7a1c37f342a2433fa00f21818a0e0e928878c6677e974d0f635c94bb5bec5c35

Analysis

max time kernel
69s
max time network
129s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 03:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea8a609c54dfc93b6c8955ebb35f90a5_JaffaCakes118.html
Size

94KB
MD5

ea8a609c54dfc93b6c8955ebb35f90a5
SHA1

8bd4435492b2894c290b28c3fc2c3dac648b3aae
SHA256

7a1c37f342a2433fa00f21818a0e0e928878c6677e974d0f635c94bb5bec5c35
SHA512

2add120b381cd092a670957699c0bd2d200d784f682c0fcaa88a9b54461ed85a1d4b05b3cceaa5be7239db1ee8efe7b75d2693e26a6aea945ad41738e1de6bc2
SSDEEP

1536:WMLiNKrAGLOKtgfc4DWy+Agf7LfXeFLe6uZkyeiBdkrY8mgHC+qpEyW:WAiH9EBdkrY8mgHC+qpEyW

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1D9CA581-763B-11EF-9816-E6BB832D1259} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000afc4e27d4f2a178b6fa579490af35c558433feff32d2ffb3fb3ebdbb69ecf474000000000e80000000020000200000007e9d2105f861729b20cc1826878e2be10befe808e96f3fec3758ffdf3c49d08290000000d173052d85d3bc034dc32d4864e19cc371f2831d3a61aed703457e758b46f3f887daea5902592b2c7b003a19b3065f472037b1c1dba3265306a54b98653548a8bb46cc9641c1f107e2e3bbfbc51bd27d813c94b9a02bea20025d46960ce1e20236ef5f28b94eebfa0af041475488261b7755d6c7840715585c8f8dfb54e16b6ed832b9a49260ef776cf4a99e3b42b719400000000723f90a1186f489d829b8aed32899fd4366e38b9c832b54a1e936281245049357426475798e3a92ad71374eb0e6c10b5b28be3e90d0a4bc4c37e8d86064f450	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000b9f5fe0bb01dc8bd30adc144c4607ee2f44ca5cb48dc8c35cd4e0cd3c19a3d85000000000e8000000002000020000000c8ebe9b3b0a99b5e16486598f1887733dae274b7fee4ed187c221cd1638d05fb2000000096e008703689dfe91a528463c6b092a17bee6107def59d46423aad3467ded076400000007339f6ce045abcd43ad3a71b92ded18e64a9c99300bfdc68d0d020d089be6c5821fcece32bbe90df6a72e22875e238ffd40be850885e1fce716270695bcc8bc6	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432880043"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00f97af3470adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1656	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1656	iexplore.exe
1656	iexplore.exe
1416	IEXPLORE.EXE
1416	IEXPLORE.EXE
1416	IEXPLORE.EXE
1416	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1416	1656	iexplore.exe	30
PID 1656 wrote to memory of 1416	1656	iexplore.exe	30
PID 1656 wrote to memory of 1416	1656	iexplore.exe	30
PID 1656 wrote to memory of 1416	1656	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ea8a609c54dfc93b6c8955ebb35f90a5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1656 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bfb78e7b47fa036b5ea094d51a1b9232

SHA1
673e1d3c1628789782860c5b0eaa58c28644f105

SHA256
be0f8117d7c67193d315b7daf6ce1e00641928da8c6737068812b5ff6604934f

SHA512
987c24c33caa8742208c85181714f5c11073abd50af0aa830a9a379230ce6ddf1b182035ac0fb93694080ba55ea718d30a3b09abe6885b57c30c4d15a08e2af5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb3259aefd4d78173cc6d44bd8a030e2

SHA1
66141047f57a8ab417593fa4b75f0cb4e31b8a94

SHA256
ac1ecbf9804d989580fe165911f6ca292228a51920bcb1df8331b09b3b7183db

SHA512
b40dfcf32b6040d3a421292112b98608370f7514bf7eea011f861a9a502166e2ea5e2b9fc8000e9991dd0a5a523797e25e2e7a1577623a99337e8ee249054a6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5132ff315b82b723e5c4f4ada7a7716c

SHA1
0836ffde37e23bf1bc829c5890e52242db24ff69

SHA256
6719ccd5aefb28c0cacfaf11043a9707168e5ff263823b9da052a6e0c0d2c96e

SHA512
25890c351f31ee3e45b8ba4c5944fc0e75a2ae3d75db240e79fd28e313eeaa175644bd1503777588057ff88046230e57c7fc75923ee677453beb1eaf3010edea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b75f6afa90f9538b5ab80c9503ddb711

SHA1
77fce1752936ead45fd80024b9261e45687b9edd

SHA256
89d2465712e2f18f85bfaef4937933e390fe3ba7dc59147eb19da198eb7220b2

SHA512
6fbe4e44f404e0a5964a3e286a83d5f20b4e5c837539fdbe7425c3976347656bad2fe51dee3d6307deb535c10c72321e02120528ae74a5bbc4c5a3ba0bfef126

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b01337473ea6e62696f2e094a2e89ea0

SHA1
e707a72c1e0e5edb6ae39cd71176d4050d948777

SHA256
dd1bdc583dda650b380aa27119e604d4c7fbbbecf18a57d883ec817b8f535c25

SHA512
0f1f00fd9de074c2490009077b0277f2ca3f5af0cf52a428eeb73770ad4c986e77c3972a887fce8cd921799816b8d2871ad0071f7a54b6597b4c0811a6fed341

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
afd346150088ff1acf6e11103c6ed9e0

SHA1
836a1e7e00b09049e9002188a5e191ba71157e49

SHA256
77b072acff7e0be86efddd93523a7d72e7b0cd50ff5576980affa6cad2d74004

SHA512
4013f623e3897ac9bd6b79e85f651dc7aac2ab4fc7e9126c38e3cff51807cf7b48673221bfbf0170870204665a1d49c19f80b577680a90a7af2b987bc42bd037

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22ce82427f799e28a9584ab9f7c5168b

SHA1
9aa0760f4e7ab5a067edbb5c35c01fcd1ae53ed7

SHA256
caa012d57dd0602e82c2d296ee89f9675a9b680c7b893673258954653e1300d4

SHA512
a6a873b06a394aa722667ebf35c80287a37d7c0491dd0eae6c5ef926da237f29d423789872d57ec23b31ad55f7a1d7bf246604919c6e48bdd6dcd63e2ea51433

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79ae38c4eeafb0f674a36bfb6ed56885

SHA1
2e6d53f3e2972f69ecb231a74c806dd12ae2edd4

SHA256
16d66b1474fd19860be66b192ed562cca4d245150e708d99ce5cf417e740dc85

SHA512
297e8ebc84eb98ba7f4532cb157b3d49bbc404a7c7e40ff16241d8fca139cb31db07a7a6f6131bae7f24429478838db9932e9539332c0e7403fca80b1e0e8ccc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff49a31c599130d13631509f250a239d

SHA1
3b35d598a6d74717df89ea85006d8bcc3ce1ca43

SHA256
fcc2e9b31037b5f56a48837e423c328d4671727b9890c886b4d41bb250a8bc27

SHA512
e359395de3711a499ecf75cd0b77f94b0e45d18e5490058eafd74eb0ee9112f3f7d6bfa9bd21980d22507b9e9ae9b877abfd2bc4fef199f0a54ac19e30097bb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c04d6668640e800849e2f39b816e4981

SHA1
65c8047ad436d8f30b12d19b32be0fa99febee49

SHA256
b911eb22e844db11aa83007f11ac8e331c5e4063ed3ed147c675b2d5c387ca28

SHA512
6220463929514df875826750b6ff1849261b1c1fd1e343372d1672f968cce2ffc39ce0f9287c2da72986c9b21e1eeaa4e0d74d0bdcf89737cc8f093859032c6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36566e1bc04d6263d1ea2916a18989d6

SHA1
8fcff2fdd19595ab02ba8965623e0ac1bcb43a8b

SHA256
c03a4be164e2d502f90a239539f29ee61fdeaff2f9aa073d05207b6cb11cfd62

SHA512
437a97a51e8e3ae78fbf7b77262fb362e75556b11936860fbcf621ac46bd6bba61cfd1cfba1f9b17c679792129d8bd5a6da8c82828a43778b694574f7cbe95d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1a35515f905e497d1cb310387416a20

SHA1
82d893522c113d42e52d673c83c0a0fd1a748297

SHA256
306f05173736309af543187b5175a3f338e44a1105471359c56eee8bbe0bc8ed

SHA512
fad99a2c9f75785122a8585e02a136cfb7b57522a35fbc0643a85159af397d1b8cb9df4cef67bd70033e52ad7eff77d858fab324095af5d3a2bdd8a6edfa3b24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5a6613ba804e1221f6577243fdddf3f

SHA1
fd4bdfdde5c21675c6649284ddd3429d954c6b57

SHA256
05d36e75e575d4cc854f6e12508c4471af7ac950d0976034f322aaa9d100a577

SHA512
02f2ab7f8047b7f4c3a841b113ae71b09b781866e3bd8deb14e66f681bfc20278d8621992f00e09b1c95e3aa1b9e20ce7819ee856d0559793f2d76dbe3ae80f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76379f370684d8c3530f11185c1d3b67

SHA1
f1112850ebe662b18216910520ab3f1210389034

SHA256
b1266f3cf88d295123212732cac66b4db0c16c931aa36903b46e6b1f6d92ef72

SHA512
bc6d2c1fdad11d54f277599891a2f1a5293c8b4591f81d3771a7f42c6c6502e8f6d9c108a3cf7f0f077a9b7c7e7f1aed0a72f64734aeafe14d92a6974ab481bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\40WV1DY9\styles[1].htm

Filesize
162B

MD5
4f8e702cc244ec5d4de32740c0ecbd97

SHA1
3adb1f02d5b6054de0046e367c1d687b6cdf7aff

SHA256
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

SHA512
21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC516.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC577.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit