7f3bf2fe186ddf15be037e976f64dfc325a02bd99fbcce6dc36fd45dce15cba7

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 20:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0739eaed6209dfc6478e330cb70babc5_JaffaCakes118.html
Size

6KB
MD5

0739eaed6209dfc6478e330cb70babc5
SHA1

86d5098b419cbeca1d3d29c389e9d49953de076f
SHA256

7f3bf2fe186ddf15be037e976f64dfc325a02bd99fbcce6dc36fd45dce15cba7
SHA512

3216eec56a8d7db348f08426cf0541d2f09f5db43a9256de1175602d081c614075e40287e2319d6844c7578e1d58ce2e291ceb2f506d82c2162e92f99bf8306b
SSDEEP

96:uzVs+ux7/YLLY1k9o84d12ef7CSTUpQY/6/NcEZ7ru7f:csz7/YAYS/O4Nb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf6000000000200000000001066000000010000200000006d4fef58a678a99cf7c0a89e3d31e65cd55e6f727f8194bc033dec99097e88c9000000000e80000000020000200000003c9de27c3a0075882ebcf3b60c3c3d9e072aa02f7c195e66f6197e6949111b2320000000410d12c64f25ac021fdca5c765aa422f1b6e7b02bf28e2d404b2d67f81d1e29c4000000019fbebb6f611e1f0a6a70601ca89b868673419d7c4168912af5c0aac337e06601ab22008837ba8f1e4d2bce4ea1d9b8aa2af90442ed97a2a763d2978e15f6a33	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00361a4f3d14db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433974943"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf6000000000200000000001066000000010000200000004378638d9c820c090636aae0ea46b462a251287361b7cab629ced9833decc587000000000e8000000002000020000000b0204783635820f7a45a17719fbe0082ced600955d3a69863c6f56fcd9df465f90000000bd48f824b0ac38cec3293396a9965fe11c6d8cfa7e2fce86f0c18018165b43b136af29268655742c0fd2783eb1d3383575863cc5aa0d9b4fec884c0fd0fe537b23067cbf4df76c5a9feebbc134281fd457a09026d8c741479fdc12effb3fe55aea07ce148c07da100f2f72551294300550d106b8c6e5d525af6c8e5069d561b6fe1daca22ab968573bd4502d45267e9640000000f92f8ffa5df80fd05d6226c902fff3e6e6afbb6d6ab84f3ab14515c516b5fe139603f81df283fc700807b560871d634050cbbf38b8b2d46c539ae74b33c66f06	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6174E111-8030-11EF-9A25-6E295C7D81A3} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2828	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2828	iexplore.exe
2828	iexplore.exe
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 2752	2828	iexplore.exe	30
PID 2828 wrote to memory of 2752	2828	iexplore.exe	30
PID 2828 wrote to memory of 2752	2828	iexplore.exe	30
PID 2828 wrote to memory of 2752	2828	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0739eaed6209dfc6478e330cb70babc5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2828 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e30acea2a71a73a004e4b75c41cc0c4d

SHA1
ad48209dc6ae9f36a974ebdd41111821d4320b2d

SHA256
308bfdeefb8e81b00d2b6c1dc390e3cde894d24f67d1d1a2d0cc447746e0a709

SHA512
80963e1c5ad78a0e2ce451b51ff004ca8b06c37727015ca8a83d97123474ca152a77fe6188a2b2c089c64a9918dcf0e7e2bbcc73ec7ac21685327fe4ba629bbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96f7a114bc32eb4d445872e689f11f52

SHA1
27578d19b4f666c9bdc48250d4d0cbc9447f212f

SHA256
c4effc35e907e19abcd571ee216cdcc4f38118fedfb3ce040588d6d237a20938

SHA512
4aab129fe1a9ac7198bdac9ce27ad5d4f1bd2ce0697858170a2e71f5fea528c08e8b8766cbdf739a05880fd3b2d66b8ea47b392922f9421f81d90471f55d836d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e708a3f9183d30da33d7010316ed492

SHA1
f52ea9a453f9e957bdb6a0d0e87d7f600a07e377

SHA256
2c7b9e9958bea43d08d2857261d6a3d1710e6c23de06cffe036cb48be0bff79c

SHA512
3627810f86ea9c177898b7516df12252951fb31ebfdea7e6b1fe2e3f928ef868b3ba30572a5f5ee976b876a5809358e8fc977110806884097ce089dbca6bc87c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6dd541aad54933af30551f793e8ea5a9

SHA1
32a406b58eade5a99e4118abf913cfe2372e55ea

SHA256
cd6822dec02602b42eb2a733f85910746d7b8398e78b7cbbd360f3b68a2ec142

SHA512
d6a070c03842f0fe4bb583edb83b7ca1435b22ce0b0fdbfee6d573f61cb5caa953e3998c5e4789e8a1486fcd74adc4bc6d1ba57b5877a1497cd0a9673336d8d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7fac910f333c60c2d51cf6f56ca77ee

SHA1
5dce5a61976ada0d4d18f5b3429c5d620062de03

SHA256
73fc4b28c0b82e3529d95e1ee32fdce11b3bad51e47479a490927703af7320eb

SHA512
e1b54925571a230fd28ca94a9ae79078df383a1c76c1c9d315c79790a6a423b91a87b20de62d2d1dac4264cbf03c2a7dd3bc8c9910464562184d08909a7733ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
840ede001b04017a14c9cc5318844b2c

SHA1
31864df64f292da5ff7a19348d1b3063b764c40a

SHA256
534fcd45dbb48ed8e7df5e9cc7dc55564aafc9976ab5ebdbfe67fe47f8851c58

SHA512
110ae29d84cba56f084ddbad82b503b00f5b46bbec90652630951884791209725b42509266d9b7f593aab871c3fb3f0cd2f8a152e8a5554741c86be66d154720

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bfae65bdd089299d6aa462a8743e5f4

SHA1
78fdd130d10136469f09e5523bd5075fcdfe1f54

SHA256
2d042a920a563712319158ad1176a6e5e2defde0399085e57c2f3485e558e486

SHA512
10f5f5771e4688750aaed1ef9da7f37e0fd66aed40d83d6658f708c088594014008d95205ec783691dbcb4039dda758e6f1e13ef9d5e8fe370fcda45d0afdc6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
544afe4843e2986d8f2eed35802daeef

SHA1
077fca6c11cd38a69b6d86ffcb424aeded1ccf37

SHA256
009295393845175fcf0176d5f672615b2494396d5c3818918290db79c4610e39

SHA512
88e6fc693956104d5d5139d619be94b8d93973af5186a2ddf601e9efb7122ecd1d7a5e405592dccfebc8997c29b7444b36e2852bbd30aadb82eb41f993e8bda3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31a7a4ccf575a2d7eb936f5b10bea03f

SHA1
28d4cb7e341b119e5d55f7db56d55c471d5dd873

SHA256
90744c4ba56f4aec37eb430c5a08325d75db82c1563041a755b07a57081f8397

SHA512
4dea99312d23c3ce0d528511b7f1c7d87ccf464d7f133b4263adb8f399b3c78745945bea8b97e1ab54fe40682e804e93a6e3db82b2124dd3888c8562f7771fab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
304230847412f28b8fb660daff0bd437

SHA1
5581e916e66f878b6d4903691a9ebe58d43304b5

SHA256
912626774c4fbf42358fe1fd9d94eb1f45bde93f29bd9c8a8c7f424f17a91e98

SHA512
eebb5dc21852ea11dd03a698a634d277a78beea9bba63bb3b812174a2815bba374bcd5b736f11fe472ce06b66eefe26082559c2b4ee919fc924a3cea2318e99c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06b89117a75e151c891b643a8b4ba205

SHA1
3034a856065e7de09a41a4e86e60e44a6fa1f774

SHA256
8d009f2923343940b7a8fb69a0dbb451fd43cf4c46e8cef22e5bb38819e0a258

SHA512
a912f1d1ddb724e6e29fe38601472088f76374537152382f51499f1c23ce274245543fc876700df0ae6b41d5cdb19644db380631e3dc2fbfee7aa66118748e36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83722aa34a71c14ac001497eb3a78590

SHA1
d72fe0ce8d51114ac3f35f545be0e8887bbafecc

SHA256
fec5b86c503a1c77d20927c5388e1e4b67c724630f43847ce4f7d3bddce198fd

SHA512
aa2c30fa0e451eaf013da7b780895b62f15cb09b11370360478ec0b9cc16617498d18f0896d889c620ddc6bb40c0af20cf5745214a896834be43299e7b921bad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a850c39e7cbd26d01e6cea6eaef07b75

SHA1
83b4174a7d0a144350e0e6726db2fd7bc1c5ed92

SHA256
275a19b840e150fef9ede70f81890662c2f1160213f19cbf72d19170b0a131a2

SHA512
0bc246cc4b148796ff358f6ebfc66aaa191702d13a2147c17cda953480c128746a7305bdb1de07e5330529f2c95c062dcba68c262595bd16191c7474580a2a73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
973e73523b8c73f7c25ddca97321c3e4

SHA1
1d306f2212aaf3cb3a2bfda7316499aca710e5ed

SHA256
08de8e455ec601db5b0707e0e857c3eb4a9bd4e22af4c1dd492462d5c56942aa

SHA512
7c4c137e900c5900076a1eea9cb4364955c56ceed524ed7ed7107be66e079bf213174a49f068b974882f888cf740c679f36646bd6bdb6c0fc8083c7319f3018b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA7A7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA808.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit