35c902a01852728a969cb6b0216db8497eda3cb3cd43314472aecb4a069b90b6

Analysis

max time kernel
146s
max time network
139s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eab957659893a5f8fdfe4f1a570187e1_JaffaCakes118.html
Size

144KB
MD5

eab957659893a5f8fdfe4f1a570187e1
SHA1

8f51c083db46d09d6d383cfbf10441236a3ce2b0
SHA256

35c902a01852728a969cb6b0216db8497eda3cb3cd43314472aecb4a069b90b6
SHA512

0ea458dc6081627ea9c540d1f0e467dd4cb02e1082709f5bad48a66c856ed8779f7ff6423977677ec0ac19a7353e9ab3b126a1ff5de40d23d522deb88b27ede0
SSDEEP

3072:SvpF8TKJHx7dyfkMY+BES09JXAnyrZalI+YQ:SvwOJHx7osMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{10837241-764D-11EF-976E-62CAC36041A9} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432887750"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1680	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1680	iexplore.exe
1680	iexplore.exe
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE
2332	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2332	1680	iexplore.exe	30
PID 1680 wrote to memory of 2332	1680	iexplore.exe	30
PID 1680 wrote to memory of 2332	1680	iexplore.exe	30
PID 1680 wrote to memory of 2332	1680	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eab957659893a5f8fdfe4f1a570187e1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1680 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f8bb10335783147676a461c003565f9

SHA1
b350107e7d3bb98bf4662e63ed68715717eddf0c

SHA256
d9ada2072e087959a81a8b00f11c7b8be3176f436e20711bf0aec155451c0d48

SHA512
f86bda3a06168a8ea677c63fc0cdec390c6ce24e34fa4ad436253942303d796313d762f3a20e766b70420c8006722b15eb1f49e533e379c71580666f70b6cc8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a9cfa78000a5c8ef6c44b2824182849

SHA1
9c34128446f589a05a7ea2745e6c5b96d63ab100

SHA256
a32139ed5da4e02be5c5a51a6c78ac30ca0c7d33c424d2faa4dccaa933b4b5ec

SHA512
f380f68107165d3e708be3d00324ad9d6c3ebc19f6575df0c96f66981ca86ecb5c6299a0c4ee69439bc38fc02aa6ef301ca0a45e9fed7ed11c413347a5a7b631

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5de0ecef549ab04c9e100e2cb7ac95cd

SHA1
c0ec7b28231725bc8962bf420a646c9368492d37

SHA256
4aed9d26d2f063ca397fd1efd13a7f354bdc70d244a2a0f497f91237aadd7ce3

SHA512
09e9073ea37f6849c5e28d0cb4fbdff55a636031b8ce362ed19eede7de93388f737194aa57158293b360ff6e8003306f956715e4dc7545fcf4cfd424a1a0b26e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e59033c29623644a28a7f3e4f69d2a9

SHA1
ec1c45c60699f1dac3b613a2ab9d417d1bf3cd91

SHA256
272e887981c2caa012897d0f54e8a94e7ab3e808cb20c341ac2a4bb5b744d627

SHA512
2362fd6591b33e531027d93adfa8e2a1fa3e3f74f2bd9868e965dd9352cb709797895430b6ddb76c6d17a37110b4e46bbc8a6772069515dddb39036f86ebb4b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
743ca39d0d0b1c71319068931edd4895

SHA1
af7aed698cb8fb988c1fb7fe9e92bf2b721b6e4f

SHA256
c3180a94a002c8feb38ea5151a8c1fdd1a74f1e65c1736bfd8888c34af908c92

SHA512
3e42e8b5db72a31eb0c21729a20b5079951b50e22b5e8f4175c257416e69d3738b6a74304bfda8017727e5cb746108ad7ea91351d8eaf603232bd2f75b4879be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
957da19398940f8ad8dc29ba98109e48

SHA1
5ec2ead30a63af3f4dfceebb9eee27e9445c05a1

SHA256
3aa398f977d7c4a05014726265a56014aa6de0fe09a016a0c34c463833fd91cd

SHA512
352e958e8ec3b199bee1da9788ba9253a12e6abf72a0180f539ec09ddfaa27921144b65477b3745f1891e185bb541873683e6255317ca0c1259240e5fb5e7ec3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de829d52e2c28cdbb8d18c1fc31672f3

SHA1
be9c9619b0d258c85325684f20c8c603cb2ecc94

SHA256
796a03d2baae5e1c93d20a5523f75b102418f9db54faf9fc7baecdfc0face72b

SHA512
390cc0eccb0de1d01477dae73350fe54351576dc377683b5d3f46b9d550bbe9942368c83b8072d8f3492f68d296e1509dcd238553a7af1f2c3f4c9ca76dd133f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5df61eb37e1e6b9bdc7b697770cda3e5

SHA1
aa443d0bbb42ad643cf7a55774bcd6bae6be72c2

SHA256
f6ad2abbf090bb1cb80e20ef6ceb2ae946b67ec1fcbf17902f34f3fee869a2a7

SHA512
5662d34b183bff76aa61c11ffacf8871d3358eae64562e105605cbbc82fa4fea7cc95a5e4e70bcb09a1b0aa9f76ab296f72ad2ef6b0dff0e78e68530698283df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca10c5af1f154b6f5219500079803331

SHA1
063d4a13fbe64a9319fdc130d6ec96e0ca5d866a

SHA256
f29fd7d8483419bcd59db493e04abe5adb113bbee17389a84001c3bacdd1779b

SHA512
0fa97cd8525c9475f4056a6e78946a5c015a26f60921998c742c53213054d53f9719faf5cc0d0a30676cf2a3552afbff99653b1f2ffa580f9343e7cbd76e5026

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab983A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar98AC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit