a81248c76b1aa79fe353e8d71e5890e48e34140095d887eebe040d571df186d7

Analysis

max time kernel
145s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 05:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eaa34f1593c8c5c7c07d9f130a990145_JaffaCakes118.html
Size

15KB
MD5

eaa34f1593c8c5c7c07d9f130a990145
SHA1

c05d355b0dbe83eeafbe1e691b434231c13b2fff
SHA256

a81248c76b1aa79fe353e8d71e5890e48e34140095d887eebe040d571df186d7
SHA512

759b51af6c6b55f70691a05d84d39630b29ecefd6ec566947e1f308cec63339b05f2ca580b91a9f536ac8b0e3ea311edac5cefbd18105c0e135b20ff5d513f6e
SSDEEP

192:8zlazSAfky66IBcrqJgDsd5JlSCPbXEbmU41qJeD6tKHtIS/3O3DjqdeE5:Clk7F+yod5iCkJJe6KHtt/Bd95

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 300017a8510adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000700007b4597d197dfc015c62426d376ffc49647fb72346787e617dfb610b8f01000000000e8000000002000020000000b8a2cc8f84ef12ec7edc0d46fb2d6a91eb89d9f0ccbe88872fc7c5e73948ea0620000000a867ad02b5c60687a184f829794f3b58fbb5c59bd4006fc724a596c13b9d56714000000090a750437f70461aa328bd0275d0b62b7588e900918307122d86a9de137f9a4c104a1981e0d80c227c8597eb931d7264845d450f1253b6cb3dc841b85e7e7e7c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea220000000002000000000010660000000100002000000074b605893cf897390cb3a17dce783cd98135ab01e52003b0270f128476aaec0b000000000e80000000020000200000004406e55b53f3fe98b05a8aae304dc8bd6be38f687aae594671c3474c06cf5ef4900000001a934a224cd2d36733502c47ec9fa129c42c81b71ec596101e13e8394b5f50130587db284573dcddf1646e94e1a5cc7f2c1eca1dfed834a1f854de4d907ec52ec528e929ca150b892b6cc2dfa4891ac8a1533649baa5f4e9aceff753a626d20eea6e09554c087ce1fa4aca53e88b3387f868fa82d59893f60ddeef5894f046193a66940e30dd4c6602ef3edad1bc0d5940000000dbe14e93362a043a196f8be0b6eb6231b0f0dce589cfed8ae385d46fad438a954eb0466e7b163686944bf186fd16440acce4dfd512cdf99ea232abcc3882b0b1	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CF7C4401-7644-11EF-9733-46BBF83CD43C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432884206"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2340	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2340	iexplore.exe
2340	iexplore.exe
2920	IEXPLORE.EXE
2920	IEXPLORE.EXE
2920	IEXPLORE.EXE
2920	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2920	2340	iexplore.exe	30
PID 2340 wrote to memory of 2920	2340	iexplore.exe	30
PID 2340 wrote to memory of 2920	2340	iexplore.exe	30
PID 2340 wrote to memory of 2920	2340	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eaa34f1593c8c5c7c07d9f130a990145_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2340 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
274ad505b41fb92409ef87a5dcfd2371

SHA1
e6a47edd451443e811d065d0121967fc3067d4ed

SHA256
01d3b6374ade36175231407d8acecd017bc8238be69cf9cc9244e4b90fd468c4

SHA512
4870b85dd293273a8c84999f68d98316984391a3733a7481fef500438dc66dcb3b9537c2482499faebee02be1222678a772d47c805bbccc5348580ca8aaa0074

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6cb8ab611ac3085d443731b672937a4c

SHA1
e2993d3778862c0564557a8f830a8196eea6959a

SHA256
c9dac407e47964ba4c62f59d653d54efd53b9c578263ae657a6f0d5f7bab7dbf

SHA512
47366c3fbfcb686a715338cd89b7d10e409bf4fe08721cc3dc1c60d3ce0d51855da5c1dc927ef4ad0046a237e8a02cbee472cd75aecd56a09ee5f7ec26c2a40e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e7afa455640c11d42aa910e16f087b0

SHA1
156098188f1732ff954d0fe47d7665d773f48128

SHA256
47f8a125ce7ff404adb4a491451810c7c83cd340b2cd07ba9efd57955573a273

SHA512
232232b0323b72c2b64f1ba6ae58d02892e7c02112941432df88998515e8affddbdcb21f57d41f2b3be7ff4ad4fedc5b7487ccfa77b7e1b9109acfe11958e13f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6aaf4e0f89f3da0c7bf743b66947753

SHA1
3b1817c5c63a5deceda7c6c7738cf1fe45b5becd

SHA256
aad298863e8728390ff0b74b937a9f520213dacc9fe98b28a76c6ac9726c2955

SHA512
2570b73d20503f7e9d416dcc89fbdc594146f8ff2284a6490b950697ef06d19e7d224e271ad78eee3dd2be705c8da0923d58f57101fe4a56718d12a4a5d5af48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d44f045272abe349eae16ff06a72cf85

SHA1
5fdfd4b024cf81fa4fa14e81e086de8d0536f4c6

SHA256
746ab9f9d6017669cc94ef505717506b42940c0bd022ef0bf7d2a2ea64293163

SHA512
ccf8c3dfef4ccb9056b39903dd24d75dad738c1e65c1f09a555d4739526697ef10ddc7152085f7cb29c42e96884fa6ae4b6dd5af9e143f0590a96366fad41907

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4342d5c841b251d92448eb3dc3d23b05

SHA1
7b6591d02048735c9736e91736644292a7dcf132

SHA256
92fd6ec56455c7b1a822742971d4f16b3ff35525725e943a60067f4823daa8d1

SHA512
53d13fcfd45c0c18f039b78fc7cdfde57bfa5ecd43940d76d5826574352d98f7e46f17c948959b02b78e5e46900d9f0499cbe1b12b06ac70701d8b1c3f9a5d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cbb9ada9242d8d356cd3e14485db7aa1

SHA1
3ae949e05fe845e21012243c0378b5e768770f72

SHA256
10d09ef680de066b7368a9ed74d671b20a2f7dfe561e6c01eeec5fb04b9cb9e3

SHA512
a28df008bb62a3017ecaa767c87456109b713f18f7a80254c23c219f045add0bb7dfdd842c6a512a40a3a052d0db56a43ec75f7686fad86a239456f861550b26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d60c20f31fcbe5519a303b3df05983e

SHA1
84ccf3ec24d17fd26894d9c7bc856d14ead6cd84

SHA256
d52c8215d1d4860fdcb9744d63979b5366c401e90d5bfd100b7fc2c5eb8242fb

SHA512
f11494f6f430504a2b00a214842b17240e2c559789177bda77d1385ddcfc3c600a34cb648cd1c8eed47f7840199be96c564e1c35944ac19344898c9cd14399f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
add76b713dd968c842d1b8b225432295

SHA1
4a1b52354a0a243d87513219d0fff8d7a8cea470

SHA256
39ad35dac39e5f4ff957d14ed208640247bf1676e4b458b7c3876b6ab452d3e9

SHA512
c394b1937fd27344f408c7e30900293d13e93c58ee01d0af1e81fae6b438a08cd52328b118129f4b5ffb02142f245a0180ac8611cf8b1e9b3363cb30789ee0c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e93d29639977a6461576a293cb7dd593

SHA1
00ae524e4ea82c38e263f95ae26babde91863457

SHA256
c54615e8602b137fdf1ff46bcf5ccfb22ba6a730023fb00e5f9d0e97dca2b370

SHA512
41730494eb7f15309994124b4de5db991285579a8b4359afb21034ecbb563ee3760e2917d208e49a8fdbe892c8bf1f93479f3aeed3f96eb028a4d84a2b19dc3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1bd8e229b3eaaacbb33e17f6fb085598

SHA1
488f6cdaf2688c85a37644067618a8f39ef630b5

SHA256
911b148e4b58d41afd59c8cb6a056e1a86b27cff8d7cc8be97329d081c5b77d9

SHA512
ed6e3208f0e6437e426d130c7c71a41e8e9071c450309326205d9992a88310fef8011974c5914b2ed0b1d2f5233ceec2da2aec2907e87422847b8318a5b520ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0e047210f4d89cf553506da1a0a07f3

SHA1
1854ce193d95b49d474f4fe2a1626f278bc2602d

SHA256
26e7189070c67dab4f4d15ea680ca9c5541f80835a0750449f7aa6346b225d70

SHA512
55811895d3b0ada380c6c76e3b4789a1db045c2903d135b3560408fa789b2c77b71e667f245b8b73d49703584a51753756b11d4783b09cabc25f4acbb8437957

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5936196e5f22895c2f667c9b45996ccb

SHA1
6158eda5d90e20f428e6f41510b7c38611867ac8

SHA256
8679bf089b67d7c28b34f40d2032f171a8694aee061eb752fca3341ae24395e7

SHA512
28a984a0df0a89327d5e78c6926abecb98c8bbc99835adc7d6423d5b005a84ba14dda63375e048c3bd022c0bd79a7cd24fe2196f7e151beb5d9547a906263830

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB4E0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB5A1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit