e964cf01e607f5f19536558e6a286da5aeb5371f5cf4470e2efaefbad356da11

Analysis

max time kernel
143s
max time network
137s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 03:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea804ce4791275e17c070e15e0ba5fae_JaffaCakes118.html
Size

172KB
MD5

ea804ce4791275e17c070e15e0ba5fae
SHA1

690cd1078b0df97327ccc1a9fdd45af49482025f
SHA256

e964cf01e607f5f19536558e6a286da5aeb5371f5cf4470e2efaefbad356da11
SHA512

809931c99dd9aefa2f23dd7be58841f867e2b96cc6f84ca6df6ce98961374b5b2d67db9586522d0c33579c1cfa94bac92fea75b3dd06afd2c996731b60d0869c
SSDEEP

768:luDChpHfu4WLGAWwgs7K45D1BvG9B3nuDChpHfu4WLGAWwgs7K45D1BvG9B2uDCc:d6eL

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4B7AAB41-7637-11EF-9630-523A95B0E536} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432878410"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000e672104b2f9f57b4457d35fe23bf6329b67980e946284340f6e9c1d9ade779fc000000000e80000000020000200000007259120d9af87ef0310951e449fd6424ec43cde7d25aaf4ae2f57f20631d5e8d90000000de6d49979628cae8063bd4e7a8dd67990790a3ed529d498b0be071cca20b2bb316d27dc14c3198dfc2306a58bc871a52a55159b2f90d644871dce11077006577b1af1183c7c5dd5bf1b29508e1db741dc1150ff5085a7545086fdef0fa405d4b5cf55452466a73604b11afd2db44e8b6b219a6231d8a33d8bc10c07c7c89c6939a16cdd1fb0797b43d7831d17a4f5f1440000000302fa6c75855994aea29f5ff10e0a9b16be4edce730047b226cc0bd36e4f76016a2b6f6b5f9dc19c0dbd4ae3970f19b885d82606d5c256c24fac9e40f0ba0372	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d066e021440adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000e1fcbac998ed571ece3013cdb8ba91a8a2862828966643c86a55c89892cea22d000000000e8000000002000020000000aa2f842a7e6348db161dccdd9ad3fede975b27c2d2ddd707f5af74e4a1c3a9f1200000000e63dd5ea11bd943a816504fc768b9754c0a957ac85e52c9227b553cc0898de940000000a4b32a0f5cf617ad44097993e152a493cf8fdd248c56e4bb1c1f7af1dc132f08a2e1f71f555ff9c4ba5467c949a0d5ed016b141a9a806fa7cba5886cc64aaaa9	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1792	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1792	iexplore.exe
1792	iexplore.exe
1664	IEXPLORE.EXE
1664	IEXPLORE.EXE
1664	IEXPLORE.EXE
1664	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 1664	1792	iexplore.exe	30
PID 1792 wrote to memory of 1664	1792	iexplore.exe	30
PID 1792 wrote to memory of 1664	1792	iexplore.exe	30
PID 1792 wrote to memory of 1664	1792	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ea804ce4791275e17c070e15e0ba5fae_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1792 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82458f5c322b86fb7c299187b02d79d3

SHA1
a830ea185112b801df3bd90f3cdca247d64bd510

SHA256
e1613dba7d29033be149d75bd88ce0375919bd36984206cc224db8062a2ec497

SHA512
57c862a06af945cb0c5056009fea22f106951adcd9bae28fb89f352707562864cd32e111fb361a955fab6812495f773cd7f1025454528935ca9afdcb46226e6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec0359fc8aeb30bcef2c6c38bc070b14

SHA1
b6aef7a8ba00f652dd0f6ab31f2e0be80a19463a

SHA256
6fe8ea19e818f31d10e9f9c5e8eabef8e4cd72af461b8ccca49cb55f4f7f6acb

SHA512
8332e023fb9aad977955c98e8f992709ecbeaeefae5ead0a3ccd5cdbf89e3986b6800c5d90f3c4b784a9a87793f28cd82941edad4933ce193b76aac46c6d59ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f06216c2f9756fe8a903a80f22dc584

SHA1
07ab7a6ad1f86e6f4160356ae3aef58e6e238979

SHA256
3000336c9a67932357e545f2214397e776ecc93dd0cae29a4d4eb6fded4c2a3c

SHA512
bd80bd2c41718f220071f7f3ac30dd93e126c85e35a03e479bac1215a3276d613c8a61bdad7dbc51f7638798c5e0b6107f5de55647127c42ec9f9dce5ab1a641

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26547a98a8574323606091d3932bb09f

SHA1
8832e07b316062c346784f4cf66a91bd6f6564e2

SHA256
0f2e48c9938361fc87243e4b8f0d518d3fd23c1603c92075d41c4b08930b2d2a

SHA512
dd1fbb69dd7376fc6d528e7a54adb1014cc355bc26a9740df3a304ff25f23e255605324e04ab01ad43415b6168aaa1a510b6c5eef463c32f4c737f951638027c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
356368c49dd0b61fd03042633c713937

SHA1
ff6d7c30e2aba665231b2c654daa45e25f46b503

SHA256
5343d8fdcd956dec3be87e804aa5049cda6c20c33f934a8eb8ae57cbb4b8f8d4

SHA512
8c60e2cc813ded13ea304f209f6a50dbf4617dbef0571beafff28d387ccccd893a757fdae60819499a7c173d8882f238f63665bb3398625c2039f7bd75725ce1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd1b1dc4026e2fb37b79c5b910381f25

SHA1
33892f13a61f490b064c2b621c6334a466fe8207

SHA256
34679ff39dcc65a87201384ff59cd52dcb5b5237ee83c1a56e2fe389d2249b6b

SHA512
18581afba4bac10a121903aa05a480f7e8e35d94c318f4907c9c36dcfb73b5956947b91f6c13d6d60197ea44eee698d75223ed4e3e915d272d801d045266a11e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06dc2c4c36ef439828dddab7a464490f

SHA1
c3d5669f858132044fd0daacef8e71aecfa16c0a

SHA256
1165edf335f55803ef867e0348082b3dfeff0c29d44916f1f605cd613f98c873

SHA512
83b7decf9c0243c5e34038f061ce69e61190a525126f47c4f6c3d05deaa2b727e26a239292783a77e34e0c25fc0b4faab79c5356c1e51ea1b50a20215bda7250

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85ee8bb3f83c7758f166d4380fcaa152

SHA1
34959996f4f01b646e10b520e10003c823fd6e3c

SHA256
45b27ea4b5de510db7358f6dba78ac74c6a33a5579aebc8dd765d194bc6322fb

SHA512
c9f7c5478ac6b9fcbf678e8862d9f316b677ad55ee2c1067af20c63aac7c1b834c32f14e0f5ff4f983f6d927d6a3553248bc8d860f2baa8862e72694e89eb47d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86321f56d37f80e2a35779558315848a

SHA1
153034bade4a491fcc812b838a13de148e2a1ee4

SHA256
7d852938fc2e83a81ef3147b935aaa0b5589964a85e676e729adec35b82b042c

SHA512
bf217bc23df408df4ab3539bd0f38aa963adfe6ce34ce62d605e89cac12529ea7da2912821f3c258b6c09ec5c514b7090fc381f8c891a917b68e257d1f07ccfa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a63db872f44e197f96d5b3d5f6ab0fe4

SHA1
c9cb8ac5a854ff15b10900ebc4748400450881a1

SHA256
6fb95e6f1a83260fd7c972f5ce4b0f8ee8428686389c55413a1a63407cbd3fbf

SHA512
04bcb792660ebd74254d86bb988c3352d108fc63abf759908fbe98164c3ed7264370b95d34f8035498e006282555642165af77e00fc5fa2046c093498a893174

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
912eff9b6cc884465a1bc75af62be3da

SHA1
00e74f8db94f8b5703d831c1ebf7ebbe566faf86

SHA256
00605280150034aba99de80797d34dfd586a6b18c16e69a61b85d5ef9d09e3c8

SHA512
2c22660f96f8af9c3d29e3aea7748ff28d6da2cca56dd7e4d3832a9d1201cb1b08d068cd91fd642ffcc82737b9db3e2fe8e28ed5cb2989187a8ead6d4170eb06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c2d309c94d90bea3c62c84c66743c68

SHA1
938ad996e1a0ebbcbc4e7721f5598157465b80c8

SHA256
3cd3276426a000d24ff7684cfd925302c0aa22a04d8b992bfa81bf8978e21069

SHA512
0f9a6bdd8beae613e265828cbe51bb0ee5f46462b64af2203fc5aa851d48acbb6a364207d9ba68a8f7b68b0aaba228bb7cdf081be7c7072d9bf1f64f5a6f86b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0a0f92ae2fd4061e61c4238920dc2ea

SHA1
0c61134c2a472d4ec3f6d89bc351632734409c84

SHA256
78069876212e873fb6c9f57afe7f484cd4240b5146aa63c89108acafe07be093

SHA512
3a3a0c134c45b8e50c1463f90183aacaf8589cd0ae24f2ea5bc31c0366fe5f8a557a660e9f63ac3ae19d5895c967a6aebc03f4db3c7b03765296dd9aa10315fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
843c3f47addbaaac31cd35a20f9ef253

SHA1
ab316c890501b5b34c93bbcd93ae95a652bde570

SHA256
d8af893f5cac0bb59e749cf081f445829565bc0ddf857aa3c005bfe57f38ba7a

SHA512
ed3341adc9fdf9f547b2bc7ff9aa5f10f1bcc214e538888613e4845ec2486296a793b04c0e9409fd5acfb017e76df4d687f01ed1ce7ae9ac2ab7534a7fd58f2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d4d448b37d204dc584dcba19d8aafce

SHA1
8c6714b7ffbcdbeea14bb79697904b8d5932a24d

SHA256
c9e3a25c43a86767e3f5fea8e05254a4abbe880a9602836941fb53987e7945ca

SHA512
11be256b159cf9c5e7332f84c39eda32f5dd4cacb4221136f8d573d5d27bc60029350cf2dc30be7db9b88c153bc878a744b632a8919f42a607bbccdbcbcf4600

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA323.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA326.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit