971618"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2248	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2248	iexplore.exe
2248	iexplore.exe
1720	IEXPLORE.EXE
1720	IEXPLORE.EXE
1720	IEXPLORE.EXE
1720	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 1720	2248	iexplore.exe	30
PID 2248 wrote to memory of 1720	2248	iexplore.exe	30
PID 2248 wrote to memory of 1720	2248	iexplore.exe	30
PID 2248 wrote to memory of 1720	2248	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\07097830b51f251ebbbd277fb7dad1b2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae7959fdc5f37fb3abca24899442fc4a

SHA1
29cb30d92d17830629c26b5c20f1f62f795ac5c5

SHA256
9da4ed28e7aa180b4b188749bd8b3dba98ea244dda1a03182cd25d75c75fdde3

SHA512
77078329437edd077e73dc27676af49a550b51926c83d3fb04ac0f556045dfa5259a0d339fdf8b9abce7af7370fe8d751452a4eb920289d41a0bae057bc66674

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f11ffd4edc9a40568851b356cb0d712

SHA1
51dac48d9eb954398fe1eb9a3dcd8b189236bdc8

SHA256
084e93d77da0638bb25f219bc2b615389e803fe0022d52399118ae0e635a1c78

SHA512
1e411f98921a6fae67648c233c41d5fdd6422386e14af6e7e3a6ceea059a55d1d354d0bd2b87eb595b4033a4604264341ef50f6dc96f1674861698df53146926

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
240c0dc226dd9d55bb26e45cb79745b4

SHA1
8867a9802bd1a92b2fa7ff0f6460aacf17207b4e

SHA256
0593976557aa26e2b50df74d9237cb7432cea629c3d9406a4d71b78e0e15b401

SHA512
07757b9348ef9732fbb74897c93e8f416767ab2952e74102ceaaea7ed96bbfa74c29c6ea7c233f24286e0fe861803afa2c6add208bc1e6ea79e08df870f95739

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
996574dde36f21ee80b6c07121d88f6a

SHA1
2c5d2dff68f51fdf528cffb8f96bb7820cb81b2e

SHA256
9b2b8d49ee3982894722dfc739e307df13214a9e3e4d0ccbae546b2873f17951

SHA512
881e0f4983b128d6f3c4a027078558af73a168a5b20d208c39950d0172ff87bcb87546a485df5c78153ced4336b185a01187baafbe48109dcc00c49a280a1884

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2be74a438c39ad3df44e27c7bff62041

SHA1
dd44cd1421b610b20515345c30db0ffe0cb3970d

SHA256
edd782d852428918ac5cd944086644e529c69bd178f1e012b995c11880369a87

SHA512
a4062e17e1a1a513edb12aaccff881410109bb076c6214a2b356a56355f65d92c32262c6287533af9200a3fdc7378900dd8a3312e7a989be24fcb9ad38c40881

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bfebedff392aa6e0b3d490c29f7091b0

SHA1
3ce69b893eff0e4b7a457db91eb135389932a065

SHA256
c099861ba142bd50ba12cffa9e4f7a3dce832b0979207c4256acea93b3ce7174

SHA512
a965609af18bfd40951c40a325130b8555b50c7d7d6111fbc30e2d3c86b3759bd54f13d47e9ab66ed6680ff7be09785796bdd949629a08ae8e09f27b190ca1b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa42ec2e3dd1b1c9f4da6ff013f71ab1

SHA1
6b1b7a58c7be652bc33fa9119c39e86b518339cf

SHA256
368ac43a134f78be0d3f5cfeedcbed31142971659ab82bc04ddff841cdb259f1

SHA512
e0c6a5f753e02b29a02438edd79f958ed630a79568f767f0ed8bd25c93ce235caf750aef0eec4351ac34ee704a436d041cffdf9b9bc6bc8990971d815abe4ff9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6d5f317d9d6e6eded4f29b748e334c4

SHA1
6611b559d91a67c882fa8380691e38626a9f759c

SHA256
55c44822da63044460ed287435d58daa8dd564b90eb255f8992e6b4f105239e3

SHA512
975fcee5ad24fe3d012149ba120172c442b6aa5e601df5040dd6b4be98e3a4df5c3a3c4fbec078d50ba39f71ef59aa2a68257d84f5a1d10e22dbe00709131066

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b16a4340fdf30d588bcdf193dd25c234

SHA1
d56a6a7c3f3823626b1715cd84519497701cc47f

SHA256
362ee91ba00fd2330c94736675d3db19301b762590e25acc83ff69655e75e2e9

SHA512
093e64b6b92f8118f5528d3da72be607483471d726d734a6fe3ac34651078aee3b6c47cd629a62eb49ba6aa168e000e87050e51c2d0996bde90fbca9c3e43b21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f256249a7eeba059cda869bf41eb311b

SHA1
95f628c76e36b7101d76fe112a04a52baf160589

SHA256
db369cb32bdcb2b93c1b23a029228034d3d58019aba3c6a8e86d09d35ff6b037

SHA512
27715ae46971d4c11bd33238b34e29e5eb22b7302fa46278b64dc6929cf19c9c499a444f43f8fa2c4dbb5b5804ddd3a7b8e3646a0d00d993308ee3a9241a66d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32980babe503829b216acea12af7db95

SHA1
86481ce94224d91605e2b656993be957a820eae5

SHA256
69050c46b1685d759ab39a60ba005621e5ec68b99e63662c2a0a0a6471ca2a72

SHA512
e069757820c0fcf68cb46319b45d2bea84e28657a2fa9f0709f479b369b372ee65a880e1cb1ff6653f914a3059970cc4c2d4047123e5829a946c77a996788b3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac3ae9e87d47113accb82a41ba7f31dc

SHA1
49c407a7d707879fa582059f446ebe74ff052f95

SHA256
7e91ca94280d85d2fa2b8e0685b14a3f3a9eab4094cb8310288cbb4dacc5b9af

SHA512
d5c21f2235d1fc6cd34f0089724ed16778a42e3128027f279ded31b821f1da6346343f91f1881a36409b749562c828319c0eee3c3586a30396ebd168a63cc334

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94ce96fa7bcebd26475d8d0367dabe22

SHA1
59b3c05a2da2b3c36e405478823046b9291ec2e8

SHA256
6259842564a142c1a68f1a94e17ec19637e8df2e4ae02c8507a9e714ac947d6e

SHA512
3ddd42bacce6b874bcfcddb700ef99f7c43d7413c4fd58d871d9b8fef95dcd2b66b3c7b2417f4abd9fcaa1ee96aa6c5a2d0b947ac1c316db02e647b44c48321c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56e184dfbf9f0d1034b2141795c81a4d

SHA1
66dd1da4b28aa18c9b955228af675f728a89db8d

SHA256
997711875541804e4912bc1476582774e9c8a27343e1e62e5968cc7e5e290d32

SHA512
c453d1cc52e120ab375a0e40dad553e1e35608a560576b30bac295067abf03e69edb7240746b3141d5ff8cb871b1adc497c83375bef9dd911c0efc4303f51611

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2f37f15b6c1be7cc71a7e6fa3076dd7

SHA1
dd72a325f58601c3e3a0b13022eb300f6a178e14

SHA256
213c9649ef4caf46020507a927a49dc1970806a6bd02c4e5ab9255420032613f

SHA512
62886af4b4d4434999d2b78cc17bb2d255d892b963b20af59d16058f774ecee9e5f4d3fbd6e2d321aa327d612fcdc67f148e4905e033118b7b4ac519226ff30b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBA6B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBFDC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit