36727013ecd1b36a805920356b1069b1b322194ec5a6a7e7e457379cc67a7421

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 02:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea69080621b4ea97638c6d33e510f043_JaffaCakes118.html
Size

28KB
MD5

ea69080621b4ea97638c6d33e510f043
SHA1

4265f6bbb09aa44548d1177c0f113bc61deeb35b
SHA256

36727013ecd1b36a805920356b1069b1b322194ec5a6a7e7e457379cc67a7421
SHA512

711b1944924bb74bb468cfdad3b0da5caf0fe9f7ff7ec48037c6a91a184b7cacf7710931d77a49ebe0cbb54401f30c95da6d35c1f2c1805d0f59f8b9f43f8b9e
SSDEEP

768:tlxMRoe8CSrCZSl5pxvhHpIaE5iFJesC8/k20yWypnk:mRiv2Sl5pxvhJMyRnG

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432874369"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E83787F1-762D-11EF-B25F-FE6EB537C9A6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2288	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2336	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2336	iexplore.exe
2336	iexplore.exe
2288	IEXPLORE.EXE
2288	IEXPLORE.EXE
2288	IEXPLORE.EXE
2288	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2288	2336	iexplore.exe	30
PID 2336 wrote to memory of 2288	2336	iexplore.exe	30
PID 2336 wrote to memory of 2288	2336	iexplore.exe	30
PID 2336 wrote to memory of 2288	2336	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ea69080621b4ea97638c6d33e510f043_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2336 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3e14e0a04e3352288b68c5f5d744360

SHA1
b0947df7714fe80be16f0da30426f430cbf355d0

SHA256
4b9e9fafb97363231ef684c5d2e7fe6893207728b1185a142363d94e44435b71

SHA512
501e950877b9f677b0182770f87d6a542a5aa194e8b4367c0ebc9541533fee0531de6e521caf398adcb54e266db1fcc13e83e55c2987c43ce220c90cf0a9f2a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f649491449a7dfcec3f7134c69eeef56

SHA1
1669bce8b43b4602f2de3c1b504b98120e33f8ea

SHA256
258caf7c0566303b5c44716056e36255f1b8fa8999c32fa359781f61e787831c

SHA512
3a177567ac07466bbf7bdf5cec43301863b6c29ae473ccdea03f1ec1a2ef476b143debdfd1c543416b81d22603baa1f6520133953a8ddd6858858305396da5dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47aed0b89a214b34c8805adc44cda212

SHA1
dfdb96ac1e96f8d07cf54b524154dab1e6e741e3

SHA256
0e000f55c047bbcacf4e7e664a9c2473725c4da228ea8fedc619128b64d7a2a2

SHA512
7756b9895176fb779a085972dc6fe989fe28943109f8b2c9ddc2abc0d0effac385d6cf0b23d5fa4abc94afa1ddbc5e406b7f76cb32cb50f92e35120179c1484b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00502e8fc09bf03a385757969d406533

SHA1
da3081d13fb672d7be31451ec726a1a29e4d14e4

SHA256
0ec85f76fcb4bba5f89d623a42686fa8fad1190c05b5092b0c12ac1fd878517e

SHA512
d2ef18a0d2f69a1196afb2afee4dead0451c65f84a8a90f748d5aeb044e2dd5c4abb9ea8d80fe02866b2d2292a15cb72d73e9f8d0cf6f608b85e207a5da25d65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dae24f9d800c693d638677647ccf2a93

SHA1
9558f35a616bb8b10f18e01e00109fe3e6afc6fc

SHA256
a5631ef0627aed5695469f69919fa0d10dd50d278d49a14e7f9e873aec5801ea

SHA512
61d5b23ff0d730c5a1d0c0759df7329035ff5a676b725775180e806e26b61bc2664312ab09ce47d13e482917ea3e0c8c5fc2868bcd67984d2cd4b8fb852dd34d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dcc9736556c82c4d1c50dc238a748ec3

SHA1
ac0d4d49b567c0bf4157852c5b96bbfb4c1cad8c

SHA256
eed686d2610ee00e0dfcb43516c7a892e34a6a169cfa03306fd90377f26aaa9b

SHA512
d449dbf9796a3cecd235903f26d54446066d69a64373894e07b25cd115219765d149cb40133dfbd623ea025b818ac29657f63f7a4d922e62a8165136226f3e77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2021758684d1c76cd6e98acfd306cd0a

SHA1
1c238cb65a63af3ea84d409780017c6f82730d1e

SHA256
f2945dc23e6c248545b4feac49232a394fd6ae635a44363c32ebf5d3b8938f6e

SHA512
3988fe538b8bec5ceed42132ea9134232b9d852eec2df290df8212d780282cb2f068730e0e519e383aea6e8d8ccbd936f1202de1cdb8da31ba8ee78414920e81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca4dccee1914df59208f1945c81fda72

SHA1
964e93a8670aac85d28cedbf5da358b364905000

SHA256
995bfbb40ec8e4b9dbbbc4769503a1b4ab85471e1d178f42d45b08b7a537342a

SHA512
9cfe4155392a7c066acd96bedd94460d1fc616bbdeb2d1fefb18a32c85aeb837888bc903eff186be2e69168cb10855926a6c36d1538f4cac6ed5951abe2e2246

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d8cb8372caa9f4ed09128e8ad948d27

SHA1
a87802b512a9f257a8a69c3cb7b50b90fd860b23

SHA256
67d718d4acdb9998749d609cfd17ba6d172f4f3b58e6b4e943c4102eb4dcf971

SHA512
d7a282ae873e4bc16bce9bb4af6af3d52d9d79b9bc370b6c9dc5939ca6094e6360e2102be95d6b04a029a23438807fc6e27555bdd3b1b8659008ab43bc6c7ce6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bfe2e05cca97906c3c3172fb73842cb9

SHA1
9c4bf0e0e8a2e9cc5f2c43cedf713ba24fd699cb

SHA256
c21f966a31f4e994242e60845232bfd2573ffef6d2a91e9f5710ad9a8f25c70c

SHA512
76da3206e56d660a9add225095d45096fe3bcd7c674d0b01264b7061d53bc5d713ccd7948d4894a91a32cf75fee2e6fb23203bf837ecd064e36d80f10a464bf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec45a734ec367159bde8f37e5f37dec7

SHA1
986aec0cc1d712309fff944865d8123bfb888c85

SHA256
386609b427c2e2ea7c1937403e29e64e462096ee6015bd987dd869c8ebdfb7a0

SHA512
04c1690bb0a576ecfac0b97f83defbf26f10bd7f0ccf90e5daba1d256830f7eaa5f06b2e627bececfc4bbe0d2b2d2b7afb139789d1e9f675d204eba48eff104a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e04836c0c377a83a5b2b6980c79d48e

SHA1
c449d331d8d100560839584be33fcebddcb2c0a0

SHA256
aa6cb7cad754d9cbc681301cf777d8c2e46aac3fb09185c9ae7bedd805f4dd00

SHA512
6fc0805c958abfbdc19b93a6fa700ffb1a528e7d7ff96c40f69284f16346838b9e33401f93e04172bffe67568f1eba789827ae45688e102eb7fc98801b52b1ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51534e146a48a25efbf8a6c31467f909

SHA1
602a64e3abe8d1d9cb7b55943013f9180e796c06

SHA256
c19f50e4c7a96db0e2123c32f56521ab23a626df2912f550681c21efa4155813

SHA512
dc8f8ecc929c2ff77c9b86e2de83f7284134eb5a9f35da38ffe347a94c5145edde2579ebcd96413dfd915421abd84059a2945394ee71c950659f80a947a390c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7CNUR30T\small[1].js

Filesize
8KB

MD5
a41caf5294227669425cd5135a26b2a0

SHA1
a26a13f88c51c37b58fbd8a6b444e9b9150fae16

SHA256
2052a227c361a7e99ea70f5bdcf54cd9e6c6b493dd4d20b73b376d94ce0dc0d1

SHA512
d51f73568d401f35fb68f9a454dba95781bbedbfcf85a5c366e9f3f44d42950b846f896b14d6d297bdba6688968b937beb5e74eff160c73eb91f49b71103ca8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D6V88JEY\f[1].txt

Filesize
103KB

MD5
038574b85a6f305b3802dfcc24fa0134

SHA1
5650ca1edad511af5e27889ef492ec14cdf6beae

SHA256
58c529c09255c603701659d8b9e09089172ab6ef53cf37bedef822a395629ca9

SHA512
c804d363eb19621071698ef0897f702dc23b8938e5df71cdb8dbcd22702ab30b6c846ee818da6f21f2d077de3b7105a7187ac30a01234f0dfa57406c4efe93d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EOYL2MRI\jquery-2.1.3.min[1].js

Filesize
82KB

MD5
32015dd42e9582a80a84736f5d9a44d7

SHA1
41b4bfbaa96be6d1440db6e78004ade1c134e276

SHA256
8af93bd675e1cfd9ecc850e862819fdac6e3ad1f5d761f970e409c7d9c63bdc3

SHA512
eda31b5c7d371d4b3acced51fa92f27a417515317cf437aae09a47c3acc8a36bdbb5a5e70f0fbfd82d3725edf45850dde8ca52c20f9a2d6e038b8eaaceee3cf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M4TQDAHL\liveView[1].htm

Filesize
149B

MD5
c53bfa99d011169c53385180f4c77e8d

SHA1
cb8e4b60ffca9295795a2fb823ba8a7a43237e7f

SHA256
1171bebf17df6eb9076d7b7c564763e8395f5d32ba0412566ca54f5ee8bbc114

SHA512
a4a7413ea048495531668175d4ff681929582aab6150ebd6e1d65b943206342413aac42d22968d3452bdc5e83c87811e12f5d4b70b9f20862d0099d2335d66b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBDE6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBDE9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit