77b0dd82272f1bc1a7f6de21eaba95a11b4d153d779b47a534dfa5ff190e54b3

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 03:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea7b6e381bdd559cc0d8da5f807f7caf_JaffaCakes118.html
Size

37KB
MD5

ea7b6e381bdd559cc0d8da5f807f7caf
SHA1

92d6b7daae8fe328e170fdc279eaab53355ff7ca
SHA256

77b0dd82272f1bc1a7f6de21eaba95a11b4d153d779b47a534dfa5ff190e54b3
SHA512

527fd6d5a9fec56759d7263fb17d711ea54d82f603c082837666db2a3aa4060a116452cf948c370ad39b2e560404352d71f17fad4528f6d256cc5f1c8b9aca1d
SSDEEP

768:SNDSJcjfQTD5Phy2HwpiuwJ2xzmRIRu2cJudN9:SNDSJcjfUPhy2Hwpi/J2xzmRIRu2B

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb470000000002000000000010660000000100002000000058a3458aa5f6b44d7e4d2063767f4f72046b56fa2aa66388cfa3b191e0a88e2a000000000e8000000002000020000000c4696cd633900cef1fea69afe8b6ab7217dce387b68a8b5d9f6270b2632e13d29000000051a583aa4d6706216a1cf85cf774498237086b4800dfa367e758931bbb73228bbc91991017ae3542a39adddb0fe4f549d6e1bcde89ba88711464a9f78caf36ed560532c1cd81a99333da1ad7cdc812dff666f62dd7d3c776441ead279e8c43eb068cada0f99c6978be8120aef25d13c4851ca0b63fa89f6ce90b66bfcbe2c8b9a3df3b2380b3a31b4167c0c997dd818c40000000de4893e31149271735452090b0cb5c1a689d1de5ee7bbe4702ab1f5483b2e7df478afff31c66eb81fff27150c775f2511a4dd080cbef7f4f53bb0379c90e5ce7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6B9DE971-7635-11EF-A567-DA9ECB958399} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432877596"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000002247ee149587e671854569c9bee8b58d942b27ade46ace77e3810bb744578474000000000e80000000020000200000000e13bd3e7510010306f81ad40bd3ea43ac912a1fac309f4aa55eceaa7643547220000000e6554f95b7640868477458d2f25c2645e306b9495ae7601e85400e309743f6e740000000c0efa30b8965b12628705815be8a19cdb7df9db5bd819118e0124c3f13dc1eb4d04ef71245a6d05d8441d6a796ebb952030000f087568fd6abd8660d539215e7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10de0641420adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1892	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1892	iexplore.exe
1892	iexplore.exe
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 2760	1892	iexplore.exe	30
PID 1892 wrote to memory of 2760	1892	iexplore.exe	30
PID 1892 wrote to memory of 2760	1892	iexplore.exe	30
PID 1892 wrote to memory of 2760	1892	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ea7b6e381bdd559cc0d8da5f807f7caf_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1892 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
34fbd02dc2540ae498e74a076a157d13

SHA1
de64117bb3e0cec45c6e834d5ab4a52fb404b1c7

SHA256
3801ea081fdec053541e539b5fb284d878a37ac8c338877aec4b0cf162fab911

SHA512
77f8c5675a6bae20aa66fa8c1e79a9a055ff1a83f21db7123a9ca6eb1a172b6a42deac9cc5e0734aa2d7f64c5e4dbb5f0f90b50b39d9cd2441ca1125ea365465

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0105ee349921237acc4126b45d88c1d7

SHA1
185d366447fe6302d897c5cf9951c6e856fc8b2e

SHA256
35fceecafb43372a0cc8363b412cfc551d2c7e7b45fb86125490e39a9de5de35

SHA512
19cbf082672ec51b2178eeec60c57eaacc0dd8f35126a7c9f6ddb306c997841a0696f0245cc469fdfd716e519130a6d685fc1bd016746184a164175e92bd317d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca78ad368be6b45c12dd4e341a96aae8

SHA1
bf187264c3923f6f54d6f60999cf94055dd1c947

SHA256
defce7b8db12241d7d349ec5e7507c7392c195346e274af1d912fe214dacee9c

SHA512
aefd437bbbe09a0144534f664162adfe92c46b8b38e8962fe9fca258e90f4bae6000f3009dee23f3f44d669c111f7aace5f75067b236a12c7715170f2e6cc8cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4133ac9b4e3cbf6610e8fd5b2fe304c

SHA1
af2c957b4f29d8c65738183008e2a9e2f8fe5995

SHA256
ad3b76cb675ec4098200b3d8f499a7871f2d414f83c811392a7dd9ae5c9a96cf

SHA512
03f93d4a9841e06e8a094a76944738be47a6a18619cf27321057c92c91236ffab24665411698799a9596362e6630a6c481f05f4948825f31bd9a4b93b95bfb82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1668589efc2c668588471160848acaaa

SHA1
b68f86a6c9ac4186c024f6fb20d241e94e06386f

SHA256
b9de6630a5ec17039ae2eee49292c935f6cc0dc167e74499bda94948bcfe0d18

SHA512
b5caa7df544964e5fb994b9928546b9617e706825b2167ae7766e1ab0ce7b3768a2682a62f692a6faa09603541eea3a99aa406ed54fec721f664ad58e1470511

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0fe6c2def7b4ccb9de4f83ba275f118c

SHA1
ea2350300fb114a34e3e7adfcee041c94ccf3969

SHA256
1d80d24e9b42f645635867fe459f3d0269fe1adaaf232322b1b66b6d04bd6b36

SHA512
c977179fec1f11fdbd4ea1e9b0f5947a283a1be507394aeb3d27b1426c7835af4a9e971f925589259e28e9ad62240cb9b2efb6a6a9ddc6492b50d64a12256ed4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34a0a239f3f180e829c92a929c0054f8

SHA1
4483d055a91734d964d9455b0e7225cc5bb03d95

SHA256
18ec2dfe1b947259678c48c8e13ab8671136ee448bd2729d8796eb3cf9ce4aea

SHA512
cc2679251592651d81df5800fcb06c7b10dff965df878d647ae0f2cd374e425c630a072c33e75591a72e3dacd058956dae50e5e1d033150d43b8980f0e1af616

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd17e13d22c1afe8edd8e56143f32506

SHA1
a17246f549590a0990bb6921bc54fa9afcf16101

SHA256
bfc6fbde51a824c0e428e524005d7b5b980c296cdbddfbc6eedb1e24f9096069

SHA512
b2a2a5ffcdb559c1dd4187417e05dd84f7db46825f74a53bf5e171cbc1a98c1edbddcd148181c88f21b7dda7971ff9f8a898e7402f105c08362178b3fec3b64e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2dc18afa8ce06b125ac2a923ab5f6d9

SHA1
21b8397b3ec4f2443a3e25aff477cb933b1b47a4

SHA256
54baf508d80b963ad93465f15704d4178393774a3b1ddf5a317d1b3a1a762aa5

SHA512
334390d987a6eaa9189f074105148286b7225fffdbe134bc19814717ec7a67c00c3f12271934984a9bf04094f1d1b318bdf7ad4cf70c50dd601989ee712e78ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b818907af3d5380a06ad90608f8a866

SHA1
ad02882492903a76909ea4051267c2fe5d1a3b13

SHA256
9b53cb18a24993bad2140ea1752102fda6d4730d31cfe4c116fc0e24543c5057

SHA512
7790d37b5e2fa763f8db47349b4e4966f3cdd78fb8ebbfa71fc5c9484fe442a7bcd0c31dd9f3d13af37c7b23d4654afc1fb231e44a7e6eb8cf011389d1748f48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5c6c9e74db0d7f886ba70125abe2664

SHA1
d60209e34ae6e39164ceeade198be70bbd495e2d

SHA256
96ba40da2a9df1561d3c342e533890bd264321b5f33cd75f1300173ac9d6ec3b

SHA512
6ab37e5e39fb6504749e4954d93fae006ff07a91878c3ab804a881a74c0c3d5e2e4722500d4cf6b9776f507b4a4142e1bfdca1ce8c802a86e74f044daf164cad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c98a4f624cc9e8edd2f033c15c396e1a

SHA1
8ad68853abfb3b3aa76fd05570f61aa52fa0d2f7

SHA256
2ec0ec1ca2d044e346acf9abd98c68fe5e06bed930cfdc7de8b40dd631c0ec2f

SHA512
7d892d7dfcb76be6b76049cb1afd54f9e647dea38520ce51aead20106f152a0e0fbac4b84866a512d610a9662b82ee741d730396df6fef40d6f5defede35a464

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
77caa542dab2e41a963351c2c1a920ca

SHA1
2140976dc1be061a7ae1dcb2b89d7faff16aefbb

SHA256
e8b9206e3900bf78383b41b77ffd60b95264efc6b30346d3be747abb88d5eaeb

SHA512
309fc642613f5ced7798ddb72314f8cc85ed3f7b9b87eeb864bc1556b019000b28daa5a3735b4e1823ab8da1030660848e4dcf3b2966a866f1adf0c88dedbc74

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAAA2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAB7F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit