7ea09df7b3a2ca27d74223fce5dbea66c71e4fbc45630f8c40d6bc4e419a4570

Analysis

max time kernel
131s
max time network
141s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 03:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea7b458163b870993aced59a84393efd_JaffaCakes118.html
Size

142KB
MD5

ea7b458163b870993aced59a84393efd
SHA1

d48fd6fccafc6bee7fffe3f7167bb5e1124bc344
SHA256

7ea09df7b3a2ca27d74223fce5dbea66c71e4fbc45630f8c40d6bc4e419a4570
SHA512

21962db1cd998272dfd6464c7bf7da997a0311f00d0b6bd3ff3c8698ae8fc28f4c5e5158e857965a82c2ad848b52e0e13833e1cb253a1dfc3580c94e88be4317
SSDEEP

3072:SfXS6/+rWx7dyfkMY+BES09JXAnyrZalI+YQ:SfXS6Fx7osMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{562A6551-7635-11EF-8F1B-EAF933E40231} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432877560"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2616	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2616	iexplore.exe
2616	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 2748	2616	iexplore.exe	30
PID 2616 wrote to memory of 2748	2616	iexplore.exe	30
PID 2616 wrote to memory of 2748	2616	iexplore.exe	30
PID 2616 wrote to memory of 2748	2616	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ea7b458163b870993aced59a84393efd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2616 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8d2162655de22fbcd39638a0f16cdf3

SHA1
248b05d26b168f70f5915cc53919d5cdfd83ed2c

SHA256
568950717e79b5ec2f55923be140e8ef2450bd37d408ad6ebbd64b618199aee4

SHA512
75992da8e2ffe82ca13b04d5b6ecb633bedf20333b91a5ad25072593546c1a7ebba1d812d58321a771a07570c841cc90715f140c99ae4c7d17f1f3f85474a0f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc0404b87dcc5c0ca477f07430165360

SHA1
2f1f4a24f2108713772152ff2344e598fd4d46eb

SHA256
25dfac3ab682b1e8339f071ba766951705f0121bdc9b0cac20a1c8478d15f672

SHA512
72c26ed3e3d7430f92e45275ef628de841bffbd5fc2c6261bcae6514f33ed9dbdf8b345446044d381640ff956f3e48afb18a94785732dd636b4c76f45a178a31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6877f099400646738136a00f64a2d24b

SHA1
a566242bf18f4aed4e3b4c1cea7fa8abdfd7a627

SHA256
97d3932a603e85b3ec70412f157784af0a0a95d210bf0100098a1fb5e7008e8d

SHA512
18fbe0e85cbd39b59aaba418e0ec7c375a21da597c92accb4611a8daaa1f423ec9b3b099ec20181e8e60400d23e427985c08eb7d2be326ad233d16e80c73798c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91f59bf55ebd5a9aad6aa0aa1f81da30

SHA1
6a630cd79f8f3a27efbcca406f86896686e4e449

SHA256
a4cb126ac5171910a14e12b08a754fb564ad6cc1524377951bdc9e4a74b48e95

SHA512
6f75d87c304b5e18ee8a065cea3388353078076ddc3b8a456757b77ece7d2794847808410de8b18ca14ac56e85798532f1e8fbd2ae550ebbd5d9644afb596bc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eaa789d83a07837778a8e4ba0a469278

SHA1
8921387f66742c1ba02b5e36e18857e334e074e1

SHA256
e59e8453f2155dcf34bd2a7e9e35b9d9781a9eab15ceb1c151490507e640967e

SHA512
5204efa630d7da01bf374902b5f1ffb0ed9183cf69e55987051575ba433cd7a81360b7ab01bca22d2396963211429c0a79270d352476d18f6cb331e966b19eea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f08a9e583c2fe30d100c7156d7a0d67

SHA1
3df522414bc47dc3d1920a6e8724e52b18d058c1

SHA256
915cc14b572f4ee191ba07ceb79dfe82e163995b48ba2e85c44fd70fa6d2fd8b

SHA512
8ddd479af62571224b99cb812733defa6e1ff672d9ef2b92fd327676c4ed7d5db1fb563a0be246499864138230b62a13d0d239a643825c07b0862af3eaea9c86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cf3a452cbba5d8522468561eac050e3

SHA1
7ab4052d4421f8aba867ed608e91c1491d9f9aaa

SHA256
51688ad3631f0b0b2b73c2ea51ff236c9feee432826b0795fb6fbb0568e9dfc1

SHA512
713c10976fc4be130c84ac7dbfdd7325f193d1384e02c5ea8e1f307e9bfac840e15b21821b7a8d257a41c5c6fda4c936752a8d6732e5c992d51228e7a356b74e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ae9290cc80cb2dfb3089b97f8818fd8

SHA1
d7e2d2364f440044629bf7e3ae1c479c963ea191

SHA256
9cec1a63904f8f76b491e697b37699c60595359d8efebbb73d16105fb64da3b3

SHA512
367770b3e60816d366eee7a6090a4dd60cdad5a19ff05bee2b8a7eedce016bc09ef2bcddbc084a644d7f7c9ebaa375a329445ecea1079c3c9cd4c5254b6732d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2d55865426653f89712837376e6da18

SHA1
522994a1ff931df367b37139fb90f24ab78fb492

SHA256
8094b19da40c8b66b97d3ab2adb935492497fc9097457f4f0e4cc6bb51e16447

SHA512
49a9558ca40b6f0a24a0f5239c4bbd415bc0f582bf9df12afb8ff3e6ef79067a7f7df27695e28d318f2efff713f63f47374e523d16725464e2bc82d07a017910

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2354743504d59e72bd031a8534a0b44

SHA1
d20c619f269e4aee19743ca91d70561159aecf2a

SHA256
cde9b85401ea86b6ba23e45c35bfcbba51cff89460bd75e0268dfd276f5801c1

SHA512
27f15084ccc6b09661529b21bbfb2bf3004b9c51a38f12a2bc8ca1bf4172c05d9637370e4e0b23a0e74182e0229cd2ea63849a741863f518602cc58ec4fd215c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEE66.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEF17.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit