4b1f2767ea0539fcdf3312871b4baad34ed62b17c147067350fdbe4df6bd3ede

Analysis

max time kernel
145s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 03:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea8330a53d4ff30205e7e708330581cc_JaffaCakes118.html
Size

27KB
MD5

ea8330a53d4ff30205e7e708330581cc
SHA1

817a80dfebcc3feece52756949cb18ebe7ca3117
SHA256

4b1f2767ea0539fcdf3312871b4baad34ed62b17c147067350fdbe4df6bd3ede
SHA512

44210a4c35bd3f27480e3bff1b0bd2c773075914c6e0260dfbaad381082169ab284e920e02dccfbe05a98a9cce0acf2484b39e99ac0cc20b621887197e0b260b
SSDEEP

192:uwPkb5nQanQjxn5Q/znQieaNnznQOkEntNlnQTbnVnQ9e0Km6uZ60Ql7MB6qnYnP:RQ/9tiM6fSQDJ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{76844201-7638-11EF-87F4-7694D31B45CA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8085be4b450adb01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000431a80e2a6ffac014d004a77f9ce645414ccdbc1c76511459225afb8a861462e000000000e80000000020000200000004b2a5aa96ee354b1d76d3787db42e0e8bd89bff97aac8416271f465c48510b9090000000cc4c2001bee4552148dd60e4310b0cec73c932047380b1f386d58e655088038273fa24bf58f3b4ed2c9eca02bac316d11cf7154e31c05a2f0dd8352992611db77a2eea7ca3f30d5a9dbe04b9a770c363e60ff4325731a1108130d7e795609f9ce06f8a8ddd94d666428a10e87dada8d7a94f45c2562e13ff9ebb384466a13e23a65e12bb7ac43ebff6da61d06bf5187a4000000025ff2da8ac4cd4377459656585470cd0802f59ad7c5014e214d383bcb0fcea0e303d6f7f557121d01ac226d71f453c9b41de2fd0459c4bf1e182d066424e64e8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432878912"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000049f9ef62361214de1972c5cb765640c2486929ff187a0b5d4a3caa2db043b328000000000e8000000002000020000000457d127b511d7185fcb4b015cce47973ce96007a2157b186baee6fbfecf703e42000000031a2d3db30e24553a1086ae105864541e52c486ef49e0c46a8ad9faf13ff650a40000000382fcc6e92d00c838e9f21af6e496ba64a5e47cbabd182bbac259916dda80ad351214afbde6e183d3942e4ab8c8f845c5d36151fe35eff756592a839dfb576d0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2840	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2684	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2684	iexplore.exe
2684	iexplore.exe
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2840	2684	iexplore.exe	30
PID 2684 wrote to memory of 2840	2684	iexplore.exe	30
PID 2684 wrote to memory of 2840	2684	iexplore.exe	30
PID 2684 wrote to memory of 2840	2684	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ea8330a53d4ff30205e7e708330581cc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2684 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f3405eef121ea8a873d939aa0a23bc7

SHA1
4d04effa5f01dd12ba108e7e6b4a63e4b3a6b839

SHA256
7e2a8fab4a9ffe2e1e08f1433bf3ec7065ee46de37362acdec475843c6917113

SHA512
4233bc2fe92938a3617c23e757897abe44ad7b7734c4091a5050a475ccb62e0c9d8ec4d9e379ab5c0436317898eef5a045a5ffd2ee30b82e75de6e971653fabc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9358536410e2143492f43ca27e0c0d9b

SHA1
9d52aedb2fdbc1359afe5ae478dbc186e705c62b

SHA256
aeec3b58bb866cc1240cbdfcb1be8ad17811bc30e387b89040f91284b0ba5cf8

SHA512
f3c0d7224a6710e9e3f4c6155e4a204e7c4cbc911fa489ed1017087f6d35280b76d347661cff14daf918fda894fa1a253bea7dc8c5890e05e4af256186adfa82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
726b22afeadbc92ff18d2f19995db945

SHA1
287f33c8f8eb61ae5707502555c52b0784a8c763

SHA256
6c177dbcfa37558c195250a4c63f866ca31329fded15ddcd6da37b4bd58bb154

SHA512
b92072b2edfe4c59c27e8a2f816752e48938368946c2aed31b5e04dc2df4b1b64999b63bffc3cb1ebb3e9a44064aa790577048411f729e7acec61aebc4617c77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21f361650fff8735c633670d453dd111

SHA1
93fb89115f5570d3aad1f5f78d3b990e956579e6

SHA256
6e79219d694512daa9b85dfdccffca69c9afabb9076f6f2a25c9f15bd0867f3f

SHA512
200566adb93587d94862e7ae54d1fe041f8551557db6ea5745e5dd85561846bdfe3e0681966cf0a389f9e6263573642c22f070e4503bfee7f451f8c3db3f039f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7fc0ad344df6774735aa97092c14f96

SHA1
9ed2d4296080ae88004698be0e280b0b3cf6c953

SHA256
f252fd172b9bc7a78171f6243f817c52bf15718d31c04fbe00e9f7ccec5e4864

SHA512
ac3ed8ecf344ef081edc7f8598bbfc75796d26ebc01c61d7ca6c0e51ea6ac5c5cd1a54a504dcab5eb9f0a8124b819248885a94262c2c6237d3063471e412a4cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82a311c64d340f63d5bcd66e60a67c0b

SHA1
f9d01d16ec5397e57e8e6863e631c85aeac31923

SHA256
12967c06390812a5c0088c4251fc810290b2965231a1db062037bd4d36f51f9d

SHA512
37e6e8b02280cca9ddbacd57bf0d0b39363174243b92bdae44fc46b4a9a4aecbef750c48889902f558349aeeb07cfc340d8f010734457ddaeba6720001ae631d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31ac5c72495bb52ce9558868544e2a45

SHA1
f5d8c1ce4f306d03831814334a4ea6b9d97e46f1

SHA256
d16b9f9a5e83ee9a35e3eaa127eeaf067aaeb89a6c15e39fec45a364541f5287

SHA512
772ebe0aceea36a2dccde0c56440117ed7f2687d1326f901db2d3954b9f570cfdbbf2118c49a0b502f47275061426aa0617e169705f5819830c62f0b13d60563

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a2c2e28d10f064b2015e88651f19186

SHA1
40f3ff86d51b83961bfa4c685019b84de53892c0

SHA256
2ea33d5d107c2c08a0c85e46ee264143710b10a8a3f4c0c5257c75e809a407c4

SHA512
71150ebc4d5816e5b966f5762dc22bf2c343c48a5f9adfb64ae7c36da7fd9471796451667c1a28e8e11f6281f6e35a2b75316b7b4fed780f3fe2ccf974b7be0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af347a119c3f606dfc6915df86e555b4

SHA1
7be15952e8dddf9f0c20acb20edf2febe3f7f593

SHA256
21db9d29ec9d162c78f8e2930f8b202e0595429f0b0529de8b3ba2a328b86649

SHA512
fc234e58b0f6430b96a96f352a99921389886cb815bbc3cf05ac97763ec3ce7a162d558766564b987ec072371d4b52b91d9d0d903168207a8a4de1130f34aa39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c1bac460dca59e7177f0b748083160d

SHA1
5d8df3290299efdd2679263b3ae78f95f51f7d41

SHA256
7dac6f1044772d5cbdef272263e8646b1cecf056dbf64bd455a6f4c67ee7713d

SHA512
9374801f93930102f945f32be793909a30b053b3e15e54b807c476115981c13bd2cdd189a9030557dbb3097f5666d59ae2d9991064640181b5fbb825a5bec122

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
abe2721890ab84f6cf22caf3b99a2cb6

SHA1
1bdb8c0e68be57e030f93b098ee9db17f9fa0e2a

SHA256
0bda06cf10e307e7d42ed2051ae901e2c6f84a4aba4c690450ab0f3abcb19113

SHA512
6acf6a4856bba751edfdcab8aaef71c8ed872f1aaa294078a5ce8e01359016b24d7ddb7ab9014a2bb479ef0d1f7019f7e85cbd85b8de3d51172c65501156dba9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA7E4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA8B6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit