4b57a79cd0f63648dd455b55074c4364a7b13ea2dd20afece232b9d4877c925b

Analysis

max time kernel
149s
max time network
138s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 05:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eaaae4830f38709893176ec82f3c86cc_JaffaCakes118.html
Size

53KB
MD5

eaaae4830f38709893176ec82f3c86cc
SHA1

f690d3cd353cbe25bed334eb23deeb8e1ef8d114
SHA256

4b57a79cd0f63648dd455b55074c4364a7b13ea2dd20afece232b9d4877c925b
SHA512

7b4859fff34cf3cda788ff2684e6bb2601e5c6959b1d6714bbf2450377bd0563b8e32f596a53b879fe9f768afaec6a2dc0469919cc5fe31b8ae4ae93cf30044e
SSDEEP

768:SHemr9UrQn7jKJ1IOg+vkARFk7Pod0rUAPt/45r4vm2NNZIlKx2M+yAnMyzgDBrd:Sfr9UrhWaT0H5WUsK

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432885435"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AC05DE21-7647-11EF-B44F-526249468C57} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2360	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2360	iexplore.exe
2360	iexplore.exe
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2724	2360	iexplore.exe	30
PID 2360 wrote to memory of 2724	2360	iexplore.exe	30
PID 2360 wrote to memory of 2724	2360	iexplore.exe	30
PID 2360 wrote to memory of 2724	2360	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eaaae4830f38709893176ec82f3c86cc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc013b7bf66ef8ad6864cea5d8086fbe

SHA1
94d2e24bb0e714de85fa7b9c929fd204940afb79

SHA256
1390bd199d2f920a258eeebc5bb2c505002d1d0be903d703145e70d1435e6bf2

SHA512
ef32e46a210b419580a3b4745839f04dd29d13775ca3509e84960a5c93c609d45f81c13c111ffb7bb5876146bd4d08690d21ab19f59250732567855fdaa16590

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9ca759b21ecbaa8374b4916bd458882

SHA1
63a1a0deb9c7fabef47f8ff3d6991382c402bec8

SHA256
f6da8f2062b75eb2aa2eb3c52ccf93d4d0b286f51f413cdf5bf4db924f1eec3d

SHA512
334d6b25f45b6704caa4a847496052bf3eef9077f787c2101a6afa576637f45edd9fc3e4f0cbfb990e78c8cb0d360279e7ae1dd1b138fa6f2f67749e1b654494

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46ed2886b32569ce60c1723f61d6708d

SHA1
fe36007b7a70d482b0b12f72fc76f9901b74aad9

SHA256
00247c67d497e55bfa26ec2901dc09afb6e9c328968c5cff46501dd56354394e

SHA512
aa92d3e85125dc2e535927f1a54b1c5e5191278e918f09409b696c707c715b0c524b040f6d5997f41d9e16fabc9095b38a06c6fa99f2fee788d842af081a4369

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3432f4bad3b2a6e32edf9222682377b5

SHA1
19143c754d8e2874af2afff5d6a2dd98800b1309

SHA256
e2aa67e6613e7e39ef49d3b77b92e935b4eb74b763f7c59c83db83b2228ad113

SHA512
d844d9dbb0f59fca5d488271049b77a05ca1b48c6a9a5cd769c6a49710c99763721280ffee80dfb0e397060fcf1aaf443823f3e321bebe383aadd79eacd61249

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9ca36f5b8baaa6099b2a7b3f25b4002

SHA1
dc61106d3f63f64e62ea5d105b43f6fa71b8521b

SHA256
a7078128e40e7c9ec20efcd8a88a770e8871b4f76021db269cf9e01925e80411

SHA512
424827bb6b3d2e581154fa21eb6ae88dcd1c9e6b38edb5faee04d43b2320304298f69cc33d1c142df3cb9d5fc8768a6c01d033e4d7986ab75424575fd24c331f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43cf2d7a04064a6d449965ea9b232289

SHA1
920fb1b56fda9264eb8c42c8782defc389fd0407

SHA256
eb530bbf727ebe164161d3fd2aeb29df7a91eb60f56cfa1576d68918d4f5044f

SHA512
522f4be1a0725c0db549fed451b331c17a47b520172426a9b08117f76e3f60c1977137a527673f04bdcdf0b49eda32127e2228bbc61e8f3a45b03604627498de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
617e61b35c5b5d7a7f058345f20b8329

SHA1
b1ce5919b818ade125696b271f0aba86810e608f

SHA256
5377bc319049d60337e30578f5bca9792adbc2e282c83d7aae44e1d3ac9fb08f

SHA512
b9941a476ba8aee7bab28fe081a661408a6d7b027d57cda8e427c516d1884cd63020e46169559789f33e332e9ae5ee0b34421ea680d48c243524f281b4743bbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10a58a82144b94d53555190c95c4282d

SHA1
e46a92f5c0f01a16a3ab739225bf6680ece9c243

SHA256
12044bd4c16431694d3f471a9d3345269ca96f8cf05e83b501fcb4414e3522b4

SHA512
a0f96be53b4c2668b401d08f6882198ed07a315c77d6366990ee4113d8e750204b477cb123fc15f50642e9b7f226708055e1fdb2bd56a413a90b49da8c48f1f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae38922bc23a2cb9d48430eaad945212

SHA1
94926a626ddf4cf2c9b1bf5308234539f16e84cd

SHA256
56d7b245c161aeff55353ff801e38847e3ac992cc6550a6db90b9d5483563104

SHA512
46d555826d5d85b5795878db024c1830ecbfbd12b42935efbd3f45ab82135c051d63d4eb0ce0009b67c842bb38d2c461498b7e7717a62a7b985abaef0a289765

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7FFB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar80AA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit