6bfee5604c5e936dff7c91e3bd70f4dd223dbf2f67aa97e198b8eb619e240ce9

Analysis

max time kernel
67s
max time network
127s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 11:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

177ffc9f237e83e0aaaff1995f56113a_JaffaCakes118.html
Size

6KB
MD5

177ffc9f237e83e0aaaff1995f56113a
SHA1

12ce958f9b2bf02d4d53f9dda1a58695a62423ef
SHA256

6bfee5604c5e936dff7c91e3bd70f4dd223dbf2f67aa97e198b8eb619e240ce9
SHA512

24a4d103abec52ac71629d106dfc21827f3ea0cb72df6dfdb326c8f8b74b6643a018620737e7ada6847665d38a73372201f71bf9bf51c5167f32bf66426eeab4
SSDEEP

96:uzVs+ux7W6LLY1k9o84d12ef7CSTU5KcEZ7ru7f:csz7W6AYS/7b76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000e1daa3d5ac3c27bef9e5f35bea8d9c8c88588af15249df5a16f2c35b67a5ab8a000000000e8000000002000020000000c2593317cfb870b9b3371aea43754dd7cac9198c81d50c089c9db6c5df8baf1e200000003dda686d9969bebc59af7fcac518ea84bb1b673d8a4fcf6debd4e737b547780240000000c84eeeab8f22a065bdc05707d57c55b3f59cebed5f4c4891cd6154e2c502de41befa42bffac266f7537346b0d33e171114c11284ebf4d8b3ad69e478a4648b54	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8060a1ac1917db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434289531"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D675CF91-830C-11EF-B856-666B6675A85F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000cf100094819e5df6f6db75949374072670735616d4bacbf7db7570fb164c8acf000000000e80000000020000200000004a51f88024b97895520b404724b08d22e515b748b3b3f538bf9e1c52af9fe996900000003c12cbfe7bac2874bfb7a5f0491a3bcff584eacec581f0b2e8dc7db00f66b1e7338e8c58ca30145419e45a3d676e0b76f5da873e49d1ce59568de2f559172f4a7d7512809ab4e1433ab9e33a8e7d42ae7c6410c8e6249a5ae3c57f727dae61d257f50ee9127635b77f1f636a25702b762adb191c5a20d94bbba5f411fd10139532044091065f86ebe02f6c5df667052a400000004a8d3302be81eb0492485d4a35ef895b1c30ff06c7c593e560460f99028be461afe21b8204bc09ee360ee11ac64f4cfae3fa5542ae780080e23fcdf99282fc42	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1744	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1744	iexplore.exe
1744	iexplore.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 3012	1744	iexplore.exe	29
PID 1744 wrote to memory of 3012	1744	iexplore.exe	29
PID 1744 wrote to memory of 3012	1744	iexplore.exe	29
PID 1744 wrote to memory of 3012	1744	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\177ffc9f237e83e0aaaff1995f56113a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1744 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8c7e96f25b040003dd67c0b9a088bf1

SHA1
f001965cb18719f6cb34e7deb6ea5c7538c5d70d

SHA256
6aef9d6f7d0bc257a0f66edaaec2eac38bf5936af9289d5177fa739fb9c80ad9

SHA512
8c6d95713db8931dbae1963fd41692e1eed3a8cb9f61d607ff69896b640bbefe4cdeafcac7b8b4efb5eaa4e8a5b409b47e4b0b97f5bb8708bd53ebcaa17a96b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2637113315cc77d11d97eec287f48333

SHA1
14230e0bd17d65a19327e573234cc2429f42b2c6

SHA256
2bbdd4d33e87e3eb6d7e86fe73f6a88982daf68b7dd2c5e123d2b8cb4e2d9499

SHA512
f47e2c3e7ae4de925e9716dc733b329f805d94f59def37ccc234106dba9975afc2cf337eb04752cc5bed68011dd270b9194ce78f3023c96c9edc191c2fb9c6e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ac9e92c62040d2bf1d144eaf42d9fc7

SHA1
2cd5401af3baa7318deb2f7e41661c6fe17c3139

SHA256
55805661c89a14342be09e3a2c0ba809f846a922fb4ab91eca4facce6691ffbb

SHA512
a260bf10f0638bb04e6ad65d4fe918e7be907d9b6f3d1c4c552ab3acaf275477048b4463eaac5e1dcd8908053a13154f225d1989ea465708552c2c913931d185

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61bba9b150ab594817b819da941873ca

SHA1
6721355ab19cadcd569d7c508405fb7106577be5

SHA256
d4a68cb3c87f6e7914e1569de7b93bf3addbc7d1044d476427bd412a9af2f8fc

SHA512
de660b08970d897bf7ad8e3ebc4d91593c562c77f8a0eeebbae777db7a00f5919ec0a5db7c5cf50636989d48dcdc0cde921c49d64988919bac4324dc5c6646a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f5f70330e95948082ed09d9db17541c

SHA1
5d314c7eb548b514166132daeeaaa29196276d56

SHA256
4663711ece772ac86a7e4cb7c1c64d85247a2d8aeebb80e5ae77d3ac3f847495

SHA512
2f360686e5c2230861f7d78b53615e20fca6fe73746a4808c7ddeda4faea429435a8cb2a6f6ce0cced82c25cf8edc38b227c79e5f81bd67def92f747a1a2dd92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
895bf9235eb7f89931dd738d227b595e

SHA1
513d997fd0f0f58211f0faa977d0640516c4ddab

SHA256
0f125826f2bd454a2b27ce093992685d4083ddd147fb5d61c5d0ac81295c24a8

SHA512
7eb3eb2d47e189221a92aab2d9feedc49c5984fd30682cb4d8e1f5480478db0d3afc0e3d020c54129d2cfde6c4cb94bae0e6e4472476df7bdcfe1f721c5ed2c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb239e7a911f90f497157e25b00ca08a

SHA1
56e464dddaab963d4ff091283f2fc744ca012b08

SHA256
c4f7e1450d84960c7601ba30fcd81092a2374fa44e7c5398282c287d6f427d25

SHA512
3f033bbe026771a06f62c7b8f7c4fb179dba8bd5b9c6ee7322c096ddd2af5b96af92c8a07d0530ea8a85270fcf1e661d5049fbff03a065117a726713ff32315e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79c601d6a9141aeadbf809a9428ec780

SHA1
5ca8f8e99200ea8e4926f1eeedf7a2c2ec145554

SHA256
6bdec89bcc0c4c33a211a4c5e705a5fc604c61756ca2cb1c4b3aa5182fe8b498

SHA512
99979d896c6cfc9f546934184df1275fcd6faf1177e19f123a97a1b7a6c5f1c8e7c8aa7e72c4e239001f81e29bbaa5f54322b60b88c60d852ee8af2aea5de6d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aca99d36c64e20f1bc7807e8456dc385

SHA1
b8f7a0f117a068b1c9ebae080810b4d200119727

SHA256
d2c16e670bcd02fd48047348129fb1cf1deeebcaf32b0d04e9b549adca321488

SHA512
b74f34b18ed84bd9d8c4d3ea3e6223bb915711dd7b29e66b54cdfd9e748c3ce89d35780edef8fb04882ce3416a9619d3df0c350c603d675a8a4c2d79de9a2971

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ff35d69ae859c4545f260acce692a35

SHA1
660149ad3e5a77a919a8ad94e77b352160d92432

SHA256
2e6fb6f4d0b7aac758ef6e8e67e3618c37f602a59b06a37c0045dabcbb2cc3c7

SHA512
b1b67f7cca34866b13d46527bbe2fc37e0ff2e740f95f112f66cae68727d265f39c692c28253ca3829cd6857119aef2632efc0786abc60cbe7cddc88a5db12aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a84cc442ff6c673807bb7f3d4f9aed3

SHA1
93d65bae2db569b7af34fabeadd60a5f73423495

SHA256
1867c9bdfa58ab45c0ad4a49ebbafd6e96bd33887bea9f24dbca78e22c679706

SHA512
bedfdb841106deea5364546eb32bb1822bae6d9c84510942edcabf8103d121546173745011df8d468a9949597561076f978de6b8146d581579befdc0b058c218

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
316909c9f39f7750313a351186ed8d3a

SHA1
dc7fe69dde0c865dcdd4f0862be60a6b1d344a0a

SHA256
4758479680aac665b007391b7b1c13ea3301ceded715996d704b6ce14cbd5215

SHA512
ee9823f3704732c60307842e3e983c345cd230c3305b41d377fea950708aa606b4e9cbf5044da42df16ddd4d81abb4bfaa608255369f678f51f2201ee7ef5962

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f87d4162b11bac07f4fb76cfbe15fd8

SHA1
4bf6b0652e15c45d2a8f21b59856ece14d8d4343

SHA256
adc1ca436e0015389a56a5b1996d0b651f03f34c1db8c46543f440ca35682747

SHA512
f86762dc109ce55c15d65b1a8a7c5d14c62d0da7f18eb38de3d811d48919792b4b680f89be23a03f7b6d6b69e46c45c4a5d75dfed2e6583e6994c9b4f1ca00c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB38.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBAA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit