a2a2e434faad80ab43aee757e9657c6cdc12c82055066dbf25356638a21be624

Analysis

max time kernel
142s
max time network
127s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eac4352b5371069567c3edcbc8758d1e_JaffaCakes118.html
Size

139KB
MD5

eac4352b5371069567c3edcbc8758d1e
SHA1

29f138d69cd6aad5957b57b4025aed2b819018d3
SHA256

a2a2e434faad80ab43aee757e9657c6cdc12c82055066dbf25356638a21be624
SHA512

304970aa309d2163ba9847e1fddad67fdaea2b4807322f4094c2e2e7a02858f66cf756a2ed8b47614f090ddd16ed2b98c66549ac0458ee4a73c0eacf364f710f
SSDEEP

1536:SALNQBokzuZlwyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJruH:SALQ5yfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432889465"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0EAFDE51-7651-11EF-9B6B-D681211CE335} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 209421265e0adb01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb90000000002000000000010660000000100002000000035e6631b7a1cce993135f7cd06f706c5e066593e4863038df96072f58d28ad20000000000e8000000002000020000000a0825c0f8a2b9f4847d073b3a4bc1abdf72eefff45de5ed8981769801f3fb50790000000c89725ea0e1ed6ff3fe6798a20e57898019338cbc1199d4d8434b4a53d867f79e072ecf6e5bac913dea736f83dad589a9fb409e3bde75f9ac6786b564f62a1f21bbcbabcfb23c1ec436bc3a898705c48bca0fe8ff4da76daca069287bb253a702d02d755149c4e4528d7f90b68a2217748e7594e96cd60699001b7a53e61303d78eec2efe2b0643e13e8b6a51bccacaf40000000e61ec7e5b913eade39a994388241b27a0835abc55a720402bda749a4114193b6fb00ac9671aa696b63ddf29ac6ce08509a11810404090ffd51e31b0adfbc9ff2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000462e69cb4a29889fe3257e305a93626db70bc4ac75003d61104ec10e5f88ba83000000000e8000000002000020000000421f0013cb346ab9d5a496c1e929c5acc1d7e9016461f07cb819c3c9e39ea1a9200000004f27ce6bb8ba2332ef9698d13865e24c096f8aab0398046a2f628f9d5ebeef97400000003a1b181b24058eb1156aa0f9b8539732a797ee6cb2466198fb75d726229cb808149adc44d476db02f1fe5df8e113446308f40176b0d6814be25b34c827f4be62	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
560	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
560	iexplore.exe
560	iexplore.exe
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE
3008	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 560 wrote to memory of 3008	560	iexplore.exe	29
PID 560 wrote to memory of 3008	560	iexplore.exe	29
PID 560 wrote to memory of 3008	560	iexplore.exe	29
PID 560 wrote to memory of 3008	560	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eac4352b5371069567c3edcbc8758d1e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:560
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:560 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0667dae75de866504b9ae1232e9cf459

SHA1
bce1ee65eb7dd75cb6ce935385d3b6f6f15e3772

SHA256
a606761a6d6cfb3ad79d028e9af5dfb2c4358c16ea9ada04ea5ef5f6d7db90e3

SHA512
6c4a6289881b8d1cc1193aa770b6d9d491d0f2c8bd6a2de9f55a80224fbfc1e32510a8604400f7290b21ac6588e4e18d03853fb77ca70afe1752bce7c6a3ef17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8d67e9a0b2ffc3b1356268b2336d335

SHA1
07488604596fc8d296a9e1f22519c933d2e370b2

SHA256
b4f9f65c45f7fade69583de87954e02b0916d286aeee974285ab09e55c3c2c28

SHA512
74ba7fb325eff7f9bd6faedb70473b21a4e1076a6405f71723bca10958e30c994db0aa7d1b6ba3fdc51dc17698b350b380e59a6c1ca3e4f47bda828b9288e2a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd4b2bc22b955459c3f491afb328e07e

SHA1
8fce778ccaaa36cb5fe2bae412efa14ef25d7ef0

SHA256
4e4d4313d8a429edccea97120a129291c399fd2a5f08c9e80b8f73e1cb2c97d7

SHA512
1af9041502fe23a4ec040be310dcc21e4083e7358fcc2ccbbd5d4b628e31462d1181c67d639dda89888b6a1875715b9676ce48b92d5ac2476622364abd7c13fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b39ba245e4f1fd21a85fc6eb825fd5df

SHA1
d19835e1653e35507981c20cd66cb86388d4fe99

SHA256
5ba8abcb4e15f3240ea8167980927ff331a3bfaf0509559a8e238607c210e1a7

SHA512
e239c3450979576ad6572e6067e09c9a2f6a4d7754af77c06f48049300fe9117713a5501e517c23d7898c098494c1485703de7fc3fec450bd9f024dcfc0bdaa4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71e3f9233d4303e67b91c3950079cc96

SHA1
3560921d2204a588a498e1c4c21b5cafec879f6e

SHA256
78ba2d33d96eddb6cf76a2390ddde9950a0efeb27059c98fa1ece275c77357b7

SHA512
11a2683cbad6977e8d66c2b49c725f5b4d65e0a9d75007da4d73bb0c53e3bcdb15ae5a371172f59f0abfe04ea16254eefe52c6d0f1fb3b5eecececea9715d082

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
394edb4b22e6dec781f2e873132dd9e8

SHA1
7b4ca8cfb696eeb035ded1000f542c7cecae8b04

SHA256
6f8bda24fe0dc2a80d25e1434c540b150271a8976fc9d4598ccf0e1a19f12b08

SHA512
a254a22367284ac1b4dc0249f2c5622c655717a570a1f815797490c72cc5560aea5905475331c73d74d1f67e4303088814f8adbe033d80789429316e01c2e3c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7d85233beb4fad3329a55ff6e511b2c

SHA1
503dd876f4de01940f34a158ff3487729d00b314

SHA256
805bb29f58f5a61d279ca675ccfb987d8d8c75fea03933cebe14e95f9b375b14

SHA512
42ba4d12fb96c764ea1f421bf5ee99f1d4d174828ec38209652721b73771f392f33145d9f230b92837f92d1a9e666db2ae73a3695929c671eeb20f824916f2af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4aa70bcf1a082be932dbba94c60a0cdb

SHA1
aef85f8f6ec57a044c96f4dcf43d15931efde422

SHA256
157675cd31a683fcf9e7d404b292edf2fe25f829093a75277c6801697790ce80

SHA512
7a645c7cf9214dc8c5e2dc914fd8182d146bfd4c7b1b16bf1d60c91ab3cee4c0b0b04c2426a12f0e9f4ef4e7ebcf8facf316bd8d6447b64d43c33f21de3766e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77ba022cde99c2ebae2141f30328ff13

SHA1
d164c531df78834a36b017af622bd3d3c7b6f64e

SHA256
a2e49d9a8409fa55e610f11bc1ae432d7d2376b8197e23a5e7ac25ae56a3efd7

SHA512
f4f549085b8d84cbfb2f2af979ac7343ec6e15cd99b1f47d0faac5110f67df4f1b5606d97b856e96751047e509c8bce3682b8c7a6aabc4a323bb4ee2e940424e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2270c6d825ae60c5ba8720f5d415348d

SHA1
602bbf8c38b16f29e5307942163137be0b02df19

SHA256
44feecf59b3e13546ca2279f09a5bb2dd0fa5547b6199a24a0dfedfc8d90aaf4

SHA512
1b2ef194f6300700844f9f4977c63f1c53f85ab8db361dd5eb4198e0c73020bbec18cf3928486098f3ea7de91d9024a10ab61766f079d5bb64eafd5d4f62c241

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
578bfd64569b3b285a970dc88ebc479c

SHA1
9cc44750f16e5460c904832407d6e2fb9bf1e14b

SHA256
330708e75c9ca8d29a820027a0b087d38451fabf9ecc1d97fa49adb25187d8f5

SHA512
1f83abcca79fd3b58211f087cffb9fc529b527f0461e4f1d7fe51329965e73a6568942a43b392a27887c753d756682cd2b184a5512b805706ff37fb549ab18ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4888ea0789422883796d2f4197be545a

SHA1
f82970b57224a73b8aa33aaffe17be420957bd54

SHA256
7c926cc219f2448ef22599352a32971ac0c5be9497df286ed775fa4ca9cb49cd

SHA512
44925a7ad14f08ceb4284ab8f079982c9cbc33d74ebf2c2c733a4c4d39fa33bee15932a647cc6989c74492a3bc1328e205b2ab7cd82529b2f9e87522912db11b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64e3feedb4b76c181082004640d830fc

SHA1
ce32e5ceecfbe559f8e4b151c01fb380cad1b364

SHA256
96fc4f924f9913ecdf2652bcea218bbf72d03d5cc3a6fc33b2940717a7f0073d

SHA512
978c12d2f4488b949be78edb944ccfa62fe2156c69d6982c962826f094dd71971d9a7c71f1e86e1dcf7f49fde6f3cc0bb01884ea166e466058bd3f736d4e9e12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
321b6782ae59dc086aac59a879c7abf7

SHA1
56908b24b879291526f83dd4bd4b43345fc97342

SHA256
6cf4fa926872a2abcbd4e277cbb1cfd1b74495f6f7e24f0c3b34189889c80ad6

SHA512
cb4aea05459950a936f272fe444d69ca96f84d043a62b9a41e47cac61d2e1d1d05aa1228fabd28ea6c007f7db48583bae90ca6bb858806943f3e240aed325b2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3526.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3587.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit