e8b8259b96aa7f4ba4187f2073b7a226c0e7880f55ad6044a84d1f5f62dd8355

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 06:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eacdd57770c1cf4affc1bde3cb0ffe5e_JaffaCakes118.html
Size

11KB
MD5

eacdd57770c1cf4affc1bde3cb0ffe5e
SHA1

a1221016017fd2ee49e16191b8e0bb6aaa080dfa
SHA256

e8b8259b96aa7f4ba4187f2073b7a226c0e7880f55ad6044a84d1f5f62dd8355
SHA512

b1942a37f79e1482ecd4ad3a61b40888bca264546a79e29ed3deeafe6e1c788b52f30e292a73262faf85102cfdfc3d18c470dbc942aef119972e541628b93ad0
SSDEEP

192:FtbTKm06aakxNczfLb9BnT0S0lFrpcfRo467POhYL7dFeV1/Wt6GxtBFXDOdq22x:FtnKm06jkefLb30SgVpcf+7i2FMXgHBJ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432890938"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2032e151610adb01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7B83B3F1-7654-11EF-80BD-DAEE53C76889} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb470000000002000000000010660000000100002000000064bccecd0d9e48c535943f576cad0f76e4ab856b813fde675f737b4f9d60390e000000000e8000000002000020000000b9bb5f6771bad9f62b9b2f7bb1fb5ced9b01bf6470278dfd9a4e0794c1268c8520000000dd0c443020a3e292cbde7e129ce52e0fed6f469dea1479df058d3f508d5c622b4000000074b7359e0b90def269aafa1e8d0e95976c0261e99f678923c917b5e4a431a82b37a31bdbdccedd7a046b1c5672a63a15b78fc8a4cf0c72391ee6c6b68d26ffa1	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb470000000002000000000010660000000100002000000019b415f08365e3777d02f63aa9e048b8d234185e7d5f7a77c43ca2ff391af54f000000000e80000000020000200000009a298fbe2515f783298b60348f9cab8a88b0a264d9a9cc76b77d571a74436f8b90000000d9a844bb87492f7ee0a28acbd445a57e9d7fc098f757afae3122dadcb530b3577160e1f162234b3f064bf1e19ee5bc526041574525b5903fcb53b7ba80e7a91e01daa60fb7134b3d854867fd429ff493136f72e9084b166562d7a8164b054bf736dc9b67889bff3427f3e7f8334dcedb6585fdc844ea8ec937409e500e08f511681ad8a516cf448f8bda90087f78985a40000000549890348e71d5d08dbdbbeb44fc15da1bdef2d1527ee697dc8460240f95b5379cb13a84ce80944584ae673f0d63f105d5726afe69fc6a69ca374463a8271194	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2092	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2092	iexplore.exe
2092	iexplore.exe
2952	IEXPLORE.EXE
2952	IEXPLORE.EXE
2952	IEXPLORE.EXE
2952	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2952	2092	iexplore.exe	30
PID 2092 wrote to memory of 2952	2092	iexplore.exe	30
PID 2092 wrote to memory of 2952	2092	iexplore.exe	30
PID 2092 wrote to memory of 2952	2092	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eacdd57770c1cf4affc1bde3cb0ffe5e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2092 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b0e29a89a1d5c670ddc654968126e69

SHA1
178037a3e55e705d0eb9e40275aaac160b63e0a8

SHA256
86a1946d34e2a476dd14d1ee8ae19ad2294dfcff4200c20c2e70e05ed7a2ca4c

SHA512
5bda49e3cde9761be3e5b7f6384e2d330459c0680cd1bdcee9e2e6a4495ca394a71d173de20bf1aa29de93ec1b9019f71e62f2422d21937405d941f5bd923fb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61f3fc5bb7e7c3fabc2fce56e952b193

SHA1
87eb632eba17ece978479ff65ae320d42665532f

SHA256
f2d17163857aa3847536a2448e0efc19409a976ef9c67582974c7152013498f2

SHA512
17e3c113bdb856319c55bb41886bb86a47d4fe6e8333eef836d6b630005be1772f1ccfe2defba5cfda590af387e72f9f706577320a96b4067eb0d965fc2e7523

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a75e278b2390133faea402544ad4c1c

SHA1
9e0bff3ce6a6fb9b10ea4bbe979d7d449b10afb1

SHA256
43cb2dd4d11d336fdaebba8e57b3161ec642a930c5301db3cc737d66da81c5cb

SHA512
69eb9123e3d7255b994387139116fd77cde5a62852dfbd919370d4f933deb02b9b484f8b767fc4b9642e6f36155c8798654975819bb383ce964e1bd89d694cb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0beb7f6e0f132ced8f4e6f733f17d741

SHA1
365e8cc54e0aec517ac0f92218fdec6d8bc88ce3

SHA256
0cfab7ff128a8b9281e1c6a15d5614e398b67853c348a4dd55c60a5460927d96

SHA512
2ba6ff1914348c8e4793f0da30bef1697875ca6e3443e98f6ec5c9e16b67c63f21e4aeb0daab6fa897f4200d0854a8ad1c031652e2e484071508f9e30f897dcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
619c1d15b98afd6f53b451b0d5a9e3dd

SHA1
5f115bdcd6ac96fed86c55e392ae44f78682f05f

SHA256
dbf5e47f90443b36353be749e46958d196916b8dd422eaa215e13011154686fd

SHA512
9276bfd6e9094a57d8e07ec8d6c02c0163896fdcd488299829ceb5f2502d68c19c3fca80bc1a0336a1bac31b451e70ca466fc7df2e48cfa9d89116e6264caaef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c1ec265681b90132e8ac2a27f7a1ce7

SHA1
48f5456d20a39c9ce23e587f8b4d023e74d8016f

SHA256
70744b83048c4c07ed0a0cb340af961a65a5f98200059e87f84d5daa12c1eb53

SHA512
ce3f89bfe2a531abdcacee7941278885dc37459fabafe49e475ff0ad7f778056aef543ec93a13a6fe6dc5ac30184ec606d8740ab486a357ea6d5ddff12956e13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2013835fc9cee29fb6b41fcf20c2f7aa

SHA1
f5f934356075c73b47df2d5ba6f1363468bbbd2f

SHA256
28fa80b61285df3b770aa1b9bd96233359e4ac282a2c707291fee64a30a2062d

SHA512
4cb9ee17628e8c173601ff18bd8f4d2130a4684d5e357124d07a0aef25a59b62a425b9ea663da739b0b5a4dfb93bb9b9e56a5f5b51105bc2f80ceb710a6f5f43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee5d130a9bcd31fb5ac2b0cb617cf65c

SHA1
1811cae64e4c589f2ef92a11d383a9e6c82dcdf4

SHA256
56b432f3dffb81c0ede8e2e8075cd327b21f2b2bb2954f38e0c91e916cacf8c9

SHA512
966fba09429ccacf2beca52b41f167fd3ae502ddafbeb826ab054576787b8af63bf4c79a6a6699727fbb7d0d639075e17d0c7df1d623811ed22223852c590801

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef176740a3eccd07f6c61fa7ab0df071

SHA1
2c89216a09b4a0a538ea6532bc24e3e70795265e

SHA256
080183e09b7f117edb0d633316d6b0d1d0abd1467eddab8e7c51454d61febe50

SHA512
fed6281cb8a0734334fc8d53b2e5511a30b718c0ed9f9942f4c649e526dc626e422cbdb32c01421cb9fc3075eb4a67c9fd4af951b00ca496b0dbdc6ec2822d96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57d7f7266bd54cbcf804fd76f001b029

SHA1
c1e3d0dfa8b8142e3119461936d6944ad156ea6d

SHA256
a653615ced5b08d894b710db0b907f08562ee662e46bf432e64b0fcacbeb2e80

SHA512
11756c608ccf294222077126aec27f181b124c94fc92a2af4b82c6d1b95d363f8d8e853b194ec34e45432ee7b883174164708ff63696df6e73c0cc0fd7d177e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b4796145c7577fb60c62855f2b39c3b

SHA1
cacd94977997c76e8b8cabac8f000fd4f5fd28ca

SHA256
8000c743703bbdfc750fd61888c2bb096565243e675dbc573b6bfcad80678db3

SHA512
7ff0cdf97a422119552316ee613a2d34a66023a543cd1bc70dfbcd16121e866670e256bbc72313838e9dd9428968eb2112bdf595b02fe1e3a9e4e40795d385fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5fc4f9aa6ea94b0ee1cf76e261e3452c

SHA1
4b232d89224579767eea4954e0f9e1e67e47c3c0

SHA256
2b13de4f92503af2ae2ded96a4f6affa7b604ece118fdc5168af4720fe334ae4

SHA512
54a07191d148b1b001f226d82fc498ca0d169c6b6af0fbfb241f1e5bc39f00420c12ac79157213abd276dcebbdcc95479fcc2ffccf95ae21aa719e282fcdb146

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
508a08ae3ce91994bd9b5cfc1b27e443

SHA1
b25a2e10218f39f666788466f8b9008d28717cad

SHA256
0ba7387e04cf66067b6de9fe4a73945ed7f9d8d907b4a08717edb3c5302a6399

SHA512
8735390004136e15e0cccbb55ad934b0a5ad7bc569b943b84cff9dc5e823a8f3738d15601027a8577b68aa5be8968d1d684b86b371adab8382010610f10f4cc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14e5a551160c8188d218344ceb3cbb0f

SHA1
d6bdf1eb47d2761bca45c42d46fe2b4cfdf92581

SHA256
79a6b4fb0cbcb2f8bd6d3a796ff38193c773d8793872bac5afed6ddbe955d7de

SHA512
40667b253c874ad8343fbf6e97252782031c51e166cfcce9a8718cb18e9d3ab61faebc77a320f4b81eedabcc607e38b9085950cefebcff2f28703502451226cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a90fe32061bcec419a532270063114b9

SHA1
c51fe4f193ac4e05523d093aedead9d2378a238a

SHA256
e8d56de3014231eed9dfcdc27e2566bd58bb663db50cc277fabf89699f7c6430

SHA512
273c8d653499096025ceff0c95ddcdc2e7e5d6f7352e123664bfc93d9e6eb5df96373588d8a24165189632ac7e96a78d89e9aa2f78a37034af172800163f3e74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0c8fae1b3ca4f2238ff0bce433e9176

SHA1
527d2b19c0aac7b168272348f013817c4016a578

SHA256
77d82559560066347f15ef73bfb052cf3bfb41858352adc981e1c8794218e888

SHA512
0f0160946dbd87e2b1d9766f3d228d867c43608ef9ef49f5b68c5c26ef88f5247938f4490fa734c6e8227300670b74597371cf27a01e3a3f116c16cf3ee8a7a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a377075e0602512d2106178cbd8c8e7a

SHA1
18d97adf2cc4849ad94689323b7e77dd63e93503

SHA256
193e79f0faa64c1383abcca26093b60e746db895cc186151b258762e88423131

SHA512
de6b0b0eb6d629659c72bad8ad1aa93f349ca78a05d2fb7ef236e190e5d2ee5ff685011f72aef0f43d717ab9c7913d04343e90ef55369a8ca2e1cb5cec1c2bd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB06D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB12C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit