2ab268685337d06096968738d8f12e77a55298a9545069d5513741fec54043d8

Analysis

max time kernel
142s
max time network
153s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eabc5c636ae640ee2478b163847c39d4_JaffaCakes118.html
Size

58KB
MD5

eabc5c636ae640ee2478b163847c39d4
SHA1

ac887831dbae768520e5be9f677d0de98aac624e
SHA256

2ab268685337d06096968738d8f12e77a55298a9545069d5513741fec54043d8
SHA512

0029c054e5154e7568bcee19f5c63bb28030f73bde827272b335331ac6ff869a65452bd482a5c9210a802373810ba630b418e619d88144b74d4aa1d1a157128f
SSDEEP

1536:SG+x5FqmZblX8EwIFqkq5fYbeZ0clnx/ZjL1Nurl33dZXBQoh1N:SH5qmnBwx5f3nx/ZjLTurljXv1N

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000cb95d3cb577da15926d864c54518ab6c58570a6552d821f712df4d2aaf93e20a000000000e80000000020000200000008cce470e82c268bf94a521006f7c2ea8bfa6d63d1f00c9df08f48ce28d5bc686200000000f33164bae33567d2f3289a39a90bfd7df5f74c57052975bf99bc5e1845de09d400000001a99061ef00c107cab8d3716c7e951c97682f98b7a9f9753048ec91b94e10610ec5ee5a0bb896b0ebd2d3e4a25b10a36196423f3e70e253e6b2ad15237a4f1e7	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432888183"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{10D50FA1-764E-11EF-BD50-D686196AC2C0} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a033e3e85a0adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000007e8abbaa11f39e50f7cab6ad31870be948f1a391c2ea5847842abd3620010eb7000000000e8000000002000020000000e4d3a0236568b3a37dbbbd19d5a0152b5d910ee36d0b34d8ffeb6c5517190d949000000095b9d9960c1384516157c08af45515592c3ad2ac1fd79058e3067b3cc4416864edcf605f2c202dd51ed67f83bf58d3054f17bf57d7859fa061be1d41f950889e513e27ba5054949c863ef48560a7f620d25747808a7d1bcfcfd84065a6d02f0a652e64bb58ce446f81a670b604294c72be126634f954643907bd3e2e0d3249993f8701b06e3e23bb66a2b39f3839bfd0400000008c2baa8e70e28914ebcd21335b5ac88ab8097115b277dddfd8c908bc1d224bdb03fd0ab77d3eae745b359fd1961ae97eecc4e6d0a23cae0bcec5ac1cb39bf9e0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
660	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
660	iexplore.exe
660	iexplore.exe
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 660 wrote to memory of 2816	660	iexplore.exe	30
PID 660 wrote to memory of 2816	660	iexplore.exe	30
PID 660 wrote to memory of 2816	660	iexplore.exe	30
PID 660 wrote to memory of 2816	660	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eabc5c636ae640ee2478b163847c39d4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:660
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:660 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02b9a0a4bf7d11bafe8d68cc46328b4f

SHA1
81e84a454e83e88e0169eb311c1ec06dacb0bde6

SHA256
3e448d0ba5aee011e591ae48ca3059ecac745def2a2547c4461f9147ad7fd00f

SHA512
296c007d49ca351d58dbcb19434653f488e07b2c9152a2039863108e0d21f97828b5f3e68e4f0948acdec83d103343be97e77f3a3510f0e954594e344d2a3ef7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d79b2e5557e30367a88eddf5ebf379b

SHA1
b7f050f48a4ab883291203289649a34346845624

SHA256
509b9e89ce9cedd3430012cabd9ccf5923d383dc14e67fa6ef216a134d6e3b00

SHA512
e1e864b43ffc2e51db53bc08f4ff7ffe6c1cf0b7920818f05d360afc7278041804e9f7197e0370da808392bd7d74a93d0d99e3924a2b497db7b14b6dc7a471e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e358ac8e73402b5c3cb548a242d151e4

SHA1
3f139e3a478680bcc7adca569b2ff703492b7868

SHA256
c8d8e91a725ac278fd5e704c83a33abff759c4ac1a80f45549f8df659765ecc9

SHA512
82ada3ff386f9cebe69c7ae4e6013b0edc2a0bcc0302751792e0f444516a985bc2019b6e02476b6490d6647b611471e3674e1907aaa4707d4365fd27378b54b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d605abc5fc3c1bb5b12d6db761b4496a

SHA1
e490724b3fadb83601f38ca113fd9d3a9c7b340e

SHA256
ac67dedbfecc046e8b13a29b5c90deb3f014dd4d35eec8630d97822b1fe3e0da

SHA512
65f530a708fea681f7c9378c3fac1559be14d659de079992885dd7857c9b89e769eccd1629f220b1e1522c6e3cbdb36e4abfcb9fb05994b1225e28f80eec70d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
661fd7f6ce3ca7945d40857c2d663964

SHA1
76b0946126b6d6198d17cce4ccac4baafd177c1c

SHA256
64c4bd4f17409c8afd182b66f40db3837c35307d4d05873b343bbe42f8a906a1

SHA512
151808d64deaa816fbff16944b1069f8cf0fbd51e2145f4646bc88d006829577b87d8c0e42010bdc42d96f13d3491a8732a4332613c447d3c4d49e03ed01a976

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d4a6961affd3f4eac18fb1052d3a068

SHA1
b9ce9b4b13f9ecb7f1e0d4e9b69292620b30f942

SHA256
c0ea8ad3f76662137d20bcb89853c7ba0ddc3659b0eebbbddd27248cb2a26a32

SHA512
6c2284549232b845f68505183fdbec9bbdee66efd55ad2f28ddc0c0b88eca8f7e53f16f991e83d9c7bcb2c224a6878e5f5ec9e116e75cf391fe00eab7db3de57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54d8609c2cc47a64ed2d5b0842778c0f

SHA1
2625dbda018ac4b4c547fd6ca821c5a3801a106a

SHA256
4f52ec347c0cc2a40bee11ff6d4d17e3aba7f33c9f0be550cdf9d2b9b3d1f816

SHA512
890ca06008451795b3f39f508410f7b35834cce1dbe4171556b896095efa4d0c6272e703474a0518637f078e3baa1a75693a6444dbdb935d173e78d153778e51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70eb085f5340f90ee1ca07e5788bac37

SHA1
38858cfa8aaa0ca515bd19e7272af1699be1328c

SHA256
22931534e02889edade62cf1e10064f352fe5f734c6444111ced2f0865c2029e

SHA512
93b6e46f28f9962bc5c7aaef8bda2b03c7f07bb225f0655633dd7b4af2117e099a4e683eefb92a703c4f77f6462aa43008ac0dd08f6d602ec82d640d211f4a6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc174248632edc36cc349778f5a2bc03

SHA1
1330f4f767b187ed75e6768d11e846e0996d876a

SHA256
6b648c71a4e125c8c4e9237b43c8e78d786c25d7629dd7da0640ebca229bab3c

SHA512
0051513e7be2a12fa69dd5a15a5d65b285862acdf4447c3b428dfd7ca3bcefdfbc56d7ca405b78095b6a3b6455a71e2a9d712db226feb48d2b56a4674282d3f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4633f4ee377d82ae9e27dca0968c325a

SHA1
d62c3893cfe2a4db09f15597fbe7e8a22674477e

SHA256
74547062f308d36c136aeedeb017084cfe5412ea8dfeb4bae8b76746ceb74865

SHA512
370273e24d9f68774dcf0612a7cd3b5bde810b816c96c91f16a13343b99061a7887d35645cd8e7055fe75c4fa3b2ec1db6d60f03a4e3fb2785c40bd6e6466b30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57ab40af07c96a1db554d7ec7620a430

SHA1
170839e9e3415ee2f7cf6c89fe542bccf791a271

SHA256
96f53dbed2a4a0480d24e259ece008847e47ef80a8fc13c7bb2c06ef60201735

SHA512
6a0402216f3818263cd196460d53e1a11a52dc257d39c517be170288407178a18a4a7a92bb2f563a70551198622aeea35803b0ba0056e04b2d119e5fdaef84dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
339d6e48bde8c1066cd9d6dea7b79249

SHA1
8bb7c3e9d82062ccf6a48e828f78c162500ec109

SHA256
d54b4e9207be71026a19798af1882ae7719e358e97065c3fd824eba2228c2b86

SHA512
d4063dbbb7ea04754c93dfcd00b92befa604b30bf81b000ea7fa437f068102ef7223e14a09130474dd1bd0084ba9918f7375d98d2920326e677de230906a8b68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0731265bcae936527c628fe8ebba21c3

SHA1
20757f6ee0c9218520bc73dc3ee5b54c1042cc29

SHA256
197dd9b6b0a1115289fe3e3b8cdb96081c0fa62c9e41606483ec8d9d77504a4a

SHA512
f01c326444469a27cdd25a8a3f2cfd9633680c5892bc7ed2da42a1f2fe658ab1df178f8fff770992b80c617ef3b9dec0aa9c3729e0d9541daf8b182650ad9b0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
561cf936b48fda40505633eef0d729ea

SHA1
41d1c3811f3254f349236b5413601f97256d9a07

SHA256
3dc8e65d399c0d402aab99fa26f68ed15dbd9c154d36cd1d0025d74ee208122c

SHA512
d850931fceb89b9ea3d2f023291f9f5986837a41adbefb89d35575c49e388c51dcf8c5550c8416f11019fba4b0e78e8136bde4bc361153f24f7df83beeab4ad4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e6b2165426a4a89a898b52caead0769

SHA1
d4d69b1068286a360919b5195113ede6895c86c1

SHA256
f3dfebf5afeca8fdef83620c4c791cb31fe3aeaf319f9d570cb216d299339afd

SHA512
6fec8f7213eab93291a5324275d3a7163b97283091b48936544f065adaa14f736bda8e7af1cd3e0cf83ae329effb42c24ead8c0c9687886ef3fd29d037edf1d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2113e0860209bc679ebb15dccf8d432f

SHA1
80599cde830592b35b8d9e07835678168955b737

SHA256
61823b3c4e1e7b703c85ec2069d0796acd713d77f95f6fbfd9a4e6efe0fc3b33

SHA512
30dcc82283de1c860f2f5e6b9e3190c8f5b4033748f2920303f1ea52211fab47842d630ca8ba3a2fefce493de2fc460c4f6e38ae85291ee7044b8283f303eccb

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF9AD.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFA5C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit