0bb8a649b0e90d25d1de04c4b2031ce7b75e920ec6879ac854a10c05a842d528

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 03:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea8aaadff5f5adbe0f9e6fe0dca12db4_JaffaCakes118.html
Size

1016KB
MD5

ea8aaadff5f5adbe0f9e6fe0dca12db4
SHA1

1d713374df3b9b63e1b4dcdf98189a8856648b63
SHA256

0bb8a649b0e90d25d1de04c4b2031ce7b75e920ec6879ac854a10c05a842d528
SHA512

2f5e06adf10818b4f2e2728b2158721c714f5edf5fc4ec6385caa1273199f0dce7e11f3146554fee59ccb7b0f5da2052549d71d52d465a4931c503b82090a9e9
SSDEEP

6144:JMzgtD9koia3618kygtAtcKIWBCx0SFbH5jV6:JhtQf6iMcznpW

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000ed427f243cc8bcb14dbc66f0be21d24307f22adb57bf8d5659acdad44f494f77000000000e8000000002000020000000318057c0ed838356e9065472f4a61c9c05a962630f31217f1b8038cd9a0e65ec900000009b5c967fa497d51892d5529f973ec52396b7916e8b75796b9eeb2fdca7870765b4622c6611ee92df638fa8988695e47acd32a6465f32c2094a404a324b90466fad09946edbcb2c1792df362da7957516bb0488d41102d0029da78299bff389e11559d69fbd64e7dcdc68d346687186f333d585ff85e3bcdde2ce7843501b3169e966c6cd8cf9cfaef002e63196c46d9f40000000079c629660f51137832f54386808eb645f36b40c95555887b7d9cceb530ccfe49e3be819a90693f0ff5bfc184ea88fb11af62089215fd13f97ec802d2e66f7a9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432880097"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3E50EE31-763B-11EF-9A0C-EE33E2B06AA8} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000ca26d5aa793bd3427756b8b1898e68793c6b6e817702a8ae282c2b9bbcd3b048000000000e80000000020000200000002481a9a0810554c1466e924b671c698d232ce70b7300079954385ff84b67dbfb200000006eb4ecdf277fb674895c24a7e71b5f0c537c3a2e7bbf27f5aaea761a998d5fb540000000d2cd1d5948cec81659e1dd5d021f8315ec5b4c9d96772ac86b66135a8171d0723d4b35d32782a4fc84e4f7c3b8aa392697750e36c606c30303ad0569ae08260f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60d47314480adb01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2556	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2556	iexplore.exe
2556	iexplore.exe
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2556 wrote to memory of 2092	2556	iexplore.exe	30
PID 2556 wrote to memory of 2092	2556	iexplore.exe	30
PID 2556 wrote to memory of 2092	2556	iexplore.exe	30
PID 2556 wrote to memory of 2092	2556	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ea8aaadff5f5adbe0f9e6fe0dca12db4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2556 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d87ab4e5a6153286b2b4d8b8e1a7ff4

SHA1
02021dd060256127fa5bc8b5c75afe3d99c44c16

SHA256
0b6936c18ba598f5058a847eaad4b1ad403144ce2f401d1a779e6c79e9a5fcb0

SHA512
9d2e315ad1f86c9a237eca4f533110432f3253ab47d2f8b11f357ce05f3797804f040e6a52c6e32d405eafa5590a2980d30489e1569b3f5905f4b18576c5f229

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5bf89402b8075645b1b06d0a57f6f93

SHA1
ee3db7506d65fabc837a3a30c6563ae2e8549834

SHA256
62e775adf5e1a6cf86a5556abb28c17cd8d34266429d4773ee64308952a7b82d

SHA512
9e5f01e53a6d2ca1a9ccbf39603fd20a2911629d9f3ada1f0d947314e31a04b7e162b85c39c6d78a04b594fb607a18d81571b5f2ecf6e4810463cbee0b7aff73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fb2266f6d32d244a0f62f5d4fe49512

SHA1
8cd12dfe5c3af9035f472eb9939f64bceab4910f

SHA256
275d057f71bed74a268071b816d736419d7642ca35336ac9f19b7ca41947686c

SHA512
db4b10aa582e52f4a6b93b8acb65f1599fdeab89dd65a939116ca4be389bc6b8b56cae0549c056c0cee7a055063d5eaea4acef8f23c8b8f1e8c8a5124e54aac7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d29d303fb9e7aeb2808588a8c5041903

SHA1
b94acc3629248ce6588b4c155273b1c2b93dd8c4

SHA256
027dd13fe75f4a0ef9f9457398e94d353fd5bf8e42a4c4981a516671e7ea9fb5

SHA512
c14f89ec6572f98caa421d6779138c35742443d0ae45380db539b5f39020ecf3b1706bbb097d4613ad08390e99c1c58e89485c088c8ecec6bc3af8b065ac7dc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91c04e6744d23a4ab264bbf03931ed40

SHA1
cac86d8720b0788c503d7b7376e3d902b47c6718

SHA256
3dbbaafa398d5c62743e6a2444896defccca370f0a78f2c30f10738dc30b84d0

SHA512
64a4437ac6e22edc47229e166259391e9d85d6fc1b8bb4605e507437da93ac1ac590c84dd0a96769a962ffa1547c0d0c3b9226b6ce6bc8cd2334919db8fdc353

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0d5da9714c12bc962256dfa39e1dfbc

SHA1
a5703cdc95a3bbdf99cd92a9971f292cc97b7aa0

SHA256
3d7158a11fbd619650fc59cb059f8be1c2c4507702e9556c6e35f243e83aa87e

SHA512
5718efc22f1ea03408ede55a3b428d5c5b2f04421edbf3ca3d4b05a00feb2a3b5554241c268690b0706288370b431aa0a69b43710ab0243fc5faafc00840f663

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6abe995ee736fa26eb26bc0e5f587adc

SHA1
f2aa9bdb8e445816f314d64fd1ee911f78b6dd2c

SHA256
65c5bd97f454b1f356ec60a093ae1cf6d238398d2f8cc0dbd9b4474b7731db0c

SHA512
0d8efcc441b891a7b9be5912d6bfa0c6770f9b7b8cab0562ebc775cc7c1944e48bb6a8a1b3f6c4e34632b575685fa327ba80781cad9705529ad6d8df309e0efa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47ce2fa4750bbead3a19e08d82740dd4

SHA1
a767575630200dc23a929e2d7f6539e27b9f3e11

SHA256
b297e501543dd7fc2c28d6716193f8f57f114f99303541ab1d66c46de423b8a2

SHA512
5116431547f2c46d7d62903ea6d333978887d1fdf075e482f856174022b11845902f448e9facb6e178716309fbe342aacfb42b770324c815ace971da045b28f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a390a16e44c1173bcc315231b2911bf

SHA1
fda66766853ee9eed8dae8cfe87cb361a63141c0

SHA256
09af9916e65c2e110be70094fc6654c1e0f25bd4677ebf4d8330a6ce9008309e

SHA512
8d6b1ad2d496f3f5e10400c25561d977828ddd3081e4716c7dae14be02f32ca2c27aa03506104af1ccd8ccf072a927afe0bdb8480270e860b34a5b28af249dff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2993da793f070b4688ed63853b7a380

SHA1
a1af2b13c41eef74dcb382587ca69048385d8dde

SHA256
de4e2148b3c667694edca00e3fe595dfd6f434ad7e04b163485b09f830bad3ed

SHA512
b0e27019229c54067c2719e4d520006a4ea49f5366889130653eb3eaec5730299c4ce9cfe2a189853fdec85d7cbb12e8d05395842470812d906d9ccceecfc94b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b411f8347a0bf9830b6e4b606016685a

SHA1
e7d823c35432a8e4ce40b8eec2af82f0549e914e

SHA256
37012e5674ca6066072d9c3717dda14e7e6af0ca47b7b8cb037e853424f2dfb6

SHA512
cf2677770636cb24299a90fe85cd1f14be1991ff67982b3f92ea6c4bc1fcfd7b7ec6cd44e104483258263ac8af822106d8a8428787e61f3d1080973d196bee75

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEABF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEF54.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit