560ef893bc357fa06b9395060c12a10dfbb8348d46540d5695a38e628a511a1b

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eabcf53a3cf02dbf8d3a6683e76bcdec_JaffaCakes118.html
Size

238KB
MD5

eabcf53a3cf02dbf8d3a6683e76bcdec
SHA1

61339577310bd612365695b2adef08768f66a983
SHA256

560ef893bc357fa06b9395060c12a10dfbb8348d46540d5695a38e628a511a1b
SHA512

9a485566f6d79fda94b0b673ecc0be6acaebd7912d99c0d9996d79f165f24e8ff96dcccc8cf36167889dcdc66b670d6c9308b8505e3b89584a593a0af100309b
SSDEEP

3072:R11vYa7bdqmMkEa0bTdtjVTHKzJXa+QB6lYbg/6s7r7fNWHX:nEa0yvr7fNWHX

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432888265"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{42E5CD91-764E-11EF-9257-F6C828CC4EA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1600	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1600	iexplore.exe
1600	iexplore.exe
2396	IEXPLORE.EXE
2396	IEXPLORE.EXE
2396	IEXPLORE.EXE
2396	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 2396	1600	iexplore.exe	30
PID 1600 wrote to memory of 2396	1600	iexplore.exe	30
PID 1600 wrote to memory of 2396	1600	iexplore.exe	30
PID 1600 wrote to memory of 2396	1600	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eabcf53a3cf02dbf8d3a6683e76bcdec_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1600 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
a4012232667521f838668bddd2187213

SHA1
c6f4f03a5aba6334ce1bfc94e4f9114b4221ac57

SHA256
2b5170d227b38b417fca52c8736b49300cd48454b1f45abba69aa14bb7efa1aa

SHA512
479e90b0ebb194cfa910c47f7d5e3d973d2420889b6b17f191133b9c4bd8683422e7e4c28d689c470cb98c7795ebacf82ac3e4e120922dfce7e7d62c01783c8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d5371cbecb5190d6810cc4d20a67ea3

SHA1
084330d4298d45e1d5ac0c8d165628fa1843b109

SHA256
6bfb90f3de171e70200adabe1de69ce54180f14b79f1f6f86a890f42708fd205

SHA512
f2060558ced4df027c20301317a4cf7f79df7aaa2cf237a86acdfa06a913697be53b97ef60d648b38bfd648e9c2e7d388e5037d3609d645d59d3d862ae225354

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d0ef4fe5169f30c37ff29e8c81d901d

SHA1
964c50e37e52326bfb3b652d72e2310bbc7939f2

SHA256
be967e3876ea48fd04201f6d63421ff59535ce9ac14d816196da6ce29a4ddb42

SHA512
c445e681c800c7132d70a3383ce7a3a32cf11172c693a6961ae2392897959cd1a02eb80f0fb0555c08a4be617f46e618d1663bca0bc8fca49a19631466f3dc1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5503bdb6c0bdfa4bc5e159f4302eb58

SHA1
364d185fc75e2239e17ced856262efbfd22a8b6e

SHA256
c17cb804ba4fa6e7b2f9749dd65ebc35a273a6166fdb6a80a1caa0d007e72791

SHA512
e524418876f6069d08be85371b0990e43ff57243260ebe66070a522168ec3f44f5f15f00260186b6d4067d0e4c1af9be9d027cca3a961478909e344047a1f49d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ab2719c400ff114811956b3d3ed91f6

SHA1
fa4bd8150450c290e0aab5ff2affada42dc96c2f

SHA256
b93e411b3963620f424c3be5007d889a3988a88fa3c15afcb712a6ac67fa0b59

SHA512
166fdc49a713c7a7cfb3ee0539ebdbf9e9dc9b8a80e85d6bbe0ae1ffaeff7c555ab916b1aa1069a6ec6cc898596d62281e000d78472feb0e7efd8a5180316b65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8971658cecb24cf02f9053028f6c2e58

SHA1
b4fdc3da9b7f0ef5240bbf8c2bc03f3a5b39a929

SHA256
f6a02fb46e2430d9b6f09b58d0aab8bfc4d830e9616a7415d5af3b89dbbe494f

SHA512
aca5e0a11503a0d9f156653e43a401ae882a333b50fd5ec1fac111a7ce4c806b8c134b0627d1da89dbef4e7400aa0a9994d84d9012629a35ee02b9a42a45c7f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25da666f27e11e89f95e4145e5e82ab5

SHA1
9e1cfc86e429a06a203a0d6bbfcae6d14f9e4312

SHA256
e975b328a21567ce5d87d3d97e97aa422448687e7e487518ec3a46fff85d04d2

SHA512
7548ab2b4dab48dbfa927b313337128516d6bc7065917b8af3b4da3078573d1eb601883ea7071e11f4681295ff1cb6a5d05dbad36eba63be15a94fb3d958984e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98c09a54c91bbe79ebbcad4a7e5421ef

SHA1
950a2918fd1eaa219fc12af5741509f9506d4195

SHA256
2ab7819cdfb7e0ce270261a79376358a00ad17c521ec5ecb17e51d5861846fe9

SHA512
46f79269c4e637776ca50d759b39f3cfb603e5e6150c0ca18e3ffcdeb7f07cfcd43e79e2d4a0dbc7f8b02631dc22feea038e27961cd3dea4ce97e7917ff10e1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0367a942938bd7fa451612394d2392de

SHA1
59aabb87cc015484da6b1974551d5c8daee4716e

SHA256
44f0b286c6c12b2154f5a639ad1e5d388caca0d5d6948015f066c146b147bb10

SHA512
993b71673e99275024c7aa2ef06802f555f45467579c84f78056fa2f293fb38b9b44c223f4d3c42e4d8343a1fbdeb7baeffc2b162b817ad52c91b4d38a3881ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8209f91b9face05245269b00970bc79c

SHA1
c5001136b041bb0f1fe0c8c547e195b85213adfa

SHA256
cc5df6e76000dee75749efda24579e9c288154fcdd7bfd43bef1393f71defeba

SHA512
dd792e8a88c31aa342f44f128780534b5e32be39481b0f5fe0581513fe7874105feeeede9a1aa295d9dba21935af5198e359e2ae8115727678bd46e790243f0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
efd8f487348951cbbe5b7241c4fcb525

SHA1
967f87200fdda78607a20ee3be90a9e837298dd0

SHA256
936338c4bfbc4707d4f4b889ea7c0967c053e6adefe435db5b546197ca4cf374

SHA512
aeedde7d2ff02206ba89d2fcecd35a798aec6f08b2f1d5c29a7273470d9d41ccca157f54955a8d32a16d6e73a287cb91a19476ed8bb2cc7eb4dd5aeab658577e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94d0158af75942681cfcf180fee1df97

SHA1
06d2a3bac6ff6a4f59b903dd724f7db83b966d26

SHA256
fe8c55d2b45f9380a437e4081566d03eeb25deaed8fbee8b130b6b65c3eff6c4

SHA512
ae5819ab58d667fadb7830cf30f4700378e9fab906869b32f8b389ec75e34c2ffd2b0fa5f77544a99ad620292ae1aaa3449d8ebdacc1a3d617d86b6114033367

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f39568089e9bb66de61ca10d628a618

SHA1
445d25df5521dfd3dffba19b53c53bcf08a798ce

SHA256
aa88ea215c6b5902660cf1665b83e339f2b8030e889c22e37b2d74474c7500b8

SHA512
7381879d4dd5a26541e410c6b22f3ce9ff04b3719332fc86621f88b38c4a237c1c0ac6973526be0ea4ff20c36232d6f46969b6653b3ec75dbc1ac602e6dd4ff9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
6441e9bfbcf575fe09dd65b88a087f12

SHA1
af8e130b19c1404da72164b114bc346077c797e6

SHA256
2da7bbe6ca4b672709ac61edbaa768ce7f46879889053078cb0360df9cdbdc12

SHA512
a26650d785c13f48e6c89e3d64c1674950f73418b4717702875f39a050f691fc23ad1f840e61fe9a221bdf1d903e44d1db7cb27c0d14650888ebc5e3b420fa68

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab11BE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar126D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit