bb66c74734313725acf2a6856e081dc524e7ebb9e69c106e37ac03e122793a89

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 06:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eacbafe738a6b6eaf978e705e9079b9f_JaffaCakes118.html
Size

68KB
MD5

eacbafe738a6b6eaf978e705e9079b9f
SHA1

f976d7875afbb86ee537e6e78f98294d148dd607
SHA256

bb66c74734313725acf2a6856e081dc524e7ebb9e69c106e37ac03e122793a89
SHA512

43f9e81e1d67ff88d29ace8497d4f0eb0667f7572ccd220c2ed29221a47f04fb7238b73988dbbcc3c1cf1cbf4c50c2bb10e2067dee924a82c2d5ebc1667935ac
SSDEEP

768:JiFgcMiR3sI2PDDnX0g6WweMVmIm4XoTyv1wCZkoTyMdtbBnfBgN8/lboi2hcpQV:JtCFEh4YTcNen0tbrga94hcuNnQC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50a3029f600adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C6E091C1-7653-11EF-A8AB-EA7747D117E6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432890635"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000e539112f399964c7fda9890a5149ff319d8a22544f69b24a1beffebbd5bc60ca000000000e80000000020000200000002a326f6ff030be0377d5a3defafdf8ee9a8d27d036155b872b37988564f9890720000000f914e933e3dee367761ee64c009adbf67d6498654902982662df7654360b344b400000007eb1f02956094ddcc29c8e8e64c7f28a910600035fcdf0b6b0a884cb9ecc4b45828ab1ae3c7aa4cb88927abbc3bfa6497eb6797f713b8edbee380663b0e03420	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000a47d6c9ce04f55a09605d349ca646247c426f78e46775f4879c951ee5cf5c509000000000e8000000002000020000000cdb9854941dfbe2bb3bf35110e3e541c706f06608af0645365e3cad2241e99df900000005b1178c41dff93fa9e6b4d6578795666be218a8fabe5cd808761b59d050838d3c1aef397a81d18e8cdcef2a36c85e82c7abdfd11787ecdc79d642d93ecc7a21a58ac82bb15508f1252ccde583a86ae6ad3b1e972ed54a8dc8f7d5acd89cc95afc1f096efdff92884d67dbdaefca756a0257296996e9f851ecfc7115061226f0bae84bf17009c9f7c37674266fb83853f400000009caa40602786b66d285413888d4f2025e0dea16356ad51d234d5962678caaa2d5f57f58326abb19dd624f962acfa3185f77378dcca35e632c8be8cdc67b16a6b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2860	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2860	iexplore.exe
2860	iexplore.exe
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE
2092	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2092	2860	iexplore.exe	30
PID 2860 wrote to memory of 2092	2860	iexplore.exe	30
PID 2860 wrote to memory of 2092	2860	iexplore.exe	30
PID 2860 wrote to memory of 2092	2860	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eacbafe738a6b6eaf978e705e9079b9f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0be8f96cf29e7af21f900a0d21db3f2d

SHA1
2d45206624a5c6c38413da394a2a7ea587e1ed6b

SHA256
6ade832b3c5ecb201dd1b12a3fdceb99113b65230ae01dbddc981121812efb77

SHA512
bec18313a5217a953a4e7ced323efc0a3ff6a7d279947f2d4edd36d33308f1378ee1779ea4ede3ec680c2224b35e1f1e0a82afc76ae8ed37bce8aafdb6ef51a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98164c09644ff384aa9cef072ef0a497

SHA1
02a53f03f8212c720d0600718e2ab7c15967e1a1

SHA256
85414146f08d408463ddaaa50a784ae2728e44d2697b997ff6633d74ba7938ca

SHA512
8b0d312ef4c6f95617170833996c3b8f5bdee233b7044ccace76d9aacfe77dfd10ed9815790465dc1ccf009c08a9732c5fdee78486865bd417b7db46d6be7511

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9677a31a827223512393198dcf87909

SHA1
714938723dae5018787c66d88b363084c2d5c7a9

SHA256
449370409245670c75be35ef807dc07a34adeb1ac82e7fb12c62f4813eefc9f8

SHA512
ec67ed85042425178c9a58db56b27812c7ddd747ddb138649e820e369f7947ecb02da10a4af27d4105905c022b52fb40ccdab83a7dea71676fec720f6be7345f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b17f34bbef379e7e4a4eafc8f22bed11

SHA1
31ed6b8718736be6f6b0770737f0937f4c750dfe

SHA256
a3d81b0fc2d7ffb20d264f41ad0c47b7f5be23f765e3646bb0bac53240b76912

SHA512
48db96ef52af9c5fad855a99b184849102d43114f4d7953f337cbcf56ff46cf1ca5192859978a07b3d8e553d98058323e10da3ce79a1faed71249e6e8b6edcb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93ea7ae3e878757019560a951b2188ed

SHA1
c99c903ae26b455733e1119e104b34949046b896

SHA256
fa02a7c6972e8c41ac4decdd03bec0a06e54433e988f83ad6906137daed1426a

SHA512
a39511e368e6ed34d2430a8617d251a644cea266575e255756c108366d6e4565451152e2142a10553b6269d116f79ec34fa244e050f912793a4129d084882f65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b55e8f434ad5246f9d5300690e0f628

SHA1
9502526f9099cdb30e245088fbd4a2936c3bb62f

SHA256
33ce7e83af366b43e1993ecd5c11a3866dea7848a49d9045d8cc9d63e466488c

SHA512
f9c95ac3576d1d6f3f82b2d0933c27075260e1b35549bcadb95f4e18fc26aef2b549886b046e326276efbe5829d23a3256c8b47f9d6b44a08f30232a5dfcc659

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2164abc6d41c6b041c47cd9e66c21328

SHA1
b317dc3d90e364e9385ec9340625fe154da9560b

SHA256
c2e833a136c1362b154bdad10d9ae99b0fbfefc08417244dca23636d2145ff92

SHA512
ad9a32fd3cab17c9baaa81054846ee50e804704cc562a8fc49ec952ceb9a85fedf2315a202dec8db48914c1c1850ccb2f7b1b5051c0e00a52691378f43abdbaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88de465fd0ead3d58a74413ca4d2d8eb

SHA1
c11beb0ea81982d76cedf108221260c18e0221f4

SHA256
9a252a986b2ddcbd893208b949507844fd2f5990c789d47ceac013d5563a214e

SHA512
4f9f1a947684691bf88ec8957e668e1cc483488704a6da0ad07ae5e6d912400520c5ac9a4395afb218f240d55b45b10854ae8ae1bdc8ea0274dc3c6601190f89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e021f5ed9e9227786e4153b32b9cdfdc

SHA1
7ce48cc42a0101213ca220680596ec0ccbf35dad

SHA256
c5e7c3c631e5004739cd54afe8d5de7ba186543f99213ef283203ae3fa45afa0

SHA512
036a27552b516fa933cabbf7b30466de026ce464407f255955413cfe173fb72b86bd0b0ce7072bbe9c78ab262c7515a45eec08c97100273e362444876bc38bbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a1590a74ff22c076f4223f09cfd2892

SHA1
3f066b84c66e10c213a29ea3edf3ee454c326aa2

SHA256
84df889747663b1cef032cd39da6f96dd787282d1883f2f3dbb66feb2c28a1f4

SHA512
b9a2c993d56a1ec1fe2ebe220ddffd4662375f3049a67371161163fb0b610bbe4769f66c150e6d5117b8a515c2582052fc18a1a90ab2b36f525b3f11898da52b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41b4a12ebef311a38cde4c6343ec2f34

SHA1
070e5269b7d3ed75fe2312cd0ce0af2610ba1137

SHA256
e9252f3bc2a82bb2f2e451a23e6e9cbc190735565f20509291f1b05d93c8834d

SHA512
5305ccd64a1f8f40f2758f626c758cf0c8f1ddeb84c270640a211541033ae97c906a41d644c029690d2ba4de5d3bc706fc74daa5e8b19365279f28d45fb9c64b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f1bc9b4c4deee8e79599853b4877777

SHA1
1b5ebc83c15e9506bf0cc680e29f1396bf1dacce

SHA256
30aff87a7f87c8a467fb2422d72189c90b2903e0a3f87dc2f5e78ba5c9a0f84c

SHA512
3c22dab80a5511e584b5c0af4a78fe90665cac4212be39c6cb4e628a7425c3e226532536ecdf64a929b6d2ac571f4560fb5a62ea22980c22c6071782a2bf015b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36ab91cefddbcdb74e53984dd56ce163

SHA1
1e617da3f159f0dcb7e874590659a9c4a677a120

SHA256
1ae4ab202ebfcc5de7ca828e3d1e8d40dde2a8f5fd287b1aeb5d79b7514d2388

SHA512
8ccd683cfe73272cd2a035c21c32ae5d258e33d5920e90e4fb244c810f135561c68c777bf96664584aa65b9fbbcc1f0403e003ef697524b29c66c3588bd94ec9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a8211e8dd190d26c83a64317d070364

SHA1
59ac1c5063f52905636d360fc6f62152e91f533b

SHA256
a9cbb166641eff29692b710104fa0a46d02f65500313c6ba675fc24fd2c23bc0

SHA512
11d97d3e39b5d207b1fa949aacc239a39e17e487e2e19a17f60403b01d4d4d3dd9a245876c57d8c314b7f9fbfb82f99369398140c37082816eedad22c6e4d7f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7245f14175931ea9e4615677e27c9eea

SHA1
b28cd1c44c2483c5527d601c9486e58287820a40

SHA256
1db1506d064c83e84d5129391a01d5dc193f7975edddf7d8dd47090bc0678a0d

SHA512
56661afd8e6c5086babe82f8aba15197a00131bbb03e6f495296590fd37f312260afe36ee3193d1ed9c305b02606cbae13842b729d0d7cd23e7474472b81e656

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84d7fc785fdde4d3532d562c21d00a5a

SHA1
13c053d6c5190e32c2b7532d224d4a5b18bb07e2

SHA256
e3bb6c083e8f21c8e46ec5899e356e8a2f14dffaf846ce174120945db569a980

SHA512
819de64191ca1d243bf9a1ef950c68152074f09adb97117a39f5c86efff0559d1688e707968840adc93d01a6cdfee7cf7a6ea285cd876c12dbf8e9a6deeaeeb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF200.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF695.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit