18de15694fc297e08157387c5e14aa907d7a1ed95ace05ec1c2da1d8a79c9cb5

Analysis

max time kernel
133s
max time network
131s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 13:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e052106e3cd82b5d4c3a0d815759a2a6_JaffaCakes118.html
Size

876B
MD5

e052106e3cd82b5d4c3a0d815759a2a6
SHA1

eceae4d966707eff4bb18748ec750160a6fe676c
SHA256

18de15694fc297e08157387c5e14aa907d7a1ed95ace05ec1c2da1d8a79c9cb5
SHA512

18f619373e8bfc7eb9fe4cf7d326db2cf8145bde335a518a76ea8ab4becf335bcc82453c83f926a5953df08b189d4c3752bc48632c2bc92ca12e47cf51b9d865

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C69BDD21-72A0-11EF-B5A6-7A9F8CACAEA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432483900"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000f0c515ca64f6c30cc1432f8ef9b8bb970607f74e413a99914c59e96a56d56854000000000e8000000002000020000000b8dc2e65b489a48642328c362e24135a3bdcfae9a8c774b31f35580347f817f29000000056d27f5aa3f2bbc3ba694ac54302509141f759440c2db13ae8a71263f428d270a25398a2c98fcf2a420fe4bd012bd7b67ed3c64cc3d9ca6550712a51da68b80146a46e962d684851d9a5e3a81011f588653300f0bb8121f3c35777432d7f2a78e6254d2e592d40f11327d518682d6572de7146d9860512f569b0f102ec4c7c5ee60bb98b03f988d0fd8b80c6ea243acd400000008386bff5801df1b4d1aa4a31981459e0faf6ef9bc8fa2a522003e90c86befac33fdfdab2e2a37c6ea9341ba4c18e123157f24ae73d297012006627e76d728083	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f5420000000002000000000010660000000100002000000030f7449eca7b3f46b50fc01dfe34df252968b375eb7740fa497cc16f1b13d4f9000000000e8000000002000020000000d25b0c5699790c0a0c9c5de085dfeaf79db2f92dc7ff3d0dc534bf54ef6651ef200000001924a6086ce712a7826e0c4264d0fcb56ec9eff46a07187305ede930f017859b40000000df94b4d51f82c8239cd8c5b2e8c4ea4daf5495f882e73accea448cfb75df87dfc84c2f23794dd83ed6a1cb5d329957614132018c689a07b848d5002f0f5ff95d	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0703c9bad06db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2112	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2112	iexplore.exe
2112	iexplore.exe
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2360	2112	iexplore.exe	30
PID 2112 wrote to memory of 2360	2112	iexplore.exe	30
PID 2112 wrote to memory of 2360	2112	iexplore.exe	30
PID 2112 wrote to memory of 2360	2112	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e052106e3cd82b5d4c3a0d815759a2a6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f22fadc3e5f50018de3de3cd5384ec3

SHA1
d96e030e96afd1f4ce361288520839fc2fd112e9

SHA256
712e729371a4b9d5a58162caef43ba559d498252806913fb2e0d242a65c1c331

SHA512
2288cf0b5e3e7cd98fd198be3d9d3e688c1ecf24b67d20b6f9696eeb81c757b8c3da33f25a44998f98fc8a02fa1405a47325e7c5e96ac9ed9b7535d9cc12a6df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8cae8cb98711c27dc5ff6a8ee8b0fffb

SHA1
9bea970ef76ab54634613fa9f7ecf88bf48bc1da

SHA256
48b8bf1f24a72682f4b4640f2345a0679e1b184eeb8f089bad7e5ba3f901e072

SHA512
6006c00ed8c0a59f2e66487616c2f66ac7b5b3af0950bd7181360ab4a0e1864c57502cde0adab591fd391409afdf08b55b959addc2e9d21e697c95e0289087e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2ec73d160cf9649ead6b664c1087f13

SHA1
9ef4d818cc48e264d7d0cf8751d67aa0a00cae17

SHA256
94e2164d46acf4b106330e5e9da27a01297aea089baea6b7b1c7f6dc19d8edcd

SHA512
a52ffd5059f8573d77e8767a20c89a07ae81b5edcc7555bda7539220cdfe9d78a30813c2a2e533d032800bfb4a732f8543e4ff668ccc10ff014bbfd975dee60c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
471a3b88d51acc204062a2ec4f3d1c44

SHA1
7c2f0e1730408d8bb221e10b5f1910c2115b8cf7

SHA256
155cced1e98ff2339894a708dad9e1f8603bb245fe4123975ee9457d8b62df5d

SHA512
1183beccb7dec7ec7956e032abdf8be7c11f65358c03e957c99a15122968cd506a956e100acd8e6e8bdc642988b876cf94f29ae6836b43d56f278d1ad668574c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2cd2d5ab3dcb483e2d99fceb91588db

SHA1
b25669a15b7b553bfee1d314b807d77229f31da7

SHA256
1253897711d3ed75920d0917a2a372180f3dceb321329f7ed28b244b869fd49b

SHA512
45cc6c55bba07dd95f07492243ed8854a21e80935a245e906d55771f61136a4f7e4daf990847c8d088f9e8b828c9d2155f873b48d0a7f127e49214f886075ba4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cadc7ee20161921239442af9ac6dd646

SHA1
5727245266145c1fef3032cc6109950b5669a2f2

SHA256
19a46e4b7993fd863d0d831cdddcbe341aa9f968e76d9251aa31373dce62555d

SHA512
427f0706e93f97bb6fc0e660dc26913629441aedd5ecb37eac01272362fd6a5ee2438ac4aaf9784682b39a89fd926720deb4788ae438705fcd78c1527a2da359

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d792bf29098632cfa32807d02493ee94

SHA1
bea5481fde702dc595c894835210512a1914d18c

SHA256
a057741b60776222346028f78009ca88034e37c695e1f4278ddc7c9390319d76

SHA512
a6281162f1016af350787143d46169ade865213668a6fa76fb8aa080205a0b7344d7ed3cb139b58690f43804913316716509772456b663bf1514449ca78c6239

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8818999cddddefece387db94c77b9539

SHA1
901ea38aa4d4788b5bfe07c22fa5141e9b05ee8f

SHA256
bf68da5f224abe2f1df76793d3c47718672a9e24aaf561b577542d54a36df3b0

SHA512
3545a57b5386d36f2682aa431dc37f086c7dda8944311129482f9cbea61d1931104e12aacdb6b35269c253de5e8154630fb60bd362b6f72414354563c1d00528

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
971970fcad755b915db31098363ba723

SHA1
6ce19145eef1129976fd162e2a3e624f3bf56eba

SHA256
041558d6f35e0b680d09e0f5e9696c5c588c091465f3c81640dd2f0e435944fe

SHA512
c91e3e181671cc4b8d7f200f42c37ab7111166a2aa07ca1f9b96d6354157937a599b2883b989a5adb4f7743fdfcc53f6ea6b5abf9acd06e4ec72aba79e2e2b06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02a06227b82650aa741843e35aa1e92a

SHA1
3ca4c14bb9dfed98febea1d69598966d75d4b197

SHA256
d0bc90700c61269f347e2c25c600e54d3b93e66e411facf201393999d6df7fea

SHA512
0e538e54f635a64f1f9e14f12c4f2c9a933833379db364b56c2928c14add94d677d3073de5a660d12b8783ae31543020a17ba511fb96eaca2c88ea247d588837

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79b7c380e4a71935b851fcdd177764a5

SHA1
04806997efdbb39068ba9418c8b299c603294666

SHA256
d0584a743d9e8d834235b2e77e47bdca0525340f09fbd760423ab3394b778dc6

SHA512
fb64cc6267def7bb2a4702832b13132464af9a63f622f0c5e72e26e373fe6b29201b67123361852151e3ee174b8456ced81641060cf6d3c456d30e007e3ca30f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91e32bf19848f66417e1bc9d3936e51f

SHA1
a46cdb95931c8d49a312766b18e066fa0e6beac6

SHA256
8e6c4fe8e6cdd7d8b991fac42e6304b2bcc4ad6ec083e4b543b133be2bc1ce4a

SHA512
1b74e224286a67ca2be9539a81561a93e1ee08eef4378cd54d577e3e8360bbd5fa243a5337c56325753d9c5a3a22f561e799dc3ccd305164d70def3bf3055213

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89cce1e5942620202f9355fdca3b9cf2

SHA1
92bbb07a56669a6a6a81640d39a4c0aede0e66e4

SHA256
eee3d7eb2d6af33fc4efc6ba05491982d0d8bfacd0a9dad3af91aa4a37fbad8d

SHA512
633da511bdf8ec3abd3e3c672a30eb23994458f48924fc25b69c4256bfef07ed230af7e1fc10d49e8e43a8010ee892a4e72f224c55bb8f8b7b6ab1dbbf00377e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7fe6a35ed57483ffd02df10f366010ff

SHA1
3d893d4703181b4994d4ed3935cc8ed73fe5ce4f

SHA256
516a3c0f6a97999270c9357de612a4d721e86a0c9d42169e7c5c10a1a32364df

SHA512
e0cccff874d4ee86b5e9bec650c2eb53eb4c0d7afe2c1789cda38059b4916f9a7edddff9c25d0a3de2a036c9df38ab53199c1c1dba3ded171c89dae5b149b5d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55f7229d6c33fa1b02243969e1454a62

SHA1
bad4c4f61805abff7f754de33511badd6290356a

SHA256
e2313dda826446f2d58c080a0c27204b1b3f7e348d7c2a778e23832a6d465d99

SHA512
f8ce2bdd2b5ff7c3b28fd61a8fe97e4affa85eddc6b73552c46635ae25d9961e86b952e5bb9c9594cc8bb02806989f073d774a03dbf8691ec42abbfebf1effda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f76fcc649449f5dcadc6d66ba386044d

SHA1
d7802b67eca69dda219cee6bfbe1fd7f08c9c596

SHA256
cae9af785c9d05351615745616a2d0f3d3041aa25c9cef52e0c49ed564c8684a

SHA512
3702b7b814bf9cfdfcbfb6e9b814607d59098c5f083aecacedbfd4b9f2641ee4699a10047dfddbe4d0af31a7bc484dcd989eda56700c3a5c39eae698df8686ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
566cd8fac298503ff2870e36b0adb476

SHA1
4b9e15098f043e97a634fc8703ad45e0d6c18beb

SHA256
b0f1d4d82723ee9b7b8a90226d09e153cf529d5a371211b5cc36fb306801d0e5

SHA512
5e72818c9ad25086996da919730417b9162371d186651ea2571116d46b36ae869aa556a489e8f9725becefc3dbaf8575a2034ecd5afc693458538076c088b9ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE7E2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE852.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit