b8c0a7d64f9f6e59409699e96aa4a2938c2cee460d929e453ddcf1a61849477b

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 03:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea80906f049bbcc668027dbab033726e_JaffaCakes118.html
Size

242KB
MD5

ea80906f049bbcc668027dbab033726e
SHA1

a151b0662dc75f35f66d4bce3aacc355572966dc
SHA256

b8c0a7d64f9f6e59409699e96aa4a2938c2cee460d929e453ddcf1a61849477b
SHA512

cd72971eaf14b4a8751161fcbb2586affc601a85fe07a0bd41556e63a2c2f63db9b6b85689598f9fca42de1ee948618a5f001f7ac5d9940fec3dfa70c1e4f40d
SSDEEP

3072:SnyfkMY+BES09JXAnyrZalI+YgxIM6jiBnes3kqee66jp:SysMYod+X3oI+YgxvBnT3kqee1p

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f000000000200000000001066000000010000200000000496e538e67e69817c018b48d4fbf1cd704297032ce57658d6cd6faa8d8d9249000000000e80000000020000200000008b841af646f5550ea708cc773b2807e1771f3b60ee01e787eda4f9588d1c07d72000000063e256cb384a47469fe592c19032738f5f3fd2391067f66efcc02582c6ea7a7c40000000c1d6baf4c68a8b899094f2783846cf8f502345b20a3510943f76b8030fed4bb3f8b95d6114af2a3627a3441a462bb49687c6c2c4b8cb7d146b8a2b87019a3b1f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20ba3939440adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{648C35E1-7637-11EF-854E-7ED3796B1EC0} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f000000000200000000001066000000010000200000002c4a223f6b40ef6decb21b8a289013750fca41fecbf8b917cecf9c530463a9e8000000000e8000000002000020000000eff809adea2a8ec75d15012cf6861b1f0fb3a12114433da632f3c4e1b16566179000000016137c06eaf772288a42a0aa2541f558fdaff6c6f504225a048f5f6eaddd3e1dc3f342b9ea04ac66727474ca32f2ebc5457c35d29ce1793d6081d70568e4b5729d56d087f492aa3ef8177bd017c632eed147565d2081aa71bfdcfa57afd07fc0143bbc05c74bbef03d32724523560f23fdac8c9e2d51d0855752f89529b4998f440978e824daf0190e2884cf3d402c6440000000591b390a82ec008d2fb442e6c1965bbe6cc5b0565c14a8f753717a8cd2210e493d300cd5e4fec3a023611f034f3ccd444dce55829262edfd686f23d23985b550	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432878443"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2380	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2380	iexplore.exe
2380	iexplore.exe
1048	IEXPLORE.EXE
1048	IEXPLORE.EXE
1048	IEXPLORE.EXE
1048	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 1048	2380	iexplore.exe	31
PID 2380 wrote to memory of 1048	2380	iexplore.exe	31
PID 2380 wrote to memory of 1048	2380	iexplore.exe	31
PID 2380 wrote to memory of 1048	2380	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ea80906f049bbcc668027dbab033726e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2380 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24ea7e8a5dba5451e3e9e7dfe163af69

SHA1
8370769507146c4d2f2075c2e1a9b0bbdefa3703

SHA256
53edf9b30a7c268b933025771c5046598aa7bc3e02ebb8f3ad59f3cc2b5834e5

SHA512
8a9be229e0bc9b242e0823a1c840eac5658ba338e080336a741ec73e713c361a0868f54999356b5a0bfbc01e306a1fea3e8d8aad373a8153bdd5b05c6eff99b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
840bf011a24c1d9ca6d703a8d1eb9be0

SHA1
19abc2fe9055658538d13be471957a562f9467a9

SHA256
af88338c4c4f0e149c37f0280c6f49ef345a08a87115684f9f94599c4482444e

SHA512
8d34fc53fee6517a1cf7c330a4c4fd95b51c2edaf6a64ce1822e8624b77079c06c08a414b7627c58976827a3e41ddde2abadc7b782de0240d532931f8f82f0fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3369d93a3c52d78d0895441746330a9c

SHA1
3aac119d4e7158de794edfa7911d5398453b4913

SHA256
7138bf88b83d5652bcc5746cd175e8bba89bb972df5ff389d08c9d7ef1fb96a7

SHA512
987eb359ff3d669a57f1c616f425e180834bac3a215240d6b71e9d1cb50b956a40807eb30df6796d4693cac83c197a10440caea1482e2dbf9af919f5d3aae0db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2116ea9b299be0157700c1486a7e93b9

SHA1
a4264a92d07a497517c61b39fef09ac7e940b01f

SHA256
279d1e04299689d4d809cfcab1542a976b25f55e3c5a179741dc377bb851e1b5

SHA512
4914f443704dd9d19f236a15c6b2ea53102f1f87c36e2db1dd59876387a254c37ea7873b90d20616558857cf2c31f925cd352094d586b7b91764bd0988b831b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51d35a2b85a1f24c87a5d21673719617

SHA1
e70d158ff9b88a6587d47f2d819128df0b686a8a

SHA256
59b08e64fce780b1adb8394d325506f5cb52a4f56eb25e8909e159de5ad6d472

SHA512
2338b85b048ed442f8e7a6dfaf160c9ee5e7541882e6d08b5734eaeb64df93f3c4614dd3bddcf8c106a3bd597633016a446db5072e87b76228c37081e4048a06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69fc3aa751c854915998dd939eaa6646

SHA1
7c1522de32a43695557b5e472e391f69c6868d08

SHA256
3212c0fcbf0aca692486f937568bb53efa9eb5e9c5bd387a97ea827923da9843

SHA512
00d3f3bdcfae4e3c6cb86d6138eae497635e11db54f88dca8f4f7107af440a65964755bef7e7e318be481d0052895ff2e1d293ad86253d9ec76e4c38f5d1c079

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9b4eed09e8735134c3c5da855145e53

SHA1
94ca7860414f7f44ea7eb07247b0467b3656427b

SHA256
e04d79c99afda09c7006110b15833f4b6b4e1e4ed4046bafb86b0c225daa54ed

SHA512
96fc3fed039eb6c49b272596af4216c767d97429631e060e37b6f2c68cf655e881b3e27f22e20f4b0b5cb1ac3a0b564ac72720ea2aa62f8634e0c44916bf3e91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90369f5226777ced92b749561d6d8e92

SHA1
cd45cf3363921066d41fa093b050315539a98569

SHA256
c6c50a348b57b8ec096a157a48ccabaaa8719912fb60d79ebb18862d8d090a9c

SHA512
430cb86c9fd3769bde66e089c3e52f4fead94accb9e2c70acf82e2f1d476ba4decff6e13b38b9b53f0e16fd3ac8de4b88983370836e12543150cee307683a428

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7423bc8c03a7a021a47b16ab166716a6

SHA1
4dce7bfbb9de784877b5425dbbed14694357562e

SHA256
39a1b0db35296c1808f1a1c93b0595630011fba4965f1e538856646356720fe3

SHA512
163a94934467cdbd5b88a499ff793b3597141a10d841d7f2da939656d252be38ac9ae47f32eec39ab294aa73ed2ca44b6dd0c0c7d9a513bb58cb7b0175789604

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90ec706ef17869b4cb2fbf268ba7d397

SHA1
155aaba3678d2b44f43526a92f12d77b94e9aa9b

SHA256
605190749b3e1b8c93f0196e1ec3174d6e35ac55b00bc8e22eb28756448451d9

SHA512
e59dc2c8cce53f929cf1a5323cb1e3915933e853a7637c71e65bb88c758955c622a4f49078b5f079c7e01e8a495d25e6dd4a70ae9752339299291a0e66b4225e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d186494062776ddf31737907ab48299f

SHA1
54e7fcc4fdfecfe57a4e4e66398b6016ed7c8e73

SHA256
34a364e4d296662353750c0936519f76aeb9a6d7f0d3491b4829640173b012f3

SHA512
c4eb0932f1f30d0d337a1e1106237f4f3880e4468b96840198e282376ec6c3cf178df5c4286234b7033dac29bae3dd4a4b348565492dd8430307c81baa2fa87c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01563d9f77548a69e652cbc1f93ba19f

SHA1
6b5c81dc5b3afe909408a4f19b63cac832ab0d15

SHA256
30652169105043fb05886ea707ec286e9c8aa4a54304ec3e0b37d616e55e541c

SHA512
59799585fb39501022fdb13e6b35ce563704ddb1c85f032a09ed8d636329c1d7071549d759158a6adf7ad825811dcdca8828865239c1e7a5e0016dc84adeec0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d305d8b105d2d3924267090bd0c7514

SHA1
910af0336ec2920fbac5b1a2470bc0e5baa9b141

SHA256
56a1321b6c2a5b11a0a38f390e8b34d0c44a09c68899c73e2b2c49b37d5f2b7c

SHA512
621a4933c41ed9454bf29198d4908a19367257e83756d791d13544f276c2a0dfe9cded60f105c5e66af599822c499c151a41a4b1ae0b7c72700b64bb527dbd36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f1295898c9ad98e3b2958d814bc94f2

SHA1
815d7c6bcbeaa73a4ca30fc621733d9b782f25e4

SHA256
507ac41009b6bd473e8e39d8cfeb0d29094427acbafda3fd5aea29070d784e3e

SHA512
0148af725e262c8b25e4e6887f1502632a1b5843c41fe1a810f9305cd7f5326382d0cba9f527262ac62c046028900756c57771ac72621a5aca1052c4417a5888

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db931ebe1fce2606c1f3feacd304e25d

SHA1
1d89c954dcd3563d0b1643bc9372fa5cb10c9b86

SHA256
0a6148cae145065f2b19dc3a3283765b1943cf970eea559b1c0fa874858c7b76

SHA512
bb0a8f8143ed7b3b4bdca6083ac6b38d3a5e535bfbc8fc55dfeaf70fa3527bb61534e7084483c7b3d85ef79020bef46b735637acf8ff0db637f9fe7bd70401cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF20F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF2C0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit