24bb49dcb7e24e41e16bf53b2d49fa92c0f2d7a59e1418df183a7752b146d8d2

Analysis

max time kernel
139s
max time network
132s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eac4c2871d81f69b170c4372710765b6_JaffaCakes118.html
Size

339B
MD5

eac4c2871d81f69b170c4372710765b6
SHA1

c968d22172fc55b702476e6fec3d32ddab5102c8
SHA256

24bb49dcb7e24e41e16bf53b2d49fa92c0f2d7a59e1418df183a7752b146d8d2
SHA512

1c33402f362b76f7265b0c27689de489a154b1bbe6b0c39d98ad7b64f1fd50875127f6398e9a4e09f0a876af72c6ab181e729ac3f0feb08795b38cb47ec22380

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf600000000020000000000106600000001000020000000bb0a7d0de3bc9d463f050f0f4c031fa5eb482a05863d4ba1e4269718c56b929d000000000e80000000020000200000006cef29bbaabe4f611ddffbfa5103c4074130b6fc264f73ab87b915ea83ecbda1200000004c270bb6804ec348ff5d5f5397f2b56e42b315755529968bbac37d9822af9e9f40000000270f91932cebdda28862df198fdca301c6a692390e9c39505c7d967325b8d2e7953c6a0fc37a466941b8e62530ee9e4ccea726ce58a33133af84d906a59c1126	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf6000000000200000000001066000000010000200000008f3573da622f11eef51572432cc2c3fcb8e8f5c4fbb3f294332fa2b5e7e76e68000000000e80000000020000200000007c335011ff059a2edb114eb6c09734e375cd0e99a753b1f72fcbd4215905b0f390000000b887220a0f893258946faf69a6043b38c36653063a3ff0f5435662ed480d43f403f12535409aeb2f12ed7ee9a879ec4c4a4089d3243b7c8d9994fce526e7bd385a7ad7908850b65a6b58dc8d57cdad81425e64a99c1c305f93fb7d50735c0652c838176102a14729c480d3670bd0907aecbdb611ea219a21c0d9904bf475d9ac00d8e0dc7236fe186a104f665e0d58ed400000007ba776b74eca39a5b68185d2822dc29677fe70be247cfa89931d7ae095868820537aaa5a99b67dae1763d054177dd5439a6ac791f34408e5c22a9a791cb25ef5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432889553"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 207ba6145e0adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{402ECC21-7651-11EF-8CD4-527E38F5B48B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2708	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2708	iexplore.exe
2708	iexplore.exe
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE
2360	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2360	2708	iexplore.exe	30
PID 2708 wrote to memory of 2360	2708	iexplore.exe	30
PID 2708 wrote to memory of 2360	2708	iexplore.exe	30
PID 2708 wrote to memory of 2360	2708	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eac4c2871d81f69b170c4372710765b6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2708 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d2bc18b4b8c19f70d636fb22fb74ee5

SHA1
daf628abf8e18e3e14a55d67ba5e611469fcff84

SHA256
942d7a4427bcce39056f6dc766e767d1f7cea7525f55c5c3b2d37eaa05ca9f38

SHA512
cfb776817e44cf571f4b5c7d667c9c7501590c430757962e37eade016367cc10345135698a29a1108fab88586167fad1c5d0335c97b8f6c9e5ee7bb59a2872f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0d247f6a7893cd460a43c0fab137b72

SHA1
5d8ae4b89287303a1ced13dcfd3b137282c71625

SHA256
110a3a0f296f6aeb64f64db86bdc8257ffd9c926937c58a4cf1b7093cf6a27da

SHA512
5c7f6167bacb7b8761a78cb82159b9f4352195d9bcd297fa14e5873543b5a2ab3ed5d454e6919f137069abc05f5caa4876afa380b307e3bc2f6e78d204558b2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
531fc184f3493738b2acbcba9df78852

SHA1
f03b9c055ec2a0a20009698e3b3c685bb86beb5e

SHA256
11dc3ff0308756c02ad5c796c0a303ea40e17c79ef62f0b599dc32f96e661ff7

SHA512
650c1d2bd1ee58cc8e916c27fa8ca4db745667870d2037ac395178c02d5a18f8f5da4a81c23951c4a63b53b6dc6a3593e73ebca3dab7af62a4621b67a5d9b914

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63c45681e656771cb4868992e6d085b2

SHA1
2b8b3a914862c54fa677b2d9badf0afb6465b86b

SHA256
465bd324a19b2920870010e1e1c85e212580c363bfbb62e97ac56ca3a83090cd

SHA512
0c883426d59f61ebe68cc490f92cd600293be3a944cef6346c02e322402717b1f5c2df36656261dd101903a4cf19c45fe5efc8c8b18536f9eb6b68110e49a929

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
580a1f80b172822605735b335cc01fdb

SHA1
422bd7dcca9f397c02d59253989dad29cae8a5cd

SHA256
2546cd3e8ca7deacd6cb47a058a7be4410748704b594bffa0bc526e9d5a6b1a9

SHA512
f1909609cc7f6dcb2be0884e18a42d8a236971541bde9d4f7249c220cdf82b88b718b08722ca83f807d54c4df670ba96d8cdcc2341e88cf1d583e7dbfb9bffdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2205f40837645cd60c5e4ad3025f9ee

SHA1
7069c25eef7796cea0614d3d43d348aac2aa7659

SHA256
7b0e2b1d695990350a11f7730f6bbb4d0053c11367edb4f295a6bdd7a09a0c75

SHA512
f6e26139bdbfbaa27fe8ef6d1abd130a62f7427fcd7bdb47121ad9a47aacc8214424467afb5768bc8a4df8239d38b264671af69cf08e40ee4e9a73ed70fd6674

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5341085ce1fffaedc95766bae6e7d562

SHA1
300a8743db9dea3b151fbb70ccdb97d8119c2e9c

SHA256
dc4d69dd5e7dfb07aeb2dc5451485fd13e05ed99275cc04564ffcc44f2820f39

SHA512
cd44414d6619df529cfb09acb55a72a7e61782342090680cbdb995b00ee4135d4568ab0d54af60410539baedb0fa40a9bcc467737b65362d14fa045ff7866eca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9aae6f83a34ad421da6ccd19a85ba792

SHA1
278ed939c666be89b45a3d28786851d059c5a327

SHA256
bd38392dfa449e26d2436dcb32e17e3991428eb03347093813bd9df290adf8e3

SHA512
c4c8936193422ac0577494f44d6e5c125f378f6caf9cb3023f5d2aaa32a4843c5f4ce915af08591192b981bdc9362801bec733a1560052835393083e2ee3000c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b39e55d0423ba6218c1dc3e7d2b792c

SHA1
3f36777baf6ae3e4e524c9e01da36b532be333b7

SHA256
913e7f7d41de6005fd524084767cce118cdc25f442d47f599fa42d34239a081e

SHA512
0185bf94059cc3f278f2651c9db73627954b9d3b936ca8e89ca01c2ed0e0b4407324b4b0d23651717e4041c08aa9d7d5bfa764878fdc25c30edeeb4661b0eab6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4882ef35079856c9e197242325939e9

SHA1
3cf83393aa0a2d8564dad2e05742ffc0d10dbf23

SHA256
029d8b906ef65844fef0c93005a52c8b24962e04f36298f2e034d22892e389f4

SHA512
692f6037ae3cf402c59295ee8064966b739bfd0bab79ffa8fa5ef0e8014bdc84f0111121fa550865bc3b03850c2bfef63caf4bc7521a9786b40089addcf25968

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b90478a5b22734a61a0e4d880dcedb28

SHA1
e83b2f7372b02b2966256e7e244b89573cca0668

SHA256
646c2d6b2ec862e500bd0f2c9ed93cab29710517308db0957e56774e92a40cb4

SHA512
06eb4e3122de2628b2648986fff719e55ac8d474025913276167ede97cf710abb87cddc430491dce3ef1297207d6f7710113d66011dc280981450c3cff06625a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0012c93f9f3ffb44ee8fcad53875783

SHA1
233a7e5887ad123f6ed174eccb5a29d7837c9d81

SHA256
998f89177bf5b769dec2fe450ddae138e7c2a4b96195bc87ce8c01b532b5a882

SHA512
8c1b2ae2535fdaab978ce1fb2dccab49a835ba35dfb10ac43003d0274f77d637a22aff32a2e1e9956b5dda756bcec09ee0ca62050af163d2c51858e4e6bd5b38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d0d324d0d014e3c584fce3aa6ca0e90

SHA1
ca3addd25609701ecd8901f70f8bdbd335f002ef

SHA256
01568786ace83d244b3bc0d48306e8750255e23c237684f709d3f506e03f12eb

SHA512
ba015c7bae82959296eea6f3e01ffc167e378ca97c09bdf13cb75e416aba8cba909b78d10d176698f8dc2c29e6775eae23f54b4472161b6731f9a915bebf85db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4C6D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4CEE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit