384b5e2594f4f4c59d4d2095d1cf8d77dadb2750c22d93af0916549a1016719c

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eabf5483f716b4c4445b9b0386388813_JaffaCakes118.html
Size

81KB
MD5

eabf5483f716b4c4445b9b0386388813
SHA1

ba0611008fa15277a650fc3ad10435a891e5e543
SHA256

384b5e2594f4f4c59d4d2095d1cf8d77dadb2750c22d93af0916549a1016719c
SHA512

323b57fb70835165b4660b3bda2de0e453626fcdfc81298beecd61aa051e3fd400b462f55d7c48a96c9b1112b7c1fdc009ca780babb1c6d070bd770ea89e428f
SSDEEP

1536:mrSvt+ZZTbgWzZ7A81G/+dcyJAnYtjLYHY7NHSfvQgLX9d9JK:mrOLvXLX95K

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000ced72ef340d99e5fd57fd0879da7155b468791308b4bf9c785d80a08d85e4aa8000000000e8000000002000020000000f7951ca6d7eef7e03e103967a160e677d6e707ab6492fc1bf136986bf7533bd0200000009b60af5a9f6248b567d10213c86463a0d8143ff4aba610b846360f54d8062cac400000006fda8c7a4562092455966c3b29068620d573a483ebd2f68dbe68f78fc1f148491e2bd4efaa4b61c4210e234c64cced05b0511afc85baeb8448283c451498737c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432888640"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc500000000002000000000010660000000100002000000025a140f98075440e35d44602dd9498f8b4f8c03c8578b44ecdd09827a20287d7000000000e8000000002000020000000a147d3335ba9be717740105a87450484599bf83553254d679ea7b6033383697e900000007541b931be576b4132514364495dda795037c1152214ea8c03640d8d28d7263dfb377f0cab21fa8f888c89a3422257a5556a4d5d05ece907750550cce6f8fc0bec5b2df4fc800d4c3195c67dfb133558ade3449e5be7e3d66ab39a2402a6076bd4b586823d5dff82487dfb1c31a9d827d90d2b38af68f071cbba5489b04d1b85915199f1218b422fe74cb0dac42b15f840000000e0e9efdffbde128b3a4eb91498c6e7ede610747a818222a7cb45a673c063827a5c60901cb38d0cb66523a9bf5377d74cf2dc1b9014854100c65441aafde61d38	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{21BD9021-764F-11EF-8B78-465533733A50} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 105219005c0adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2360	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2360	iexplore.exe
2360	iexplore.exe
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2468	2360	iexplore.exe	31
PID 2360 wrote to memory of 2468	2360	iexplore.exe	31
PID 2360 wrote to memory of 2468	2360	iexplore.exe	31
PID 2360 wrote to memory of 2468	2360	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eabf5483f716b4c4445b9b0386388813_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4281f2e8f0275fae70af3cf2512013c2

SHA1
423b9bb32a7ecd9689d971ed9044da663d82f797

SHA256
2beb7e4946a677fecb82ca7a9fed97bc83121d72a2bb30fddfb604e34db70f3e

SHA512
360f279d41797a12e12efc3597c0975e1d694a422c4ef2d3a846867c161da429e7de519e81c460ccba6c47bbf8e93b60cbc27e4ea684421b9353bcc9d9a53064

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc845e639f965f6b208f982c04d1249e

SHA1
1337b4199e71a26871337c40bef131a96c0741bb

SHA256
d376ad4010c7e0f536e293da1af42c8bc16f5e8def9bbb269ffc562c814860e1

SHA512
70f4a29981ca07a59bb710ec33e229336d9fa21385acc0741eedf916c942d1e3bf9e0826ee2c0f0b44f3975bfc197cb0fbc936df00635d72a52c85ea456fa30f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3352d9c69386df7a819f8a3917ddb0d

SHA1
1e15acdfdff418ca9bc63d60cd44a2a2771621a6

SHA256
077345575faf8e14c8a889f05079ead63c8cf40fd1282dec6c86296a5b5be88b

SHA512
c90886270881c8060f402d1c9e59846fa6ecc7ea8011ba1d7a689f8bd08436604731fed3078430018a081eec01b2d06ebcb3fc08b305ad34a8f46876a1f301ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78cc8ca622dd659afbd624b8ffdffa61

SHA1
6aea8d7c5e72e4d7cc7cfaa6b5a354f3be7a2db5

SHA256
764029fe9c4c95f6de091f507559b4cec4ffbab7458719cc43e555950a64e8d6

SHA512
315587a4b6432e663f6433250a563d1463e85d7cf77d60dfb36801fe578c05327a7ac97a130f63ee1b24813d3dc4f4a51086e8b41c8708b48af48ae72aa98c9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b891fbbac61a8be12f3b6a7e3490ec9

SHA1
38065b661e99aee74499b1a0fc7e962fe999f5bc

SHA256
86d8d7a9ccb84988cc24cfad0ca8c82dff84922ca9fb77be40ad6d53bebd8953

SHA512
176f4ac38d93b535f8d22dee1028e1265606f68d3219c5da0e81884e70d5f4186f00f082f3a9bf830a7cb51d7aa66a2212266e782f7dcb84dfd42e73a4cf043a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
612b0111fa277978aadf897036826246

SHA1
4117aa496001822f4dfab5fb6059e7ae7d2c84fb

SHA256
0907542a8470eabcd9951e614ba1b3fb3a795833ab5143ea595b90da30b1eb3a

SHA512
7320f5d04765380655b4c5ea4d8dac8b2f6e38ccb4469593193cfec0c916d5e2e1b7c2960feaf2e63052a07e2bee34158659ee177c2ed60d85486604099173f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0897d248902e48243981135098c3be3e

SHA1
4c8b6163ca67a7655c07550014e4d26d43c76c1c

SHA256
57ee79a21fe8481f480196357bf40631cdb8e5c2174eaed3ee0523b7ac46b1d7

SHA512
b8ffbfdc63342b874f80034209bf8aa7485c2f16213211848c5cf577a239ef3acb2e5d4cd78c21d248e49a8ca8ecc885ef5da44497b850e517e427c460a03fa9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c667271f666f23156a05b2bf6980b7b

SHA1
9093dc673ac5d149e3840424df19dba49b4a514f

SHA256
18124df9f5c03c3134a4c22469f93099cff75c75f4657dae5ea211df80cc3a44

SHA512
b27039f8c74cafbf0587e964e8d29285891f8b4c349c59552f4a35bedb1f40813e9218d231a294fe0649dbeaa8ded350669c047a2646844e9569e358aa6a0a9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
088d31d528a83b4a930cb6e727729e12

SHA1
f4bcc3d1ca59da620ef8f060c4e0d23c6c9324c3

SHA256
807bb18e46b31591b20ad69c849718cac382bfe9b882ae9097de960d8ec64f4d

SHA512
2c922e2682ce34ac3ea8b5c43ad57bfb725bb9e526fb2865abaf776d0126ace367937a1f3b4ea3e6ff1b19c73dbeef9d48cf084eae3ada5c820cfc225096e2f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9cbfa2b3f1f6f8eec0f41e5f17480c0e

SHA1
8a2465d0766104b60b01511ab81cba497aede061

SHA256
41caae27f5eb83636c6439af2c8ee2bf0aed805c41bc920f099bd2833c2bf50b

SHA512
c01aedddcd126271eb891ed506f4174680271ba22b68bfd20e34d0e1d149894c4b4f9076f9a469aeedbbc0a3fea9d44cfc7014cb1f2657ea984fe18ec659f29a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
824d975c433108a53c6c241b71c3315c

SHA1
e478269061dce08d65f160ace39b2b1a1bfd00cb

SHA256
f96a63aa0a3eb0b1a6ec97b353d4403cabe8fe20ca08536dd2e9bd7ff89cc899

SHA512
d8c7b616a3bebfe0654a20c9d2da091725dc623a3d85cede0d5a73847351dd3e52d2b8bc99db76e71facaf1a9f0fdce5d18e753d3cbd78c7e72d1305d74f586f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f13b035195df51b86f974b27b4daa86

SHA1
50d53390e903b455e42fbb9bb0bd6ea0f6d3bc42

SHA256
d057f390605840a2821298ee0aed5d9931e6cedd88a7816d649d08c9094c02e8

SHA512
4ab6196eb32c3fbabcdf81f239bc0aad62088e128413b40572b3e108c975344bc4c69ebb926d67997feb06d9c767f716a96083e255bb3f5c2b5d1c8382572d20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b052e6f2d688c3ab4e6ff35a0ac8312d

SHA1
47d9dd6fb2faf49f8a3684d321b7f68eb0bb48b3

SHA256
4c7760f688358747d7b4c5856ca5b0c76eb48b97c75d811f2cd0d5495687c96d

SHA512
20c2ee54f08fd30274f8ba59a5f27ef0c6548c87f787c23acaa0e96961dac28f3bdc044b7782cbf7b1814b842b92fafa2a679df8583f5dbf7b32d38ba5c4e492

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c481db9f5dd10bac9b03b51fb4bb269c

SHA1
4160462aa07fbe4d7a1706f5a6f43ae22ac1759d

SHA256
2f6308976c7008ddcd88c3627c995ec46e2e91a388b08a83b5a7d8335fa3a41d

SHA512
73762bdcc32ecd7c25e642f59d2e03b83cc8af9c90f0a42972b0c9633d60f4465aa917ef774fb6e1db160f133b4510e5de2d3fc8826cf03ed3b2475fdec9fb85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b8db93d305ba75ea6198310b43cbbf1

SHA1
b523806aedf072796c3f4ad3c9cd6eadf8dfd7bf

SHA256
1825308da3f88a3f3b01b84abd5d2dc0ec9efc7beb62ea432d70283c3c45440f

SHA512
57fdae84de69ff54bccaf42b2e9cbeb1b2c8c374ce7e7fc3b89ea598e15d93f38d22e901c26b0a3e30462ec6e6ac004667302e4a792e4de7a8e12542b8094360

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8a415db753e88ea67c536b7ded7610d

SHA1
dd6c8bd26a9320c480d7bf89df6cd63837a4d4cc

SHA256
9ff5b98b745405d01de39adc146367b208c446cd0841d1b1e70cee77f5aa835b

SHA512
c559f2b98b8491690d7191deb46bf6422cb26a414a38c2ad13890815bed87f94fcf8d1a287bae9aca12fbfa62fbd8637317c524b28b6ef1e624982a02985f0ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE93.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEB5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit