07b339f6377a1954482885b0cc0a94fef740d26fb8329550ff90afac8d91a6cd

Analysis

max time kernel
147s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 05:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eaa65d68eaf647162e39029edff8a3a2_JaffaCakes118.html
Size

144KB
MD5

eaa65d68eaf647162e39029edff8a3a2
SHA1

938c2a66b56600ed6e9ef4ecccc83b3be43273e5
SHA256

07b339f6377a1954482885b0cc0a94fef740d26fb8329550ff90afac8d91a6cd
SHA512

fe944f424e95c5e069b867f1454a0ad1fc0514723adb3e96ccb5f4649d27b6ea4ec7996521439a94e1955bf35b603dcb6ac61b5178a60f8a5c2002c7d0ac6c8a
SSDEEP

3072:SPGRMprx7dyfkMY+BES09JXAnyrZalI+YQ:SPGwx7osMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0574C631-7646-11EF-8778-C60424AAF5E1} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432884726"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1448	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1448	iexplore.exe
1448	iexplore.exe
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 2864	1448	iexplore.exe	30
PID 1448 wrote to memory of 2864	1448	iexplore.exe	30
PID 1448 wrote to memory of 2864	1448	iexplore.exe	30
PID 1448 wrote to memory of 2864	1448	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eaa65d68eaf647162e39029edff8a3a2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1448 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f8dcd12589b4a46c677241c43806dda

SHA1
67fba6b57dfe44f640293b6a027dd4cb4b7fc93f

SHA256
cdea377e33ef540390d465f5a9ea3776c5521d5a99b87eee55e7e70dce164ff6

SHA512
f8a704c0952556091fbf66d724cec3fa761a683f8722f80d038cec1682bb8249a30b0129ee8d31d3af31b14f40acb6c2730a0b1692e19073e1b2012f3e2024fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2249601d89c3692a9e3e0c7a26e96f1

SHA1
e8b8402582955961ef099a03dd3e9723cc50d84b

SHA256
a26d955e49c3e94bef2b0d923a53d6aa585163da3d5a7472eaf29814c11afa51

SHA512
b28b12e97cd56d2c8e90b0372a22fd0e2f80dac793a5adbc73aecd26c7ef426d8c1490cc9fae1cdd348a81030cd34542c18ddd4b808292163ff4b721a1fbb3a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1582639daf9c56fdf54b32e1d5164d27

SHA1
8acd6ea04eb6586cbfa01d0726e0d14c7e6b289c

SHA256
0167ae557b5c67b5ab8aa0d6c29646946fc06fcc08c04cf58d7466dba8a286d2

SHA512
cf706d09c8fba2f9eebff416cec7d0f2531f2dcdbb73aedff53adfa9d23da57e24f81c80d8f3a169f64997690221221c1f448ed25961d1be1f7b5134068619ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ecacf38761bf5f41e370400f86cc24ac

SHA1
fecb3c75c2279bafd9e7deca2c95e83b8c077010

SHA256
311a53c79ffdafd31e222d9791fe00fdd220456e2d7fbf2b8b54369ebc70b8fe

SHA512
c9ac7ec696c4875a423350520ecdb8403ce8b6376010f6786029d1dce3daceddf6bac61b67e803488e14dc25bbf5025ace46ef716355ab27517a4b6f90777307

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86a6e8a3d521b7160f31efbc0e8954b6

SHA1
24b81df456e4ff729239fac046bbdcbfc9c67cd7

SHA256
07a920f026414a718a381a59f8527239cfd6670aa132995f2095ca451eb20b2b

SHA512
2cfdc2f3df2041f89aa8b748d1fd87d913a2fb4a7aac7dcc0e78812c08c2634ae8954ccfaf635a3b57ff79641b00d84571f5cfb2996447f3905d07ae7e118288

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11a504da80c8791defa69f17d6d799f2

SHA1
8ace9d1fcaffb940e2f7b03e0f9cb004662fe587

SHA256
8e5d1c6977042193834a267de566d8fa2574995eb5a4a9b12b9addc6bc40da84

SHA512
1d9ce3ffa86155a3d4af38384d38037244b51f87c7f9eb707373065f5c0d0be124174a904c0dbc7c07efb7724cf2e5121a17494da7955e566da2119e3112ede6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5332da10806a1690cd65392214f6241

SHA1
b8b70a62482083f43f0a34a7a92d67160bb3a947

SHA256
506586c36134874487f10906fd2a99820ed5d554c1df68b077e00dc0407a3547

SHA512
522da03ec0379f4704162436ec4fffb2539857ba6e94342b3fadbec0d3f5838e8906dc95bf58dc3e8e83224f4d581ec31e8ad5243645396e9aa4a39cb8374828

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a67e054694bfcf6781ab7144cea58174

SHA1
ee079c54e7449cc7eaf7db201ff2d3d7e5150a16

SHA256
87dfe84f82c3dca5fc1d08f69408ef90129fefe0bf1dd86dd6d2d78120a0f1f0

SHA512
ef45a838d6cc1e6f2cb7455657afa3b226b4de53b50c3d0f4e37edbab7a03d481281e343ad44895503afcafc759581631c13be669a35837e68ee48a13b3d8f71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba02fb5b4cbbad330e5738d573be2af6

SHA1
49538b8a9297c7dca3c9c86ba1f17f5fc6ebbfaa

SHA256
fe0f0baa38980af203ac5328ffcd8eb3486c0ffa03b89fc495572b74889a5002

SHA512
50d996afd7df630fd7b77ae483bcd2a496fb1a537ff2e09d4d57f2eb6fea3d68f2bcba67a6c19be2f64fe8ab081bc93902564e49ca83067e07dd35c12b4dcffd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9873abc3aa43b9a8533414241f1aebe

SHA1
7748e47f5df7c5802618296b731a154193a480a9

SHA256
199013364dc1ffcf558efcc88eb801bff14e1f3cb829417e46a1f135fa2e0c3e

SHA512
60179349507dec7f17e9e1c650588e6132ee12d71bd7f09954840f0ab3fb801dbf3855a4686d8c1035ed4d99af61e04d2c91a16732f04cca0c6450199a517c79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9df866f8d2d896f14d44a8479455bc83

SHA1
d5b51cd094d3fe02a9e031e6b91e39e5f6ecfaae

SHA256
42f532f74e40605b9e680d393f6136d6e8c0898e45c36a260eed2e9a566929c4

SHA512
f48e5cc630a0567c4357edcddcf7f6c1d2db2668cce97780c50d9d502a6f2e2ba5b09cf3bb0ed06668e5f6ba3e0bdb9b9fd45fb0dc2d405f6511ed1eeed20f92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af171dece7c92bc1c5f2b88569caffe1

SHA1
8a842a211cd81a3ca093400491a398bdc70c5452

SHA256
793b3cc88a6027e6955cb0c30fef5f0017b5901a328387ad456126f73ad6a3df

SHA512
7c15b6d8ffcae48618dfa3488387202508bf087e83a161c323e3ef862906ef2a3872c319fb6e5220424d8e26adc9451b667988b94730827cb2a60dcad03107c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c15cef27235a551dc4b6db32d6b2afa

SHA1
c4da0f7909d9bcfeb8e3ae8b11d521b3bb4b876b

SHA256
7778a8879ac6d6b1694e7d433516b21d24757d1795d548f276e3786a8f396860

SHA512
3ef04e9134093f03cffd80bfdeb85cc3f442f1db5259f56593ee85a071916417d31e350736fbe99b2e94d7c6d258e4d63b9f6cf3301bb9f3acc1f2f52027a87c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53a42cd5b458504f74759fa9e5080341

SHA1
47db9b9eb71cb87dfa82a7a9533b6e56af7d8f35

SHA256
534083a90921059b8909f5a881f03525aff33fcc4421d1eb7a38c6f4d093995b

SHA512
dd5cde729ede4901bb93db5f341a10fb80e0dc4a94c818e5f235008c6d18eb3efc2de9690401afaa0f31e624a9f886f77912f371474e4bca45c5470280541dd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01078b61074f715658dd09e1b3aa3b1d

SHA1
ca2017673079358fd0f9f4c81de07c98578c473d

SHA256
4df80bd52893259e495c7b0b3d0d2c4571dbc9595b097aea3d9ba94096330b91

SHA512
00a7cc607a00b182e1d1456a7120fbc07d02c3bd49426e966efe8a7e95632f0943855886428813ee0e2479e0d55df1b5a47ca68b48fd11ab8189393a2c8f684e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
338d501c39fc1f49300c930ca7b8a19d

SHA1
65c01c96bd5cc84befabe7345a645a3c2abb0e09

SHA256
261675ebf595afb80e9eb172577848b12737fc55cea3fa0064ae7fbbe643e946

SHA512
e2c7cc0896044e1de54c5b94059fc780a6a4f94997211ee2f64126b60117e167ef62d068aa21dd7727f5195947c31893b4154ecb69abaca691715d2dad810795

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5063f5860d4df4745fc47c256c62f23b

SHA1
e267461cf4271e7b39008db9939b9ada55c05a9f

SHA256
fa80a44bb93ad760802d16462a3e49ec85b744bee6cdda309589fdace3a8bf6b

SHA512
08321a8b7020726ffff314c3e9d63d545b46e96abff5269764c44d78f7fe8c81a258e8ffb1dac0d9e659d0e8118b669d099e46a60076314c8b2d3a72124b5106

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9be8e3689be5cf5998cea505734be8c

SHA1
fbbe4ced76fe7443183d19b4342cd4a9a76c7a2d

SHA256
21eb60275a03f410af5666b6c320a70340319da6bed004a83335c510b04dc0eb

SHA512
7acf3f1704dceb1df31cf663f00443c3a112d04f8922d3b8d5899ea6427273e1ee6c326481396bd3e646ec9d745e9df85e7b16cbbce5c1bdf7af438d81f358ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98c6c7e552748a884d27e3d9638a3920

SHA1
db7824e7d826e82f948d41392004edea688d7410

SHA256
496797101084de21eab1aa3a907b19b1382244dd6b684fb96d1996cb3727ef6a

SHA512
328eaa05e7673f0f033c3c66f3122af93f109d1bb4149cf17a7d0954a473a0f372e8614fa2d10e5f29362c74c6fac83f52c3ff4ac0417f14ef0a703ddfe51921

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab908.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar978.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit