377466b13da141fb45447d4f0f239508d2a66b8bb6a0145d6e7610cf93269488

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eac4d8578ce8a916a4fd9eb91626a4a0_JaffaCakes118.html
Size

5KB
MD5

eac4d8578ce8a916a4fd9eb91626a4a0
SHA1

b7c38b86076eadf8c91ed1a141be4fc88ec5cc37
SHA256

377466b13da141fb45447d4f0f239508d2a66b8bb6a0145d6e7610cf93269488
SHA512

c1ddcfc2a3ea1f0bc9eb345af6940edae82fe1a3900ce7dc2a271e66e5b8e954e12af628690a1d90bf1a959c79bef962ddbcf1184f16be76b9d348f5851ec071
SSDEEP

96:+eaTgXjHGKii9RHGhk2Y5Uid8lyRgccxfccC/qZF0g0/pd1G/4p:3lXjHfrR7b6PyR2NFL0/pd13p

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{47F1ACC1-7651-11EF-9FB8-523A95B0E536} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432889562"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000a0b1b603c42d09fb0d2a9ed09c3602f798cb65a67ad15955d22fc34b6702c131000000000e8000000002000020000000de83646765785e4be2c40149326c1b21c0636bd7dd0a9ba19c1a007dbac8656520000000c52e89bb1a6165c5495a7cb81b9bb08fa66f562ecc059cf5029b1f80fe9f02744000000009289c0e6c90ded01bcc5920f159cc40b413065fb661974f5d5d015118ff2da149c0d768a1522ab406111f261012dfec27d3164d72fa73eaed4e706218bfb646	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0abe9205e0adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000de5e3ab5275a7e0df04de39d185f90b87cbc672a95e08c1b1240e9879db7fe2f000000000e80000000020000200000009974998cfd75fd4dc8a022dfe9a75bf11b14144537bd576c8ca462f58575a0a590000000ad52b4ebf27d97c2480b3047b95e9d9a7141b21c78f8aea784206e1e7fba9a6733baaa7ab4ffd4cbb5f5ccf62de64c6320f3bb6fdc7d3e1f7c90353221fe2f989c61b79acd33d8ecc5eb4f65fbaa9117478f9f544ab944d2c7c4c18d6a145d8eded00ffc436e2acee8e89181ca5d37486699a1cfee228770cb03f12d6dc4a0efb8b097dcfd8b65d96c17a666aa0ad0cb400000007fa8c97f396482d13147a49f1b76fd1a9ec7cbfd5eb89d7e40d26cfa138ba9745d9c378d17eed014efce6b2aebaeccf8a8210b38ba486841fe3ffe0e6e98533d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2320	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2320	iexplore.exe
2320	iexplore.exe
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2412	2320	iexplore.exe	31
PID 2320 wrote to memory of 2412	2320	iexplore.exe	31
PID 2320 wrote to memory of 2412	2320	iexplore.exe	31
PID 2320 wrote to memory of 2412	2320	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eac4d8578ce8a916a4fd9eb91626a4a0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2320 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d630e9508ba51046a86e57154ac775e

SHA1
cb56f2efee16f22d963ff8669f9fb9d6fd022b1c

SHA256
01f2082ab423ec6243359c2f18e8882556bfc6d37b1a9ca0d390ac4020560ac8

SHA512
8e7ca10f743b9c39d01faa269a71cc03f1a3f4680baa8fa95469bf4c07d11829015985f757d2c70647466d4b1eca759afcc74a9d230fd2dd938ba0d292180054

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
469558ccf96f57f4c072053f18c9ddfc

SHA1
bdc20d5e4dd9e9babc81ee1bef1736726aac48cb

SHA256
562a97f5be40333715a596bc37822cd40c143609441596eceb7eb87afdc7181b

SHA512
e92434ed3be4d5c1207c4f2925b5d0609b67f5056061066b6b6790f90a5bc89850f1b16e22046a81c9a562e3f264ea89405b053b8f80c73813ab07097c3f8853

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f861951b818211c57cfad9c1d742fb60

SHA1
123189b0b78ec5e2379fb9fc9a929db451de2280

SHA256
f2334976314576e2618df7dc57c50f97258fefafdd68273f66933c1af5e08e62

SHA512
0a55ccf8f5e0f689eac57cf97d6cee45956cd1b50379925cdbcc0b624e0f5e15987b80e23f4eabac17f0af53495745e1afcef32d684facd93a1c8284178e128e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f00ecc892d501d0997e114f8d35225b1

SHA1
ab61d18c66bf4b95cff0a3440aaf5ea6256f8be9

SHA256
4ff9270ea85537698b384fbac1f68c8c5fdf2092a694c36c07951db6432b3ecf

SHA512
2cfc0b56d0f8e5047c34d37c5ed28ecc4ec7a63f3a761cdd7e6e067252a1dada4e5e745f5aed48cd9dd119179b554cf919975b44dd7db1a90bb824f1e1ba7f35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93dd2bc91d61295919b307924114fd42

SHA1
fce59586fcf76b35e2e2bbac8cc69207afb1982f

SHA256
41e067f7602de7efd6a95cc73f53e043c7ddbd6f021e35b6809888f95fc5eb0e

SHA512
2d7a849486bff1a0be186a962967afad29f8db9bebd716d5ae5b457441ec5added9e290ab97d35ff488c4d92c4bd08096728a410dc4f8e4cbd223d5872c4760c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b371bca916a61c1995ffe74177930e2a

SHA1
ffd69f56c5af89ee29a59ad6cd138b2dc5a2cf47

SHA256
e826f5810e7461ed9132ed2bffaad7ff4da8b797c7dffcee73ad838fb664e2d0

SHA512
99c92d6e85e8f7fc16c81f347597052a42d5c56ce0a8838ebd9f85d1cb37acb60ceec1d9b65813ef16380cad2e952885841b8cbe6aeff027e5e01a8be212489f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c798cfab3f07be5a2d96e1f261b5b2dd

SHA1
9183e4be86f08d2ac2ddad91835851e85e994d69

SHA256
d231cf201b08baa039eaac09dbc2c137cff57b9980228d96414ec66c0d9ad8ab

SHA512
62f8ca02ed2b921c5272245cd82f0e6d8ff703ec757ea373a96cc6a4c697f870c5c00ba6159a6be31b01753b3440d34237be73cda732b04b086e63413ea89918

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5dfecb4e278efd3f5eb436b6f39c0238

SHA1
cd9e3f73001efa830d0b3991fbb81da4867a2629

SHA256
7a5d4b39cfe6be54e998a714a4a51b2ee9563d014ce89afbd11eef1d0767502e

SHA512
2fdb2b2dde5df84a27a97671c923098cd6e5e9104df950fb6c5a6eb48fb84bfb007720bb2aa18d3f5413c4b84a52dd2de5b1072e3e5b52978ea3474633440ba0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bfd5c779de8a405549006c0eed960fc5

SHA1
659e2866254a5679f22e7352635a1d694c092666

SHA256
eee4f99d9f356ee8194ef742f7132e55b1c8c715456db596617db3a6c65a9549

SHA512
9528d7c48109caa88c5d0bd22d226acba00bb4b5008fe24558cf5a4883040d9197d4343703553c8827200832d9270bd93e42e182f0c5d4dc3e8e9967df0be949

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a08caf0218d1cca7e5f68cc0c79bbaf

SHA1
6584fce8fc89350ae437c89ae7fb7b89d9d2820f

SHA256
03abd1f2ccaa79ba6a02e5f6bd440a5ab6c280ea4b9c3b015c37c4aa810f08b4

SHA512
1469200f92daf5e98fd121c7f2555a548315afb6d2d554496509f34e283815096f445ef56b93e019282066fc194d1b075ba08b59d40e9350458fa6d5e84dd69c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99b1df8912b4087805d82db42b17c4eb

SHA1
c7d55ed0aac5f3d0e39f854e037cd54bf4c8535c

SHA256
9a4c88bdd434d9a25af3317dd7e8297a456a754624c8fd6b348b1a80e66fc4dc

SHA512
3342e2a42615d7a490f5e47a7d802149024c96ee7c2d78807251ce0b9c7ab8ac50c75deb8a5b83dd527f6ad25d14dba2bd0c77fce25b963945c49f46f91a1fb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF00.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFB0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit