141d6815c75ba4f5727b00a6c4d6e9c8e4ecc048516770a8ed51dbd9c82f7928

Analysis

max time kernel
134s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 05:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eaa97ba84541c37e1ef9066cd67a8b6c_JaffaCakes118.html
Size

8KB
MD5

eaa97ba84541c37e1ef9066cd67a8b6c
SHA1

58213ec5824611824dc762dee14540317a1ac6e7
SHA256

141d6815c75ba4f5727b00a6c4d6e9c8e4ecc048516770a8ed51dbd9c82f7928
SHA512

79841c3ebd31b653e59623d8c477be66df3699e0c27167cf34cdba5a744a83dfc864057bc404c343071f1a55fbf246724c0cdc4e7cfff2f37f68da2b59ec96ea
SSDEEP

192:7vFd+taw+BX3uGgNOt30e627JsQgVCH9/Xyye:7tJR3uBNOtEed7JRg4dqL

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0b8e601540adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc500000000002000000000010660000000100002000000086415f51363478308480bbb5a536db7b2d63b73ebbb43c19ff86b0263dfd386b000000000e8000000002000020000000da93ebb752dbd473f7385aea839e4505b9a54304ead6c19d8b8cce7cd3cee827200000004298138edb264e89e882402255bb59a3bf5f4d91ee2e543e0c39de16f5dda71d4000000015d14065321685257c5f958c94eaab3fe6baf13ca01f78b05446eb6775242f3a43e1692fdae07a92b521bacfc8a5f3877b887ed302c08f6e7e93f169a9817b15	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{12D44ED1-7647-11EF-B4B0-E62D5E492327} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432885178"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc50000000000200000000001066000000010000200000006852f77d9c946d1b3ed7c46ab01197c5c4abd100156202b8f8f9daca276135ac000000000e8000000002000020000000b0ba46ed3a5f94ff97a17acf86be42e04c4dd832c85f0e80c9c73d73ba96ed5a90000000a3d9aa28f55a2d9789548f206b6ecacb7e5b69cab44687dc93c863db58c4d321527d5a76bab4f3cc3ec551721eb7b431fc673aa5696778aa586e2172e67c1b90d0a340d4e7f31b2653064eeefce0fda191ac667f2fe5e9a9641f6727836f7ee82c3e5e9fef8d7b5d82ba1f7003337b8b2bb619e13e612fd0bfc66df0fdcf1c4d172e72e79ae6d6ee7dad5c4f3c874d594000000078c024b645a71797bd52055ff0fefb6f0a24b48bba556796bc250ad293ae13d238e48254f05b8f42450d2b8570b207d6ac4e5e290fe14d56ddd90e7736e82d84	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2384	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2384	iexplore.exe
2384	iexplore.exe
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE
2912	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2912	2384	iexplore.exe	31
PID 2384 wrote to memory of 2912	2384	iexplore.exe	31
PID 2384 wrote to memory of 2912	2384	iexplore.exe	31
PID 2384 wrote to memory of 2912	2384	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eaa97ba84541c37e1ef9066cd67a8b6c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2384 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a318b578f1240c5377fcad6639b04be

SHA1
ca585881d7c1324ee2d460645a6c32c7863c0f04

SHA256
242a9fbc1fdd20bec3dad48b4c2d40c391508034b5532346fb2a6a29d29c3150

SHA512
c6b611c45839f2d0d4e7d1c7a37c5cb2d21b1185cea85973e528483e26a3bb45d0b9a0c99af6f90f671dfb54df6ae8dbe897df45e3300e2bdeb2eb8222c7f9ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b134bfef0c9d432872ad6c428bd8fa53

SHA1
cb63c2babbd74298ef7abe34d527c1aa1c1e16d2

SHA256
4cda35858bfcc6fd10b9be9e250258f7137a957ca1c82e819006ec7b6214fba8

SHA512
d5f0aa9f3c42719f997309c17c644115eb4d706db9006ab6c2e924e6601985ee4fcaf112a4420fa840dab5647f278ab79f36cb4237ceff980146bebfbf59d11e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3aa6ddaa9463169990ea49102dc55e00

SHA1
077341d1f460b0918ef3803df5658a25c101838a

SHA256
ebfec334eb69f1933c08313aab01bd13f17b5c71218ec0fde204cfe50ab80fef

SHA512
7ab9c4d5608016cd4c36d5d0e7e1b3a6e6d0fea5fbc2e7e36647c2a0a6b0295ec0e57e0b42708c364838ef5cb19b8b2f4bf7bf94334b673102482ef9fd368595

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23bb666d867d8e7627bbaa796b762e86

SHA1
61fa80e63eec34d2155522f63bfc05073ca961ee

SHA256
188640ceeae5c947d6325aa7b2af31b37a824548d2db8bd98e75ecb715a41cc0

SHA512
094a5d21c4e820c26b704e9258bc9ec93ba0bcdfdfc8115e89a1b3c033b9fae63c412f6b985f89f59ff4adea12754517855bf5780418ddd35feb049c044f07a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67de288151befdedef1ad6bd856bf682

SHA1
120cc77a1c3c8fa6e4e703da54cca8bf6874c547

SHA256
479192ff9f56ceda101f61e184c12047a30a71750059eb9d921b376174ba9155

SHA512
ffaac1aabd4545036f626a910226b4ee379c98786fac522901d595ff76de9555f6c8296dec9e64d09b5b8ce08bf4d7a0a64dec5d7698db69d85ef15336706eae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a092968d44de37aa156d11aec8bb594

SHA1
b29dc685027b76a86592acd6c7c02c5c2f6c96dd

SHA256
31722ea5786e0ab4f77510c6d7eed65ed052aef9d4f14e1b0f48ed34cfe4f267

SHA512
b8e9b094d4967e6965229991390c16e362cc9a9ab3eb0f5135d475696128e505ec5fe5a0e4e74423d86302a053eca7e0626410016ee69c794e4a0254a47cebdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e8df4489f1e1e3b42869c000d72a55f

SHA1
58b36f03fe018cd44a85ad248bd1286da73f2cb6

SHA256
98e8026d270f972afba526e4b950918905230f7788b73fb9651187a179f1c0d3

SHA512
25ded12b76f20b83dd3c2bc78ae87eaf2e69b8c34f893493ae6232542a8cb15b4165ea3932166aea68d188e90572ae1f60c4236abf295efab1a74a477e0a1690

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a0c023a035f57e4cbe7fdcfb4ac467c

SHA1
0ecb011224d9ed471c540aa0a278072cc2859268

SHA256
567a3272505f2ade2632e0df57b5477d90798c65a1976c5aeaf0ddd2ec0b6acf

SHA512
a383dcdaedfb1f879d71d42a9a8df200ec916e567642da43a534bf40457c4935518e5862324b38d0dde792168466e80b546e0e18803e75fec49bfc8d524f1baa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
694c95814fa944016401c1ab95c50fd7

SHA1
1e0c75e3e48ca6f817531937779696ff5cce9cdc

SHA256
0077216eef885eeb396faebd47b939c4e46af0b01dd9a53a78ebf072cfff10fd

SHA512
bdefd61f75d27d4d3d65652787d704d2aa4a3af0a6178a23e1da9e792d603f610d1b16f085b92853452eab16c0990ee1cba79dc09c3d6ec3d93a68e24f1efd14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92b9670cdd0b7d72c13973bd295c9142

SHA1
5f5d6ef5593b02cd5fc0cfc944069525632a8267

SHA256
311381ea14b21b5ff7d993eb582ff862e2825ae4e0703de2747d61bfe12e3674

SHA512
932cd4d5edc6fe3259bc9686e65e59d82537ee21980f679cbc9f7caf3f6dc1863057d4b2e879f81d0fe7e94866a4c3c8ec79f57b8470d6b0fcf0f79465ab37d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
397a6caeb15bd0d6898d65cf49eacf07

SHA1
6a87f123b5ae5acbd7bc564fd3bf35c164488f36

SHA256
c75b2c297343d664812dfbd7ee55ff4194bfc7d4bc9bf60e5ba4c93244f9f32e

SHA512
3417efab2f346fbca4a07762d6a39fc21aa2f7b33ad1e8be5fa408ae6ac1482a1b6b0bf7bc9e1a5dd09c84f080ad8731f4dfca12d295855944720e74da39b700

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4dc2233d33d1b10b0ec37c625c9281a8

SHA1
6aee35da522d95ba230ad0d9e24989f21eb77d3f

SHA256
18050efb88f12175678ead0967688ecc066a10d37808dd21e10d5207cb755bec

SHA512
7d6c2bd71e0374e08e653103f00053221a27be56a505a192f90adaa0ed1b9c28e5cacf6ff26daf7cfa21c17bb03da2fce5a7cad5cffd11de027b7f07bd72e6f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1150bd6e96e0efbbce7e07b368e9c042

SHA1
35208c499eb31b0c2153bb9dcccc070edd8f62a8

SHA256
c077d4fb74d5da620f5cad34a405bd02d76ab82f6e7aea031f2b9efc7cf66e44

SHA512
47eb8653e0d5a2bc369db18ecce2ca31d5aa7b46f95d3b1faea07effacee35b6a5c5bef2ceb3058a531095e79a5cad62a957184b2079690430ace0336915af0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67876481f1ed8114864942373adac335

SHA1
a558bbd801113d41c4e4eed598c7bff6218d8a52

SHA256
a865c16f5280e10fd91fbbd75e4f0d004fa5485d775824c151a1935774a63d87

SHA512
83906813a980dc0b816867ca3614ba3b43dcd424f3c2a25a718dd3511d6d38c0bd6197383a06a40a6af448fa98ae49cb590f44fe0ec15ffc3824dad65b9297bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e24cc88618248d54ef103216ddbf023

SHA1
15981888681021ce37387e28d38fc7095781e0ac

SHA256
7efddb45809c5088476a6cf98defbf94c69fa6efa94898f186d013450659ea7e

SHA512
1d36c1090eda93568a917e3e3a216f7278f7570b538b4196efa61bcabf201ba35a5cf2a860911adeecc40fc4d7ece30425bc9bf2d4ed6cd09373d78ebef5900a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d08ed715b048d1fc9168e17892b8da42

SHA1
1aa1fb8db09bf67dd073f4b71068c02e59f2545a

SHA256
6ca7c4ef9754221827474259fc632617128e6a0fad4c3a57495c63b5d014ba1f

SHA512
ee5addd8dd1372f043cd51b579b9ea00ef3e382c320f63699a8ad703526fcf2e104b84de524db2b7297fc0c5cec2b5eb2980c093d7442f1c14cc4a8e3b292b75

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9DA8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9E87.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit