8c5f8d871edb45ce41f56a05d7f22542108b36414df1f05bea29c367ae3cb426

Analysis

max time kernel
136s
max time network
139s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eacb3559476d085b1c1578d9688b3f3c_JaffaCakes118.html
Size

67KB
MD5

eacb3559476d085b1c1578d9688b3f3c
SHA1

1d9aa5c570281deb0ed638cca6d45161f823eb62
SHA256

8c5f8d871edb45ce41f56a05d7f22542108b36414df1f05bea29c367ae3cb426
SHA512

6bca24dd4e29adf34892d95d56cd9d61b6296d3a26a16bf639d124c44aa588f6b797400a12ce51d3bb8c550b2e8f6fdeb6beafbddacb28e5d836cad8d6c375e0
SSDEEP

768:JixgcMiR3sI2PDDnX0g6R0ljoTyS1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVG8s/k:JVsTzNen0tbrga94hcuNnQC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{96012011-7653-11EF-BA16-7E918DD97D05} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000000386a430176454be9189bf114ec46e608b08e45fbc524348154b20cc4e6a42e9000000000e8000000002000020000000d5c3bf57bbd99a0f5b5318ed98e9338328312959e7ebd3e14f0a852fd323a066900000003ffa1566cf967c933a9ed444d0bac89ed855d8337b2747a0bc5fc42435b793b4b2a7fea48bf89feeb005608b95fcad8ce3b1101c7720690d4069df25d82293d45a1f1988886933f4f1b23ef49c1a415ed9907293a3e9f5ca8a39777369ba77943d709efc1f74741dfdfa7ca9fde7584a6e8b31c0ce553c2f446d5463bd5d9d5bf03ae6512f73e64f62360279dab63f7f40000000a9b1618d8a66955ef0d73b2b2d08fe7ce7c9355438c4f18e2334e4b858e5a4209053f5f17083665f76ec1f5b4322f0d7a4bafa2df95d2d42b05a6d647d8e6ac1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000003fa1b0ad61c12e01aebbbbf5053b84c4f2ce451f559dd4779d93e0434be1d3d9000000000e80000000020000200000009395facbdae417b8107eac632c0c01f18a1b28ec01a2b6e6180616c5400c01aa200000008fea26b71cc0e07451b33514a09922cd76eefb3d17cea9b5e925cc426638dc6f4000000051f8ca613a27da1b48bd07aadea598981e79450bc8ca13e5701a9e9a1c678b339cffb4449c162517b171140ac4d7f8b996c9f1c9697c72aaeb5071926e23ef5c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432890555"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 208c546c600adb01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2600	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2600	iexplore.exe
2600	iexplore.exe
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 3024	2600	iexplore.exe	30
PID 2600 wrote to memory of 3024	2600	iexplore.exe	30
PID 2600 wrote to memory of 3024	2600	iexplore.exe	30
PID 2600 wrote to memory of 3024	2600	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eacb3559476d085b1c1578d9688b3f3c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2600 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5bf2198aaab8c7860878719b65fb23c

SHA1
434ed106d6f62fc477195dab56ddf21b80bd47d1

SHA256
a53a1d99b21a322eb5960ed51856976b4c163e2c69c1556ffcbc1fcd0a643dd9

SHA512
a47dd595efd16bdf8eb83a181c232b7480f7f17c9930630c4ae94f9a712b2f62e239308cf9bd82333ee125263dcd80335b7b2c98d762f29155c625fc35ecc4dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
686f7cb0158e6cfcad8d26461f81658f

SHA1
23829a9a794161a03110bd3ce5fba3e079c04b16

SHA256
160bfaaea634bd64455284706b2162ece98246bc9cb2b81ebcfcf49555ef754f

SHA512
bf63aae747026c2093f5c266fb98410c3fbf42c1a299ee300cb5086aae2debbc867eaf360e2ca28f95329928eac1e98bc38129049c5f0164ffa1adf0682f940c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbb14d4af762639fdca39bf7546cfe87

SHA1
b7d0f11e784081d6b7d2d5be5a4bf2d7c89a2626

SHA256
3d1c7a00c1e7c824ecbfe6bb52116ad63183e608499569ab33ae4b377d93d9bf

SHA512
a09b1a97ced875f27584f7483b3b6cdfac853c550914e6da2624e16b57da90e4957847c70fcafcefde964d4d43e6588669a313700b8028abeaca5a0cef5a21bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e47cb3b1e2d442b34a6bbf1e00854947

SHA1
61ad0e0418f300312e20b050bf1963798a3a21d3

SHA256
57cc572d02e52cb8bd92216249d1ad563e9f822cad8e733e638f31db94dcc02f

SHA512
a18d517f81dd8316b20da7ff9d34dac3c2eb54d56907bc0c8aecdbb9179f38d85be0afa930bfaa482a05a10b91479dfec304cec4dc23222a27cec3222f582418

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
204dd25254ae643d5339d11dfa779f33

SHA1
d70a8fb15fa692ae7c6cd5b74c303b6ba678be5f

SHA256
a37bbecc5144d9305c97b4f1d48ae87cbc11d6d7d531305c67879fc0d5b77d8c

SHA512
0740e9e4e1c31b86cf9192e719b56002903509594860eb5f2426c81a7bf20334c2c98b0a1994199c458f833f1081037a16c7b19f9149e38adfb181faf9156f0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99cb2987b9606afa5aaecc6f44981bf9

SHA1
409f453d6c4cc54dc6278f0167d3f07095abae92

SHA256
c0339f5c37a7d235399988c7b22c733c5a0494e3e7800010de0465c35d7fc497

SHA512
c70979a98b04a69a5652f1570656684d9a09da30ee4bc76484b5f73210d71ee935f53824e4c0bfe10d198a4671c0dd1b577d2250d75d9ba9879138039c37c0fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
edf10fde1ee27a776f420dbb77f66a2c

SHA1
ffd71faf302321a8f6f2d45bffb8252d10a29dde

SHA256
480bdef2a88106b983d6ebbd6d3e66eec2a6bfde87d9e45943144ebb1c5a9808

SHA512
5d6d6bf6d2d8e4b40681f8912642503a455ea589073e02a9133d4b0f98139446b4ad068e12aa5f518a24e68dac358393412f497bba319e5868550da80f5e8656

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72dc5ebd97408242649a31ac71521ffd

SHA1
3b60807033ba2f0c8fee7f11f71bbf9aa1428f5c

SHA256
ece907df38209b261b4ee744cd61ae1e218165aaa9ebdf2339c87807854d699b

SHA512
63bedfd815f601e68dc91f612923453a0f3fd475712c440677b61b541d74110409cc072738dc4baadd75366aed05a8289d5f6ebf6daf72de5ab8b329b41deb87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2dd0ce3cceedc64268354914e79b17d0

SHA1
4d1d13b764861d60b19f7342c902c550cf3eacb8

SHA256
757482acb30e5c573330ea6aaddb784592ffc9c2c4a35a36d2b067528d92843d

SHA512
23cfc2cb2c7b767004fb0a150c221914c9c2e43c9199795f05af731ed4bf74e61353262ca7b95149cc5b90870a8bb33a0f0fd30ae8571f9fdf1908c886565b3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6b7866854fb5cfbfcda744ad284ef58

SHA1
435757556b8561cd22823a475e8955c785614e41

SHA256
05ac97ea203c926ed2937cb84654e3a965a0f2de8757123be4717de108d9725b

SHA512
fb5e56bfa16ea1fb2468340d8bc094702ac149ef2fde21aabed73dddba42a31c00fe42db762c764754f07bfefcbd62e1a25d9ab22156d02e0cd8c562c7760f41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
943998ef8b3146d7454dc1751f690ee2

SHA1
5d799c73d258855e9704b6dd9e5d98b5bfcedb96

SHA256
8d07c4b70fdeb9eb1a8466b6f5b37177d19356eef390d0f0ad6ca3a8cda6053f

SHA512
d44375a1e5ca398b8d41d47063ecf272fec8bbacc566370bdfd4df051585ff5508d1217daf092fab24d41c70dc41fd4029ba38f2cd2ede087c5e21c81380bf1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f7477e35689098a1c6f66902292d490

SHA1
24fe29ad7722c3bfaf9dda142d184f1738993856

SHA256
c1b93f1351151f16f6a7565fec09d7a704fc736a2664f3a555041b0feafa5f30

SHA512
8feba761cc423581eec81c7aef43f961205d9d9c5e4f991387466db1e6e8eaac9a07472913a6443b1b67045ed0b7feb72308ee249530bcf9d6cc5beed299ca77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c028b83ca96dfe4102f47c83a3f8d7b6

SHA1
7467418e3c405f002e1d0c81ff50d26bd71b438d

SHA256
f5606a6d46145788b614d92aef72eee6b43a9f2a5e3d08ea2bbd056e471938cd

SHA512
86a72a95eb14a85ac9aace76295c5af90953b2607320a4bacdde7da9a4ddad96b16bbdf8b82cb54c175826c81e868d2fcfbeac4c554f66985584390736318cf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ac53d7ece7e5253cdba37dc44614e3b

SHA1
101859cdc87f581aead298b5fc2d05b95dfd93cd

SHA256
5f1e790b44c73c3b2ed9be90e5a3377390a5b6833593f0f9c856962ac0d00426

SHA512
ecbf977e7f5fa840d43cadc09b5c62d22dc340fb518f577f8d71a3cce28e38f53f1959c47e4748dff3161b569497a1ba66c259b3d2fc76f0319e9c923d763192

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49937ef37f48781621f2adc69464e026

SHA1
6da891fb10f1ca4c9bd5676526406f0989f7872a

SHA256
4ec757c4b2d1ef58edfc5efa0d4af2f528b1d629c29a450996de1b6014c7fef3

SHA512
566986839612614cac65a7bf28437246ad23242e7ea667e0b115982485d83304b6423f992c127dbecaa39f2b1f9c09cfb8c73970f9eb3351db7a303a42cf20f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC890.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC93E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit