88071e3b7599a20c4b5877f17a0975cf65e246d8154fdfb579a6e76d6ff16992

Analysis

max time kernel
73s
max time network
138s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eacb4351525a9919a8b455b7a8b7cb58_JaffaCakes118.html
Size

50KB
MD5

eacb4351525a9919a8b455b7a8b7cb58
SHA1

f4a7182e6351b6c05a374ae383633cf5bd408db9
SHA256

88071e3b7599a20c4b5877f17a0975cf65e246d8154fdfb579a6e76d6ff16992
SHA512

6de08b07fa4032f84886e6b7c3d9ae878ee212930be5eb7174122586a0bb02386992346f26d872d3e09d80db55dc0da07bfb38cb6b2d7043c92d3c8a57bd344c
SSDEEP

1536:FXiz8CLZL02M5bGS+uNRWTqm6r83hC5Lkl7y0lGC2TsLZvZJwOSDs:wz8CLZL0P5bGS+uNJm6r83mLkl7y0lG2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A02D3881-7653-11EF-9B59-D60C98DC526F} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000f1de2e9bd04b9ed4efc3cb32e84a98ae01aaa2f2658f1edabf8db5d62bb646f2000000000e8000000002000020000000dfcba84e0f68b94f36ebc4684e044fe489a4e74666cc07c4d684606466eb31a920000000ee4a1f9da3aa8abe70933a014a58e85d01080a0c8a8f76b3bf4c1295883b2a7d40000000cc1345a941eab1b279bada35f4bb62e527d42d230a16ed5e467c6f3e26fe1ac2246b5d67e9f6a6400d5a68298b41c4ca90eb77749b6d6bd97fd5099c954790f0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000904e7c8f79a49f47890758750dd73bc1798de62a1a118cb686b847cac7ee365c000000000e800000000200002000000079bb4b2bf011fa5f4f7078fe55e85eb6a06b9bc000eac2b585b3ae48427e520390000000f53b7e365ec7632a9fccabe5112e6862451e7c0ab88be2c9b300781882a83ce7382d0662381d8272b91d32a07c259ff7350ecc7b2f45b79a877e2ade86e777ac5b3f77509bd31d0eb0f61832595607b31388cba6fe4b0ca95563d0001b53cde67d29f0f29b9232449d34fdb0bd651436226ba824912b4667f6521007cdba31b952bccfa2b8f7771c7714525ceeef2a254000000074c4b6a2954da3c92976bb5cbb865b14864d3a33fc922b5c4b5c6a930b08b4100b4c472b9c8a9b28661dba729cb728b16feee5bb9e5891c90ee1437ee8491f97	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432890574"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10f23378600adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1140	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1140	iexplore.exe
1140	iexplore.exe
2276	IEXPLORE.EXE
2276	IEXPLORE.EXE
2276	IEXPLORE.EXE
2276	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 2276	1140	iexplore.exe	29
PID 1140 wrote to memory of 2276	1140	iexplore.exe	29
PID 1140 wrote to memory of 2276	1140	iexplore.exe	29
PID 1140 wrote to memory of 2276	1140	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eacb4351525a9919a8b455b7a8b7cb58_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1140 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
822467b728b7a66b081c91795373789a

SHA1
d8f2f02e1eef62485a9feffd59ce837511749865

SHA256
af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

SHA512
bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4B97E082AC8FC8C68AB8D3FE646C4F52

Filesize
504B

MD5
70e723577c451db53a8a7d682f42cf47

SHA1
2341647c07ffd86aab25c65d0e61a68ccb3b48a7

SHA256
43b781aa26d54c357ce7023c6799244ff13147582d60df94268927942ce6eb36

SHA512
e2b85e773f7dc8e82d0733c1e86180c08ade522d7580385f1d0305b252bf70989a704d92d3ea70bd27e42389d243b297495a9c5ad397e47e7f10b568dee54f03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
ee3ec3279590b59d93a79ed4db75d186

SHA1
08973825c867b6176aaac2d5566d771c63bd7208

SHA256
3d9eac4e2fbbf3b0e8cfbb995582375358e170e0d9b8085054888aa8c73941aa

SHA512
becfd6758679075441438af350a7879ebf8d5575e07582fd81392c669f51960d94759a7a6a805f63b436e023582e61e09e894dc16a951790c630bbb4034084e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1abd29e73516a2d1a59cb06d994fe235

SHA1
87f92cb931235fea413be84fd6fe6eb31330ba2f

SHA256
c26d7b0896c47395b937a98c54677bf9227881fc73377e3883f1d19b7a804915

SHA512
aba071f907bfc42b85517ba30de742dbb1863dba2b7d6eaa81fdc134899c04287386f7a7341401e2c75c6c784e5666a8f2dd4a2a4690458732ff227b1a89ad17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33df5fe7f6bb13a9fb1a5cff116c00b3

SHA1
b5824ee423f788bc460aac1bfa9ec2266afe6d9f

SHA256
9d8c3b0fabf4089e0fad9c85a6a2a67c5c1994962f6db8b670204027c97ade45

SHA512
ff3d3c13833c051ed4792dd098fc681ff2601baa59ecafa8e64349f5063d0da97f26b11f39f81a61bdca46fb39077f166a72c97559faad8aac4b65199f99dccf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03307fe69b85c013db45d27a91b5400b

SHA1
cb3115fbbde1183af993026a5a86b639d252ae9c

SHA256
cf0e7d192128dabdf0dc4f93bb2f7ee5927cdbd9d3d50ce60db83951dfbc5fdf

SHA512
12542fc37cb03174a53340aa19774819447a4941f8a13e7bb4b454e858dcdd882db37255703e87e21900c3b1c1745d1ed06ebe338a79b83b4261cf8a5ecf3eec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28afe5eb64bb0eebe1de9f732f1f2975

SHA1
e6f67cf3ae2533f625e35ea0e5328a9519fdf62a

SHA256
814cdd07536766c1feec1be889ffdf731d70610b552b4740882f25cae9084df1

SHA512
e404b826a603ea730ceb6559b89ad3ca25fba03326324453af8d0833c9e876fa7efcf87e10a20fb5e7b7f4894507aa8a2914ffa39290c5a9268d02f5d4002866

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e26dd92249597b50eeba7a9c3b220c07

SHA1
3a1e13f196b1d20d7ae67e0797486ac2165c606d

SHA256
ee23218777550d5e5e0822a431b5eacdbca7f5d549c3ace44b86ae2ac987fb0d

SHA512
6517de427c8eb4c5ee029fdb006868245044f161a5ed1e4c6a8c58af4169de578a794515e4bf4fd6341aeef9cbeecfbbdedcfa3b02f6b42ef03e648617e00e59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f15d477f2fc3d8da6d37c0e1026d55ae

SHA1
d9ebb398ed2b011f6d30dc5bb1b31c89ae7db492

SHA256
441827a92da3b866381e4c105a5de4176d6b38f2cce0a3c6dba59afbb33af904

SHA512
1dde0d8a22ac075969b486d7bc9d7f09ecc5fd719240363158ce5963ad89e9bc5efa21f4c8e1870efa4c6cf877532d66c3caa1b379b103a3efd343a7654d2e2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
739a31ade72db474a90e1db221c53e6a

SHA1
895de7d6e2c1ceecf896fff8f10c26bb4118b128

SHA256
1e1bce32fbfabb4b81c6076d10264241e2fbcb7136a1916dca79bce5f5a6f286

SHA512
58db054e7b7f49e790400ca8f753113c63f1b1a7794bcea8e64f53f2b48277b893aea8eeb524a0a54f9e63f633bb2d339d4c9ce79138da0cfe1e82360ee681e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5d94fe68501f8bad18d277731656046

SHA1
e0bafaf2786b8c9a29040fb71502b681d0ae40da

SHA256
e2fb6ddd9d64aa784cb4245809e3873623a3fccc54aa52ce4cc9d7de949bf7b2

SHA512
11456230e8191164ff8aec1d0faa115d0e3d5467faecff626e1576b68ac7e692c0275abfd0307d2ff40b82b5a78c4ac8c3f060da2a6c71b19acec0ff09b4048a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e68468bed483d02eced79894bf9f572

SHA1
199a5dce02ea48c9f1aec0b6dbf0f2c121e9c9d6

SHA256
b374194c0e2e4910b028541b071ee7c7159dd74bb863e5e7608432f4629dd9c1

SHA512
9549712bf80f722ef9c774c694c8466140fa79b629a63ef1dc84442fe642436a2633eda0f1206042779b48c082dd30d8f3289f7e5d91fa663261d0a748e4881a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
924f6b7b09317fce4d77e138f57b31af

SHA1
7f31fb4ab04f82200c14a28148a054305c87a304

SHA256
6f571a7a6746110a992f04ede742ce5791ec0cf4eeb1fc9adf4e3cd95d64c572

SHA512
e45e92ebcef7c5f7ba1cb386819bd085958cae4183c1654166282d8a1932b366ae7c23d9dd00a4d0f29d33fb651fd156f9117fe91730072527825f3f4e4f2b0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb81e3c4bfab62713c937032e5e8d37e

SHA1
2ff0bbeb72ab9df387953b8dfb90540b7bbaed3e

SHA256
96d5949ed0333b9116d8756fa041686a80f8444a37cfeee7414031b13af7539f

SHA512
2f8b4cee54f816841911283d766e7bad09bda1d8fac89f169a354c01a1352ad1b310c627685cb10ceb420caabc81e61a0276736056e6c418b6a91a90dd86c0af

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD52D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD52E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit