5054d3a4eebc003e444527f4712db0a68f968cdb3c361f92674e0f49d1529504

Analysis

max time kernel
145s
max time network
148s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 11:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e01fabb9f27a697bdaa2cf8279e72656_JaffaCakes118.html
Size

21KB
MD5

e01fabb9f27a697bdaa2cf8279e72656
SHA1

8c910794317d82c7c8aea65d59f95aab3b6bf41d
SHA256

5054d3a4eebc003e444527f4712db0a68f968cdb3c361f92674e0f49d1529504
SHA512

03174da86f5a2cf229501888d1ba402826ae5c45a57b2f86c67d12c2ffbfcf3015fb413ae15db38dccbac71e2193dcda0dbdd620a7cb476e2234cb03a26bf71e
SSDEEP

384:nki/T9iwoeoWBMPBMQBMLBMaBMqBMXBM9X/y9E8N1WGQVoMNTOh3Kb1PNd:B8jNWCPCQCLCaCqCXChy9nNMD3N5Nd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000738e4c96471aff2beae0db868a7554289363d999ee1c4c2886decdfac7d7dd0c000000000e800000000200002000000046369daf3610317cd398b4145062b4fd83caacd7a6a76dbd9a2319802b0e52a820000000b1344b0766122eb15d4ec840f83619d6b00a1c13bcfbcb7c4a62dd6ab942e4ea4000000057161f5e23ae1d03c95841eaf25acabcca27bdc2296081c9b118e3ace7cd27f8498d1cda5e1f825659a37ea1bea9c868dc43b2918de408a20f5460b5eb63364e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432476576"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f03a10c29c06db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000089f49dbb97f62ddacf9d773016e8c86671c0afd5c751fe9229b696d6e079f5b3000000000e8000000002000020000000764d585ea93f2799c23a40a6f6b25b63007fea548d2cceda949bf5cf648f0eb590000000a57d668b9207cd86261469f00aa1cbe5147ee41ba2c544d1efe6e1b1e28eb46287327b9806e784c3f3c2d6020dfd347bc0f7a36a217efd2de8196e8e4b770f82c3b9387ac620a05d04f84e3aff2f4a2f7302876babe7dd04e93062449f201ee2f180af82eea797ba07703eea2720bd1337bbc5c8f1e9b3e57509563bfe930549ad32a395d702f794a1b1c7ee94a6d34c40000000609cf90af0250e6b2c4b799bb7577ab96e1f488825ec907a83b00d07d5cd1c0371c4a627732369e96b26652bbc200a66a4aa52bad0d256b335f5afaaec47401e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B4E86E61-728F-11EF-8BBB-46D787DB8171} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2368	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2368	iexplore.exe
2368	iexplore.exe
1396	IEXPLORE.EXE
1396	IEXPLORE.EXE
1396	IEXPLORE.EXE
1396	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 1396	2368	iexplore.exe	31
PID 2368 wrote to memory of 1396	2368	iexplore.exe	31
PID 2368 wrote to memory of 1396	2368	iexplore.exe	31
PID 2368 wrote to memory of 1396	2368	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e01fabb9f27a697bdaa2cf8279e72656_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2368 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
a89e450d5d0ae24b1d50c2e97c5358a8

SHA1
e9b368e12aaae2785420e7d9eb028bacaf0887e2

SHA256
2835151af369161fa345b7dd06936a8874cdebb94c548b3310ebec058307332c

SHA512
bfbe93031b0b37faad1834b206a95f6ca9bd68aa20f638105f18d857069a3bcccce2d4839127026d37f9303e47c55afc6f8335118c3b9b98660c9c3b63d39e70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b585014d3cff3e209fb111d844abcee9

SHA1
9b565a8f55cd7c32b9a38c7a14cf36108c1a910e

SHA256
152c5ca6d33bd0dc9c610834c7a3845da7aa5204ba77cb2a5fe5ef8099342fcf

SHA512
0874430bd9563fdc39669595c6e51315cfb5720132c49a7a0dcfae784c773bd70ab0fdf02ce84b51d0e7b3e86e5f2c945021f044f414f7afd2531415b13eb364

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3167ccf63f612dfd1e2cd9b737073612

SHA1
93cf15b6afe51e83ded187a37b09a84d870e73f9

SHA256
2fe004bc7033c9385625ca4b26a4b739826181a10a8a122c823d44868d773809

SHA512
b95091fb9febb51156c169e424e791548a8b6059231869c213d1dced01897f15b9c65d13591e78f2843cd896bbfdf272e275815df515ec5dba4fab785698c16a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
137d541f509f770fff2ce70f5c66ac9c

SHA1
1df13d64d408ee3577d63102b3bc96918cfc9c08

SHA256
2a04327dde4b321c56d1cb5b295cf89e6fd87033f9d4596fbabc84178336e4ec

SHA512
13c420d08d7a5d5ae7393d1c1137cc5373723c340a3a405a7dfc3f28428602c4052cc3301583baa08c2d5131d55304be5b0b31be51fe3add85758d14917b2460

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c54da124a8039e2e4cd67a783e430ac0

SHA1
709dc00782103068dff75429b9f1460008b93943

SHA256
5f00c27a5e5a128e6446a0214f14dc34cf4438e18b80a757cd09eb43a08432ca

SHA512
553a34c90a86776b82224b8b93f406e65ef8061b38ca362f1ce729fa58a4092fccdd324955e417af7692a89792fb9e77909737cde23a45de56a82dfc8cf97c66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
768007860ada08de0f1d02617708f5d6

SHA1
ad773e402c88ec62b21548f8bdcecfdf6502e345

SHA256
adf5d85f5c30aa9280bdb0333d4bbbd6372ea4e9627c614878ca88156c7cdc57

SHA512
9dfc9b39cc5b4b64be6919141829aad25950043bd08be72d25d90f2bc25c59ccdd1aad24b83d6406ffe24502f83c83421ffaa2bf7cabef7ea338c0b52b402782

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bd837c1760b051d1ae3f42b0360fab8

SHA1
01e05630707f37f0cccdb476ad12e7086ad9316c

SHA256
e0b8f723e7257aef49f7810466b5b080c76c6bd29284ee6ec651031c1a92d71e

SHA512
e5d1e284cd43b3d6c737d72a0c34465c37cfe5ad2a9df05f822d075c88a74be61b692d477ea450b1171740ea57783e26708ea8967ee667d0c0a551087f19a57e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
706eb4b9792ee9a2e424f730fb0d7e68

SHA1
6b8fa4e3a3eebb9c0c720263dfc7b13066bad05b

SHA256
2109f82807c20cd93b5669b1321540b00d3effd1681b33947ae980646c7d9a34

SHA512
3fa240f1ba54f361fc0ebd9929ad5619ee38150a67677f984a74ec11cd0266dda42509ea126fecfcdd981d4d1b0a4f2fb6ad5468c6d9b4a93c2ffc77db7279e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ffa24cb7b99e1e7c81ae4dfa1a56ead

SHA1
bbb6df3bc894cde1af4fb169f5d35ee235b436d7

SHA256
b1c0e1930fabd86ea389dc456cc79e5c98047a2e5e0e34a5a31a5f68a33b7037

SHA512
13613f7d79d86452aa19c007d79776f6818105a66b3efce1c99a076d3c6c924721e61710ef6cd1031c906969ae6777c6965210868731be093a78dee30dba36b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4992384edfa2c9758b0244c25483abf

SHA1
6781afcde51fdc7d148efa9e24e6178036014461

SHA256
42912498d6b860482fdb108d2354b0b04afb735571414d6a5ed09ef86dd8db7f

SHA512
234d62a67c3f709ddae1e59f8630d716a14888dfca2e6432850ed4833caf6954a6f92d981e98c88b5e0d24c7600fe9c4902fdd7cf2e500af5ee5ce8069a5f8c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2434e4ac23705067d4ecedae6997c022

SHA1
83a887d38ffcb47ac8aa531a15d008eb17b64d85

SHA256
03b653bf05b5aefaab7a1103b9bed4a281f54ea76db6b896afa50bb5b5f039c9

SHA512
fe163a189f4527aabbcd1965bcb7308488d5c7a18016885a9ff84f842118325bf75dc4902f6d4b922a3e1a81fa3fd46331a343dbef6849c2f9837f2209ebaff1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5fe9076961548f079e6e66845d53ed6d

SHA1
0087612cc5096e86bb26d5a26d98d45d0d53c782

SHA256
87085ce3a7fcc6e867c5d3ae58a6f086aaf00027d03b2e9bee9cb6c6760d7a1d

SHA512
77e1537deb70c5457e36903e1cf909d5baa71899e8004e062f84fb143a8c78670713a11ef8f4f3f726dede29eed52750488cbd3b92f49785549e15f54a30181e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
0881344e39eda9e8ba2ae37c84801f4e

SHA1
b1b38c84b652a4e9a2ba2f94f935da4d9d3afd04

SHA256
65fff167764080c1056e5a54a73301c245490f4b414fabeeabe7ce1eda361caf

SHA512
647ed323e1933bfc55c2963d5addca9fd44c48dda36624869db26655c3bce82ac306789de6c30a8185ff3da3d4d584bbe0fede18699cdf50e556c43f4f8b56a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDECB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDECE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit