20fd8c5d6293b881a14a0b314d5636f852e06f20f6ab5841ad2716acc0e182f9

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-09-2024 14:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e05e88815ab9c9d236d0ed8cb13b7ffb_JaffaCakes118.html
Size

22KB
MD5

e05e88815ab9c9d236d0ed8cb13b7ffb
SHA1

71887e8763e7604eb6c1cecabfc7fe078d60c1b6
SHA256

20fd8c5d6293b881a14a0b314d5636f852e06f20f6ab5841ad2716acc0e182f9
SHA512

507131830a8eed6f3ebcf54162379ccca30afc2848c35ff617fd793e006023af72dbda054c3f6ee00a305d9b073490d19fe598671e1aff525c6e90dac32b21c6
SSDEEP

192:g83GVwYzel5iYzel5+eWnLzyw+U6lt9Xrn4babDgdvJfHVp0Td4/zJFZOGXpsEB+:GDiN59CfDgdvJdt/ZOmpTvuZYaIR4/n3

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c4000000000200000000001066000000010000200000007943871d60d91ee2cfe0a78f239d7a6169e06ac088eb8e2823254a975a2ef9ad000000000e800000000200002000000095db1e8ad929eb43d32095f2d861b56d3f69ea7b335e9ce5a55e8fe7626fd3b1200000006eddc39d120b297960ad702c53cd848ff396ad7a6543b6aaa20ac4022d6f869b400000001061d73ef23d313aa086f8a8acdd58ca702d916d3fb40f888bbeeb8b66ac9eabc2b9f15897237e6513efe8f2a166f17eea68657dc2becb91ad07c0eccbefc409	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{28E7E881-72A5-11EF-81C1-5EE01BAFE073} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000b7d21ea9b7d2976cb1a39423c30a889b07e59f1dc0c278c4c324dc2c1943debc000000000e80000000020000200000004a455f606daae3512f10ea88074fb8ce7a168e562b8502598547466db48fd67c900000006a718bb50912b98df31ea644177d8d5b15d0d527d80155bbd184541935e7917971bde6e5dd0169c60a8450ff086d247ec9e021eac19a954911660760309d940b6eac969d3f72a81ad6ded13d2938661a7f6f5906426b80f227603730d5ed6f2829b829d059ebd601dfd7fc75521b847d19076d3f2bcc3005b9cf863084b6a8af550a7917a6f68c40946cf3c72b44ae38400000003aeb587f51a06c0d436baab46a8307162846fddb9e3082779cc7d55ea675b98c976c9602419810a4c99baac55b690102a9c9db7e1b65c4ce0909c70faaa48c3d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0b2fffeb106db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432485782"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2420	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2420	iexplore.exe
2420	iexplore.exe
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2064	2420	iexplore.exe	30
PID 2420 wrote to memory of 2064	2420	iexplore.exe	30
PID 2420 wrote to memory of 2064	2420	iexplore.exe	30
PID 2420 wrote to memory of 2064	2420	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e05e88815ab9c9d236d0ed8cb13b7ffb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2420 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a37c474349c96c271c32da92935f0894

SHA1
77382fe9288d7cfdb478ea6853e8c2fbf0437e39

SHA256
d432380548bb427eb4dba8bdf0d405feeab3053d7783d8ca6a90eb0b9e78239d

SHA512
82350fac079e2bedf4e4eb4f42be6cf89067427a57786da9f75a775cc67fe607b3ab09682c7459741650824c27c602e1421d1464d27c48bfe779e74d77c98b75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97edccaafa88b1460ba6ee8354935ee3

SHA1
4524e95fec68970fb23889acea5a2a768b49bca1

SHA256
ea24f968d7c5670e6a682d04d10e95a3fbbf72ca2c6466423c66221d5c08068c

SHA512
3eb7edf686277e4f4f00f2976bc4231b65c1f762116547363574250621b20385e357839bd34d6fae7754b6138512e6b2164c9b4241aa1bb1deb66e07ecddc26f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ef021b971548cdb1e5c222810d61f1b

SHA1
ba2e5bf6c02e7aedc6a25a3769066f3a3a1991ab

SHA256
182cfbf8bcbf536af24748a37fc2eef9e93c69104eca3d32712c8fef9887b9f0

SHA512
7e4d2c3b6a2a5d95c3f57c2f641cde22db78edec2c7ae9b5280b83e6df302a992c07db44a733294acf7f27df6567eeae8263d612b7376e24e560527d0f2b5be1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e298034afc57261f3bfa578302913b1a

SHA1
c0a02d2ceb0fde857a11f5be689c23597ac46010

SHA256
e19abc7b337b831af6e347843ab5ec9982d558ae22e7d1142ad8d39d3b8b06c3

SHA512
65d51e36bd6cfa18a17b71a9f9d03bba61642f3a87f630962a4d16810be28591e51344c6ef3190a0c1b4eca642dd113dd1a9c8fe6c1a3624754dca95fc4290ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
722ccfeeaf35a01b2f4665bc76c666ff

SHA1
67151318e4d023cd7c981903d806ffc3381b286c

SHA256
7b8e56475a2f87380aead4925e6508dd2743bc06c409c69510557a7d6c8af344

SHA512
ec1d755de263f226f47f31e3a76079f46e5d6afcfe0cbf77ab9f852f724dc9853fe31e79c9e1f1d3d37d78ca462e7b476ac27b168cc46a0897145f9d1b4547fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc07842aca091f03a5202a978ce23d81

SHA1
aca77f4eac46fa4670830d070cc2babf97407a45

SHA256
d94b4faed9ac9552acbd34e2215904d47a78cc9b3d18557fb3777338eac46c5b

SHA512
525ff5b55cbaa59897722b36019c8643776583e3d514b0a0c65456a8ee137aedc35af49be8a48c5fff0343747be1ceb709fd7fb52fd8b1bb6fbcdc2e5cc4a977

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b0faae8eef979e221221daef45d176a

SHA1
1108395b9edfb7ea16c2ee1cdc3bf2436a432412

SHA256
52e3c6930c8ad9018ef2a05b2ab136065107df65dbf4bbc9ec65562e7eae11f0

SHA512
9eb7d75090f2eadf909b57f6c989214873df2e0ff11cf06fb5fab8e9fd01ec9c5f53361d10b754d3fbd0cdc057db05e568b092939d74fc8f73574b08f71ed24b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe449e037c3e4dfc59d1bcc88d8e283d

SHA1
9bc08b85a07547363971e24c564c16f4376a0c58

SHA256
0c05b76964b2e69cc0db6f1c265f2c22e469a390461d1dff1614178c181714d3

SHA512
3db290fa5945761dfdea92ce3b3b7733871ac8de58bddb4d103635331e2b434d0c2ae88bcd23a665c8a81cba7ecb6a3c0200743bcd8b56509d58667653347185

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67fe6eb4dd52177e863ce0efc46dc99c

SHA1
feed62002ad1d8fbe6f670507e24ca0786e67c97

SHA256
8b90fcae8e0179b217d9884f9de0bd250c2def3a86bcb7d02846ce6b8b7944f6

SHA512
74e4d735d0c20c7aa8226f00e6abee0dc8118a53f64725fff88daf9e6040e928d8249c8e3d1627cf74447d8f96b903d08f771762673da44fb04d4259365a6ae8

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBB45.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBC05.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit