ea2bf363133f04b1ef26d04a889c32e6d9587caaa64197eff487f36c762050e8

Analysis

max time kernel
90s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 15:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dab529fc1152d4289a5d10e1b2e5c1f7_JaffaCakes118.html
Size

32KB
MD5

dab529fc1152d4289a5d10e1b2e5c1f7
SHA1

6a8ba5b1d16df55ce74a2e8356703b97450af9bc
SHA256

ea2bf363133f04b1ef26d04a889c32e6d9587caaa64197eff487f36c762050e8
SHA512

b5251723fa467e9d55b78e263b5aed31a33e3d153303465b30d53fac7b24c75c505b3ffd286d40180229ce4a29facf4d736c2ff3d81276ab0c1c352318340cd0
SSDEEP

192:uWnk5b5n9tnQjxn5Q/gnQieTNn0nQOkEntcanQTbnNnQhMC6AESgphIWdgTrX8bS:nQ/ewag3I2qrcrsRAWqB2Z

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432232225"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000eb1614ddf3e6b22f7a1ecb4c74b571fc10d0a69364b9755882802eb1fadeb71b000000000e8000000002000020000000afc50c982986a0e1e6c98f6d9080263dfb787c933e152e3be790ed891914d3ce20000000cdd794bd446b2b41187ff8b192508e7eb4d1b7291d512301e5987f7f1bfdded840000000dc33727c4ac5700927a58c995c2f9d419fd1d650f59e8e8187a9a0f2f8b77369381cf103f1c2cf36c9b5e56e1bf3982aaf73575eca23144bb3a7bb067c8bae7a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BF3DD6B1-7056-11EF-A0D9-6E295C7D81A3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f05463956304db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000de2465dddd8d93f5da1a7a577a636ba06319c3f267a99729547efb04c9c9a49b000000000e8000000002000020000000a714f2cca74d339cb7d3f93b175c656f4341d3de6a43542d3125c39aefa37aa19000000087a68acbe2086398e4cdb98b97a316feb7b110bb31200fc4a4b3ed4b492541998f3c24e505b6d0c2bec3724663b14a02f42c987fee0bc8c39801fdd9353aaa97d08f297c29d146df5768e3954d3661658c7c3ca8f11b298dc63f247df19d4c3f9669ede857db1da4b89ef7ff1ea748c9e3c77447483249adaf40eb2f7304681609b8d2fae6ad4a4c2cb2ff6ede9bd649400000004d752d5712f9c35b1e8c58ec7ae260030a7c4cc9dda0d34aca8c3c85015e2462303e2f0dee872b0ac9b48b3fa29215ca4ff0fe8d2334b574e0158a2c1d292211	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2716	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2716	iexplore.exe
2716	iexplore.exe
1964	IEXPLORE.EXE
1964	IEXPLORE.EXE
1964	IEXPLORE.EXE
1964	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 1964	2716	iexplore.exe	29
PID 2716 wrote to memory of 1964	2716	iexplore.exe	29
PID 2716 wrote to memory of 1964	2716	iexplore.exe	29
PID 2716 wrote to memory of 1964	2716	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dab529fc1152d4289a5d10e1b2e5c1f7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2716 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52615d00ad5faacd6777e72b51a931ce

SHA1
dc70e1cf7217d46dd8c5f4cbdc6b601737b485a9

SHA256
46abeec622c42f0ad984bc2ac7c53ee52626a89d2d4a0e6af49f34f64b9b9ba6

SHA512
f7bf3a08a5e6644cb1d5a911b00bf5656ebc72fd3f4976204c5dd705ae83e87dd220d92a80423119921e73dc6780eb59cccf07772c5a0670122eb14443dcb4a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e98fc59d0ed7f97584c997f5c8100e18

SHA1
8abe982a648dbf58367cf7279504c5d533926e2f

SHA256
7fbd39a6835668ba1db5cca50d2785466b52f94228d43d349470aef7dd1e8a1c

SHA512
72d0f703d74a79931d979b77e3451d866f1b31d843899401932c28ae53c80cb2bd45d6e2f9fcede18d0aa82866e4490225df886324de910349613abadae047be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef4c864211cfe9dbb2dbae7abf43ed1f

SHA1
d1af82dc2e8980b4ce644b5ce793516709bf63a1

SHA256
d3d05ae3bb5713342e405726c28b4ad298a800b941bd2f5cfef5ea19c920966c

SHA512
916f9997c9aeef0316b6a60f676afb4c8136633e53ecbb1f02ee589ff3ed641c95dffe7dd4bb6644b8d66837b82002092a5c30b6adae47d287c8b44eb716b106

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de10baa7ac9a29a84510e1ba59e22c18

SHA1
3049a6c2fd3162b785386e028c211de86165b023

SHA256
036dfdcb55a39101a552abb5415f5640363a515190a5551cb73eade302defc8f

SHA512
fb3281ac38ed1c1b4258f52b4961ff605e3ed5fe3cc432a535d1ef8c546f4bfed3b9361d451da4a26f2ad162341eb3bfd8d5bab4c65313c06234506d2b90f495

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61ae4f1c8931770fb74caff3fe65b5c9

SHA1
bf727ba699bf18cbf8c82d21309f589fb7349bfc

SHA256
7fa338969c7f1c697879c13d6052ea3f72a88629503c96588f58c7393983c729

SHA512
c75900f67dc2ccf6588bab92b1ada6cf7d0454d56ad4ea877f3489083143f1e912b824390f27d7fef7b46937c658cecf1fdf414c2dc9b36c5c11135e43b4d652

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c03ea2110b8e237e491c90375799575d

SHA1
ccdfb802206516e327d16201b30986bb523ee959

SHA256
e04ff8504ebc4f67f8320484155ec434d6793ccb5b53f6027fc0eff1dd84ab82

SHA512
05e062495a8bc9d3b4153ab7dafcaea47ba52d30cb7f49973f157da6d920014bf6bd568dd6aed481b48555227ff4663b89d19218945dba6ce4a88c18d2b4a206

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d46c0ea9337639296cd035cf2d40b97

SHA1
ca812d6cf2699fe5815c93d3706d2cf05600615c

SHA256
46ab4309c684c272ab19a517dd1d81667633d9f616e6611a4b354a0f3a800a82

SHA512
f20f08e4da8ddeb7fcb1644c1c7351e527ff4ffecacfe16ab05d11527dcbc4f44da577f6574f92261ca66c84e844cc3c811e14e31806ec363c25b377be5394d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
974078399f6e76cc40b09a21d85ab2e6

SHA1
a59c1cfa262a6b0eae569750697dcf05e7b7df9f

SHA256
b7e1d2aa9f1e5040b3064c7c5d6870538da82fb35eeed7b738b3069ea4a16989

SHA512
2c17b5a228ab0d124b8db2e191e31936d84cc8b10e26e5e2061d237a49f8dd3a2a61cad8a09d2136d62ae9b97726e827afc194c1ebfb3b8534e1fe2764ea8c17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d2ff53cc98f4c5fe59c1cad006d8c80

SHA1
493aec01d69d8e3675d98564d4a5b0d1d1a1ddd1

SHA256
b5adf454bfe8a03b3d20ec97061cb1dc30d4a0480e552a01a2ab18d0154b183f

SHA512
0b996ae866cfaa243ff41089709d6187c3aa4d29719d87e1d6e693942ce220f2bac8b3d99b95ef8373f74d038d1ac452507a007b65ac65646a38912a8e6e8a6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43e0a468a1e16c5ce04cba21a22b3ac6

SHA1
74296bce98befe981ce0651331f237d1585f9477

SHA256
50e721dcb8317312e0b4b264f2677a5683724ada79f1797ff2282ddef8003622

SHA512
6d0b542bf1ce079f884b69aa766fba41b4c37e8b4ddde524b71eceb3b0a932c510d7e5a42c8e848c0bb5bb91a989edd227e527afe24fa5b4167f5e327d1a424c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1F36.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar22C3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit