a0dd341d03d20ef790267818c1f16ab0b5f073ab0b77773a81fe572eaeb62d69

Analysis

max time kernel
142s
max time network
143s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 21:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

107ec3b49cea812a4a7a52fa52288aaf_JaffaCakes118.html
Size

74KB
MD5

107ec3b49cea812a4a7a52fa52288aaf
SHA1

07c4c8bb21d681c17b545504494d23473579e4bf
SHA256

a0dd341d03d20ef790267818c1f16ab0b5f073ab0b77773a81fe572eaeb62d69
SHA512

0b4a7f9321da723d038f32b20d2f92e461a818839b8773dfdd2d73dad95a3ad08f675143e16c521745dd49ad790c846cbe2e67abaa5db9f769dcddb6b30a5980
SSDEEP

768:K2Dqy0RUujRUuTRUuRRUuxpeRUu4NRUuwvO2KRUub7RUufRUu+RUuaRUuHiqd:K2Dqy0vjvTvRvnevsvhvb7vfv+vavHim

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000676458b0c93b2dea911be2be3ec34764cae442affd4db7ebb9dbcd24b3f97ba9000000000e800000000200002000000097bc6b89cbdff8fd4c1501de3568da8d95fa73742dc1c723fc2c672e65de98a62000000023550f1ec5e0f7d57c2842ca6d0c31d673d11fe5d544fb47e26c8748277c6470400000004dde81d348919a1faed2f119eaeb5a5f6ab15776bc35f4ae30f2a907723a8e3cb9322af3877cfb250b2898b7c4e5ddf8103d7a9679d23964762e9bf7f1b69616	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000894b5c27fdeeb2d47fa3095aa656d48f8977ff04e45bf54bb872457a0e5d885e000000000e80000000020000200000008201f5bbda7736965d250736ec110ce2de72dc1ab18f602880c7333fedf4cdc3900000008fa669633b6be81e188bb0b87cd475cbb037e873db20a631477a431fb13e26a25b5b787db7a26fe8895f76fc743e54d43c284b9fad93e17d4e6b7627af8728f8b127b4f8d8ebffbf6b3b343fe3c8f98d22d7c9796864f2817e00c133c60332d7be56f81f44a06f2bba11375e96f9e6d0e74af6953c9e21a0b87c7b9698249dcaf83187c9373210b694b1c669167a41f1400000007ee304a86163b71306c8f7fcfe138e08734b46e31fd6363e426c5ca16704e2e3e4d6aed9c67d2e90a281268fcb9248143ccb659888c9fcdac7541dbae77e930d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434151238"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 501488add715db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D83A6FE1-81CA-11EF-8E54-C2CBA339777F} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1884	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1884	iexplore.exe
1884	iexplore.exe
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 2804	1884	iexplore.exe	30
PID 1884 wrote to memory of 2804	1884	iexplore.exe	30
PID 1884 wrote to memory of 2804	1884	iexplore.exe	30
PID 1884 wrote to memory of 2804	1884	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\107ec3b49cea812a4a7a52fa52288aaf_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1884 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
aadfd708d338eaa9550e8223fd568a75

SHA1
a2ed29884426b8b556dfc88154ea46fb6f9966b7

SHA256
abd6695fe8db9729600ed9f1fa337d8124ed6f92529cb93eefb3cb73620afbef

SHA512
8e44df94094d8959c41454e818f0e48f888d4330e79dc01b7048149166ec5488d411a7ee576c97762fc47551aae5c8f76a122624b9f77f808a83f93d65ac77b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5da53cb86404274005fa49cbf38d833c

SHA1
0388ad568cdcc1056170fb7dbe20f23e9ce65d09

SHA256
c01b3ef9bf612038d2d4180dc53f84af53c84b32b1b6c55f48d4a2d5918f498f

SHA512
e205167ccb8f0c3ad653d4b8b50d9e2d4ce9143901548a06f3c9762a2af8ef1e09b56c660bc516fdb802dd1297464a1df3118175ce27d801e17f081208a6456b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c299dff07b3c327681ea0237e6a8a45e

SHA1
f881d29023c82d44b8d01e7d22c3fc566ef393cd

SHA256
27875fe40bfdd6905a852ad6bc515cd1a127dc9dc52352c57e778f34f1785b48

SHA512
982cd83655d65ffb2eba7b6ae58db036d3e94bf1dcc397d6f3c58026ed68e9c4e397c3a7b6eb1adeadc754b4be97976a6de4764b1af77af70a31534ef62800e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ef2b3ff347696d12fe70c0de9b309c4

SHA1
cea7925fc2784fadfa20dec14add6c9e7e24de2b

SHA256
53731652b2e593f4c3b17bf352f07216f2269747a733343b7f22952024c7f41f

SHA512
cb8da035443de2215bd49f1265f42034040b4aafa146454662c8824e41fdcf7dd77e7749f5e822d801e99a3f61ca1e5e5ed03f35d5ae4536913e8d66b259314c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8dc346fba2a820f0925ffd79b24d5be0

SHA1
b5391d3b140ec3d29606e03437ba79624a385088

SHA256
cc58c01757e0b59e92a2e977eed78f974a08f3196b073ae823d4356e9dbcbd6a

SHA512
d79798d5cd12af8f2206acac839b3a6abfa1d8504d95f019967a426a6af002aa1fd226545cd97bc38a216913d2dbadf974f7ecbf30da65659b41226810765b8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a7af29c61fc14dbd1dddf225c6bbfd8

SHA1
75f90f728d5cd46a79c9d06ed349f2200d93203f

SHA256
2b5bbde0aa57dfe7e05058483fcf13f5a4595d34778eac052d85469b1155a522

SHA512
2dcc2636b6034a6c2fa57ec50c635ae5f68cba204786867c26e77e764331a251fcba4bea330570cd0691a779cf519ecf17ecb247b3f24eca9af4837358eb48cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9243256155cc5d53a401624e51a0a984

SHA1
6dfe642d1466c7b8f2aeac0829fde10d7e3bac9a

SHA256
78c755d965c37a9f033c34ee589dfd474d37db8ce0917ce48076cf3976c3e931

SHA512
55f7f28b8b2ce0e027b85adac4fc4c35ddad1ce232c337c884c8ed7b5ffbefc7a2d556f9a8cbe44d5c3894da2e956d2760485e7671050d145eb3e02fe354c7ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9d4c6c2ce56f94837f50e67f2796951

SHA1
cd7c994d28992bd510e8aa755ae63a8c15346748

SHA256
5ab9688d847b1a184ce3270bf8ae7bd2aa618bbdc9d604a441ca97f4bc520cb8

SHA512
a13976e9618eea6060e405dccaa1a2008482e15a15feef954ce1dcbf08cf6b0124c7a862045a08cfae5c3fc3a99269539fa162e5b99186e88d8d2139aee7406d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26e12e40f3d2654e8198ffafcd4d7aa7

SHA1
24d8e399eb7a05bd885e22acf5e38a4bdd636222

SHA256
9b20cf7fccdaecb80a0bfb758ff13dce443e582260462a295ca302a90cd698e9

SHA512
641a7241b03b0d0a570ab1ca31afc7c6e3dd51289fed1451b30aa06de087b1cddec5af32c74275fd262201d1b9c1e0a688e726760e91432b8409441bfdeb9585

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4739a1134d0c7552f4efdf47b6cde43

SHA1
c952c3cbda94af60328b558549cc958747e24688

SHA256
52f2c8eb07bb8bdcbe9af30c3c3925295d07c9e13e7eaf1cc0b43540c0969700

SHA512
9b2abcc0e63aef6ffe68f3fd6bfa76069228cabf6ab5c5b42632971bc8dfe7e18abb6ddd77e99376536f1bf752bf43ae38d445fc043c9b3f0da8aaf34c60415a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6729c6845cf9da1df9fc49e6fae70215

SHA1
3e152f0fcfd22a31ea564ea9e26a5edf4f3d098c

SHA256
67d88757af8c1b9dc1fe0fa32749cb6d5c3868dd7968e832accb80bf954cec5d

SHA512
7c39e12d5bd7c1d324b49a7c75f0fccae5b8dd4408ccae7facea7388c4f202efea9393e06a8958c841419564c07a9e928df3af3ae35d237c67391cb891e81699

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b27ea873414c95716750855e9710290

SHA1
32fbc8e53e574cdc1e84d838c06d8c05974eb01d

SHA256
dd6e40374efbcb3c5e2f98e4935c39f92ace51aeee2d4c3906939978e63def05

SHA512
dd20b410726f9ab658805ab9e27bde1eec22ae3739ce3a57d6482cf598bca21667fbba6041c6fd6a734bb971c53337df5d1eca86ef67ad785720e53798e2f0a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
2a083ee8541b2b6e8585307ab5baf963

SHA1
39f8cd006f9c718ca6c7e9bf4ccfd1ae6123832f

SHA256
d0e5f04efafa1647a391338635c801461dc47c4ffef68aa5a16b10b214b82862

SHA512
7a2d48057a11da5c4293e11ad900526092fc03c34d77b800919b7d5c67064604a302e37f99f18dc0cda05295f4c1b35adac8885c9121513d938cfacbd97b1ada

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
8909eb796d77292c5c013b99b6227dfa

SHA1
4d08da303782c5de09ab2d2c8e0899005af4162d

SHA256
4678921ec6f807d5a9c9ec2bd578ab9f316aa6553debf62b0313d176994cdc9f

SHA512
3bf21c62db2ac252e4c93cc297d08ed608c1fb181e884b815e321cdb84a451a2782d365734467bdf76d255296511720cc324a5790dfe988dcf64363dfb8f1933

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4700.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4712.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit