35ea50a1f43adad6b354cf292d665cffa8d3cca2336bbb1d26e803a5f051d597

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 15:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb9c9c8aceaf246c81c8cdcaaab8a541_JaffaCakes118.html
Size

69KB
MD5

eb9c9c8aceaf246c81c8cdcaaab8a541
SHA1

42f62fcb513f4653530fc982186d1b02cba0aeea
SHA256

35ea50a1f43adad6b354cf292d665cffa8d3cca2336bbb1d26e803a5f051d597
SHA512

faca28eec47f95fd7d7848f9a6d4be6fe4e576668af81578d260d5c6fe19e759f9a7923fd76fa90e9bb667dc723cdda3437dcd3b8e5c1ef84532e4b44b5404a3
SSDEEP

768:JirgcMWR3sI2PDDnd0g60uO3QoT2Z1wCZkoTyMdtbBnfBgN8/lboiGhcRfQFVG8F:JbR9TmNen0tbrga90hc+NnhVJ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432920923"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f000000000200000000001066000000010000200000002ae226159018c7323c2913903bb3e513dd7d97325d7d77f4b133d636c261ad83000000000e8000000002000020000000ab9a911879da875425ff13a6c59c4191c72dce7f3efa81c1e519822413d7ef6f20000000180bfae86ecb80b728ab7cabcc4a873ce7c6b6738cab5d6989fa3c82623ce47f40000000445d2bc028ff648f6600244f3c2589dcf6137a3aa631248fb7f0067f98bdd286077234bd93d0d0fdd83b85c8877677bad08da6271b2ae89cbd91763c9e5442ce	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000938f3f1ff9de3355453bd4479edeac21fc89dfcb89518a09fcbb5c5b7084c487000000000e800000000200002000000077bbd9079e68dd4370292c92519252104a0ad56c4a881ee6938739f5f4abbca890000000a7360b8a0fb603a3ffdd8aea89a9c6b8038c97da942a454f397c7244cb3d87bb21ad0b7ad38dae0477fc2f7d8471758d0967de0898d9e028a0311bbe5cad97867177a708e5aaa94ee47fb1311a1b6b36d379b02ecde47cf63b2ebd33354d57e0cda6ff1d0fc8ec195fa30ffaabeb6a8705129aca523021e691972e827d4375aeaf2fd2b7c1e5a9b5692e9003ff569de64000000095e7ec0aaf65b3140d791cbc0b1f0a5d8461250a33f8b07d8a6174db7bde623841d5e1284b9690c292ecdbbe3554747d08c6e607fc37da3c5592ce77441efebc	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1054d221a70adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4C8BFAD1-769A-11EF-8C8A-62CAC36041A9} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2656	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2656	iexplore.exe
2656	iexplore.exe
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2668	2656	iexplore.exe	30
PID 2656 wrote to memory of 2668	2656	iexplore.exe	30
PID 2656 wrote to memory of 2668	2656	iexplore.exe	30
PID 2656 wrote to memory of 2668	2656	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eb9c9c8aceaf246c81c8cdcaaab8a541_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2656 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce98101fa60e0caf056a9784914dee80

SHA1
e0e0a2defb0d32b9df089500cbe9318c15541377

SHA256
b47d898a296cfda048104f9099559dc46c3f4a80cb37a915589b7923d99d6c8f

SHA512
fe920556d21b9e2778cf95eb2d2d4e4d6f405820177655571c9c26d603233906218f72edf498b186668837ef91fed66ce5dd56a284cde4921e1db69d973ff2bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3415730a82a2aca56fed176a1c7bf8b

SHA1
df142e8d25b16b3a05fc99ba8bf3fa73da113603

SHA256
3da38e7ad8a14b20710181eb85353de894e40fb1dad40acd7514c401cd417298

SHA512
f18036fca4decc1f14b1b2a47a47262eb3b1abb3ffb83267c9c37e212d098d7fbe25bcafea21cb15a7cd05ca8091dd0427af6dde6f1a28efc8f1b2f861022296

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05e13debb10b9bfd9f7df1b52753b241

SHA1
ee63f575badddfba8ef05dd8de7952b07060b1ef

SHA256
e0af442efb3a12af4efe060d34c2404e00a7a8b09ddc4bf98a77688593b46d12

SHA512
3b1da2b1c8ba548af42b09f7f6845c8cef49aa47f378e55b1dc8617396a6bb50c2275ca3540dca2c6a8868195aaa468a02cc70b1e002da8f0b62fea50bdd9b79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bdf8c07e59639279cc82cd1c423556d7

SHA1
dc5a7775f385eac2a6c87d613858edea1afc3238

SHA256
2d4885af608027cb39a1b87bd1e7f623caa4893476f57813557f4627f7ad08cb

SHA512
a0c11a8bfd826f1d9677eccd75c004d7d97538acb9fd28f79485dc3399e6927036de35e88f1535ef2fd5b3e8dd51ef07c2c0f59d9d75e228576acdd3f933cd9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f42378492e1aed8ec23307d281fe460

SHA1
3e93731eff348430640d9805d1c1716d4a4e5b31

SHA256
26da110d3267eb093d5801356fc7ea30654bf855cca66db29a0c65e5f378ec38

SHA512
507a6e326e5b0c85e2d0265bbc4c3b5f0623bfe3faf2fcdd9997b94b0906cf1dfe9821ecbe848e4ec9cf41768eb1895a766a5d918882e2077bef47ad481e524d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
482a696ddb0f4b3461b0715cf1ac890b

SHA1
8d82214c85ef0d663b29e9dc77ac6edc72cf8d1b

SHA256
0ee7ee6063741541f7738f33e75d610444e810c11d1a953c18be3ab588eb2091

SHA512
2bcac9a2f4762a067f792f2fa0348f3a3f0d7bc294d4643ef3e2921972fcd38f0a4558ea709cea08e665be08431a319676c2eb4372b0728d8737a1301e77e0e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
077e537fc10b3d1ff15a32763979412c

SHA1
9d58e845c16948fae9d7e0881320cd769d90b566

SHA256
173e6f0e75e0c2d52f6154e5a2ceecfcf74a842304051e305c07bb219812caf1

SHA512
d394d361dee4e6b0c6e0896a13d05ad4648a87a377f634a386bd55184d8c162db0560b9fcbcce508d900122504798a18739a2f8bd6a0885b918e98dcdf35bb58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aab2bd32ce469d9e43459015dfe36335

SHA1
626237f1b31a1e6dd92074c8be95bda319c4008e

SHA256
8baff0a5848801a1ebe5c1ef733b65c0f7959ab102a31b88fad019c24cc00a6f

SHA512
1423aa287bd0886e4e30a43071c54aece99ed3571975e3eac6fa68b1fba63c656ff90bc17ea9fdd88c9a99bfcd0238dc83ee757345f5481018f2532c0cc6a15f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d640407ea5937a41a42058bf7f6902d

SHA1
5a768c24f537cccaaec252ffbdf9dd65048dfbd0

SHA256
42f10ee5f7c1022a736847d2498f5358d32dcf5abacfc8d3c5159d746733379d

SHA512
90cae85933010262250355a359c3b9935fa204a8cced5443df86ed17ed1560f28cea3e06b609021d318e1d9d7c9ed0edf9b3052f453f1084661536beb86b98f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4894e9308798afb22f653d1089cd5a54

SHA1
f6ecbaad40c17de1b92de5b2c9e1d784b2641c59

SHA256
6790a31fb70599e9323b7578d4ca616560b9a86daa17c9c35d3b3d22519dfd81

SHA512
c3f85a6670091afd34e4f0a1f82ff908e88d24a8af950755049538e2a5d899534e7be1ba8931c8766761f4e52c4032877bef6128e22b93d558f67b3fbe526d11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88b00b3b3fd4687cad5abe128d737d5a

SHA1
fab827ad317274fd47b564877cf4562e6bbfbea4

SHA256
5f696a953e40c45d24b5a39d5a582eaecaf5c9aa6008b7be897cccafce2967d4

SHA512
68a08be192b1674f92a46fb367f2e5745f6c9f43026d5bc07c8e1ed8b0b7d83870de1f9b188c8d7467a653a48d74f89a1b099bd4b3f58b8ea695df548838f036

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1AD4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1AD5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit