2df2bbfc9ce779105976c6048da20f5c743ec042dfcbc05f15c0fe07d6c1a6fd

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 06:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eac166f283d1f106d3e0b9788a5814b6_JaffaCakes118.html
Size

9KB
MD5

eac166f283d1f106d3e0b9788a5814b6
SHA1

122de27c365ceb9f276e4368d66537a5adb21ad7
SHA256

2df2bbfc9ce779105976c6048da20f5c743ec042dfcbc05f15c0fe07d6c1a6fd
SHA512

6249b9c82ef0e23627813a798b7a7fed24b7573caec9b4b8fe5a1edbfb74a7d6ef1c1bea89a2561006216ffca759fe3b86fb32d19d0ef061003ddeed1bfa54df
SSDEEP

96:uzVs+ux7z6LLY1k9o84d12ef7CSTUWwzfzx57FBcM/Nd/QeuupJxv+yUGyY+eCxw:csz7z6AYS/X3kjYFTXb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432888959"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000f1fcb351db6fb52ed3b6f8c6b65950e3d44b1a9f35ed455791f796366688934b000000000e8000000002000020000000b06f10934d4c23dfacf8b2456010a681469a3ac4f9b7e9c59c53f23c767f8c48200000008a28733db4355fc0ec00825f1c9ab36fb9b66823ee1fcdb9e9bb60c831ebe49f40000000f428deac7e0b88360b0e60bf6ef40c71aa5f411653ea8677ee9117a8f5e3ec8cc439d033615069d27aeaa2c7c820e53fcd1f215536060812821ee6c2f1549e6d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E082D011-764F-11EF-809B-F2DF7204BD4F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000be81841e7202b68117fae1fd5b9cc731f0e890eb00aa9c0ed95555ae1e908756000000000e8000000002000020000000ecf3875ddb04a9174699286d4b9be2370d8a192329d91534ddc00f11f8c52498900000003831e03456169845303194efe5299f51b59b7d075617e9aa18904cbeec47de850a03a7a549dbec28821f2aab969e23ba42f61502ca8246bb1fda6ecf9d323884b04e2b2fccc3a4fea5371d8f91fa72dee71d178d32ecdfe77f30bdccfdbe72440454dc00e15576b934325df199d5874a18dbd99fc07e4f1903fc0a3dcc9a13f0321f3d81c752f290ff52463fe57ef3a640000000334a5e7d26e2887f1f6b08cca86c143559cd8fa55f58eaa00246b13cd1ae19d9291bb2b3c0e6ee6684788e3ed4fff785aac504790538dc27292c7c401fb60ef4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 409228b75c0adb01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2148	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2148	iexplore.exe
2148	iexplore.exe
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2420	2148	iexplore.exe	30
PID 2148 wrote to memory of 2420	2148	iexplore.exe	30
PID 2148 wrote to memory of 2420	2148	iexplore.exe	30
PID 2148 wrote to memory of 2420	2148	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eac166f283d1f106d3e0b9788a5814b6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b2206f03d1a4fd7a5733b6c7bcb32a2

SHA1
6550c5f1a4c523edb627dd83c771475360700751

SHA256
1e498e19bac357c637908925ee515f99394358231e086587a687766ed598548f

SHA512
44e84a7e305f0d84df812b01b0677d43d1c4c5a74cd8978066a31be01acf0d3bbaeab74679aabdfdb342dbb5f12ed4e74a07676213cd3042bd9d3b10a3096f6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d5a9b23bbc8829567fc5a72afb386b5

SHA1
0702115dc5274b02e313c96fd326dbb75d4dd121

SHA256
e80079e96e64e9990f18e310e55443b9791ab14b93b463f2aa006737cc5b8342

SHA512
fd663582bf3f52f5835ca8d637979e7be46ec899466d98e4db3223e177e7a0818a1ad51367c66a955c5d9b42ce7d6ac43833f99a8b010183ae981d8d49cd5ed6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c81f8e95eb33393e963459c9757a20b5

SHA1
7d6b88338cee42512cde25d28ce781f00a8678df

SHA256
f971345bedf51de0ca1b3254a51dda1a38c6d5c1a677bce1bb6547642112b34e

SHA512
7dd031b79b66acb5372ab8587ec3660129c74d0eb51be9a5ee08b48d4b9f9ef5b8cb9c6af6b5246b62cdb5278675f66e6c4ebecd67c20efec816d21f19abec19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
edeb88fdbbb5d21b94a73b47437a2eed

SHA1
458752f45b90204a1f8894136d19511623fe84b2

SHA256
08763a641687643012fe55c3e5fa00bb8c2bd421b15f78413222167c63b10d5f

SHA512
cbf68d24419ba5c1657a7708ea5986e76cb6ebde6cce25dbefb0a80686937eb7829da32fb01b8da91a1c43e4f9d5adb3fa803dedcbc0613858e0200f94f679a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b8db4bc418581cbc98b2b86ef75e9b7

SHA1
60b7d929077e685e906f98a53985e89d13f8021d

SHA256
b4cd6204d8bd5a96cd0b28442d0409e675fb63bf8593dae08a0ec42e8dbca12b

SHA512
2717d658b024c25c9f9a2b46d6bae3445c0255c904667ace7f70dca3263027012ea2f31a46f9953f4b48aa1bbe5041db63eb80a24618d2c0a30ca96814623d1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f1af187d571c4cae875a6f1e67aecc6

SHA1
c464125739557613cb4d6156bacfa6a2bdb87403

SHA256
47c12c7a9c0b2fda1bf6bfc10f958e421274542fd1cef5570b591fa29e4fde0a

SHA512
573be9524c786c3d2d775ab2cf13de9c0be2b44f57bc20839a2101375d126383820a3643e92d5666524b86bfb1f12268a36787ef7569d749ccd6178161e077e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
edf4468515f381780d43b951e83d6dfa

SHA1
bffaf47a3de08e8e3826d88babdb81d71caf018e

SHA256
e3cb75ff7a1619c8bfca74a8b8d53977b9ad46beadf7042f2448b23a17838681

SHA512
aa260e52c104b6466dc5d006c6fa01bbbff9c33db01db27ad4997526a1e2154a0b4eb263244114974b8d2057d9fb94d15eeb6e61839688f1fa19756e38a773fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
623bcde2d5aafb97b73e2d11a7cb0956

SHA1
0445d43dd7b7014abc210a12ebad02ff3c3c7c69

SHA256
0931cb294f710974f6ae9961b4beb74adb0201fff88001e1d80e679be2412771

SHA512
28783420843d3b8c7513d9556131a172204deedfafa8b351c535b7e7e96e2daf0f1116498aff06c51a5bd6b2149167ab83b312f2ab241f3822e2543281636375

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08c8a0613ffd9b366e51a5e9dcf5166e

SHA1
36a63b4ac015d5b02ab9d77c5c8c696d27a3501c

SHA256
20ce0e243d2d2e49cb73c218837a818d800abbffb20681fedd12f65fe2a869bc

SHA512
dfafc8352f635f8a1e3afd43a9d8a01ec3200cd46744a7bc8bb89f9641a9f32e95d0a7eacd5e30c6eea3496555a2d18b3003c4e4b17460c8f31a9627c58d3896

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25a4300be133888d94a351fbf588543b

SHA1
6c26aa1b9d42928afc1c3ad299c20b59bf3be57b

SHA256
2672c8c7a2835cd328085354290cc9898a2324fae2c8e890125ae4d663256f60

SHA512
855fa9da36102ead31398b7a8f3188f479c00e4c962066e30ceb3f70899a3ac89a96a3d50fe75b5064ce45aa242b28df8220fb9410ccfcaa37d824c4bd10e101

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
764910808e01439ccce71f0f93b63505

SHA1
0d6c203a871cd947b6fc64bf7e43b5e9eeb0f329

SHA256
a5cc1e7de4e19b4b4616535ce9eb93565f4b3387ed9e8cd1eb78386b33f4ade4

SHA512
0dc1b9a3856c2533983fa14bf10e892db5992a67e461f8e2835f510381096ba3ac3fab1aadcc3b99d5f1c1a0d8d1d913f5aae65b7e55dd8f237874fdee4681f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE726.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE7D6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit