7791dd0b2aa38aa913699aeb0a17ead9c277e5d1b0d581b2d0010ab39da359dc

Analysis

max time kernel
119s
max time network
140s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eacc47e0d7ec891bd0760a839d5e3f93_JaffaCakes118.html
Size

18KB
MD5

eacc47e0d7ec891bd0760a839d5e3f93
SHA1

62a4c005745aa863366c0c0b4178dd886f69d378
SHA256

7791dd0b2aa38aa913699aeb0a17ead9c277e5d1b0d581b2d0010ab39da359dc
SHA512

52014d95b8e9ef37d41e07449ee2b6c170734ccf3f7c638194e284e68e190f4f4447f6605e63e4c2ba093c8ec050805ff1d3b5efc127cd960d3778c565c38e52
SSDEEP

192:SIfO/QZWVz55Xunm2J+GYUTlnbG+EsjES/VUw/Svso6ee9/6uorVjM1OZE+CuYke:SI0VNxunm2/G2e6hSdC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10ebb5e3600adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F5F891B1-7653-11EF-B30A-EAF82BEC9AF0} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432890716"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000009948ec07ffc5a56b049e1406f6b3215c97b5358a3e96918f1651f4c1820aeea0000000000e80000000020000200000000216d9d8c3880dd587da9b07dde12d49f38282c1931f2b7b2a50dc51485cfa4b20000000c88f592556bccc950e3ce5d770e2e2274e722a838a9784188de357145bdc8a18400000005fe1e6da478ef99218bc7311e998c526fd3de66a81c23c533a25c8bbbbda2500c67a3137ab21626f6f1afb1f4c1b6b6065356ea1f8b855eb4f7c46508e6bb16e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000f16e1c46230ecca4c3426ca04b005687f19d56a4b8003a05b1419c3dfd719881000000000e8000000002000020000000d6dbf967935742e69d58edab4e6c091ece5dbe9fa382abbb4591de4f6b4fdb219000000035930d8b179df0d12d1fd0c5a63ae777ac252af29ac19e56c8aaa7a6a1bce785d64d922cb85567ad8e30deb28d7408284ba4839814d68fbdaa8fca2340a62b6dbc8566930fc6bf095635e9633ac0acb623957de0c32eea39733f2d634592ea0c6d9c1e0cdf0d3d2a0223b822352eebad6ee51c75ee185d6f26e900fbd39244fdc2da1589f0e72337030b96883cbfe29b40000000a754b3c2d5d3e8f0f5a00b06f2cf3c190df5a3a8eed5079d01c2a95231839dbb73e1e20277288d77c6dee30c851e32523eacd419494b45859f6e5ec1830ea7ec	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2792	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2792	iexplore.exe
2792	iexplore.exe
2088	IEXPLORE.EXE
2088	IEXPLORE.EXE
2088	IEXPLORE.EXE
2088	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2088	2792	iexplore.exe	28
PID 2792 wrote to memory of 2088	2792	iexplore.exe	28
PID 2792 wrote to memory of 2088	2792	iexplore.exe	28
PID 2792 wrote to memory of 2088	2792	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eacc47e0d7ec891bd0760a839d5e3f93_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2792 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62baf1785591650f7ab04fc9fa8bf70e

SHA1
6190576aa8a8e6960a096d6229593ff6613dc78e

SHA256
90e75b04a15542c099875030e2d0f9a3a9a5c6fa738355613526a817fde18ec3

SHA512
a05ea6df0e17d015c616cd5ecf66c87b1be4d9d734fe726a3b6c9511c80fb7ce74baee114f7a61e70a61051c5c7f3a965e480b7e37223c6cd59bec1db53dc671

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e76fddec57a134e29735979d7893cf5

SHA1
375da5084e4e76c683d9e984ed743a1a4a95c71c

SHA256
db6509b5ba7496c926b457833be04abf1a8ad269d0b4b4c42e3f1e502ec0eb81

SHA512
ca67e8864c4fa9e8038d23debe05a27ef265dd4feb6bcd4b36e809f7d3c06e98eb3bc842e684fb888b31c4a038760ebf56b71f6a3bf83b8886d2e8d048734600

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
249894e132433d8b5a8ce06c2b94c256

SHA1
8654a009f6aa5404bfc4d10d6baa50badcd54f28

SHA256
97525a63193624add07c70758e90e7bc3011dcfec1e6b01b4575021bd3e62973

SHA512
ddfd668c6007db2287204c80850da10359f93e0a6a1dd8eadf3601668f26761bd5704cc944564d1111fc2c46594985a225880854ce31703c5f3d61a74160b7fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4aa521e3039647ec52f98ff4ea1cf9a

SHA1
12b14786fa894d5adbe4ad9aaa3c202f48edff4c

SHA256
b015945e1ff1ce527d2861191809f32811924721fb9b2711ed2365c282023866

SHA512
7f4310caed54d4e8f1807c2facabd5c94bb26a7e52dcf36741a289b52a23591b8431be67e2d5c5dfe399d9a6a30543e19b43d61aa4be0718aee8243eea760df7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1d77f5c439137a491302a89b308cfff

SHA1
bb5bd9689077b11d6e5ffa2ca1a384f7825c0aed

SHA256
7d5d54ab7ec5973a35697e274fa3d5e13f0c9002f71a9dfef1f467ee1652f3a2

SHA512
293526affb032594f1f7672718b4842f66d7c3c49c3c96166e6f7e6084168ef87960b464bff32548fa6db81f145849e59ec22445c0a316558e449aff5d8fe878

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65f1e84f2c1a669a927d78ef38f7ed3a

SHA1
24888d5c015b3ed3fb1a197d44e3e7aae9c39a13

SHA256
caeed8fae9b7946aaff297c274b3ab97422873cfc2b62f78eee95b801532b4ff

SHA512
11e01300827657c73ab9d39a1e6387480248d9d7f23d56fe042b49dd2cb19cea46da9218919252a7391a3a4fcf8437422d1e3ca1d7931b70f8ac6ada137b640e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8deceedc8aabc03737ddc23d6e30a36b

SHA1
6a2291ef3f1abc0a53669c4a4639af91c44dae83

SHA256
cd7aa6a39f441bd1eb1fa97cb6e966d75817776d6d564381275b5dc6a3e28529

SHA512
6bc9001d9670a4e068265941d309e7b09cb54773fa71cf301a6ede64516551c1547da56a53b66764929f00ab9c86320b4d8a76c65e19d7ec8cfde9a9fa52ea74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d840bf842ed0c1a7f136e0f2b78fec4

SHA1
229596a42fdaddf79f603a64dc9f7dca54a35e0c

SHA256
893704d4d4f65081d768b8daea2d6128885db40e130936151e88f7b14292cf95

SHA512
d204fc8eee997b3992d8702a31de5f9a02da4c3b1696fc5abbd51927752fe5ef58531bfad26f6e648ab20b7d9a623a4b286f76dab119982bbfa9640ef71d2c84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
483224d52621071ce353f64d205344f7

SHA1
02b9492cc986417347be35a18b71ba2ada9fd458

SHA256
68931ae179524aa11becaa167ce1550756265419b5717cefd45aaf433bc1e4fe

SHA512
f7f3f313276f08b84f7d7d712899c4dfa7ae2d8ae40fbb98062a192c8b32a613dc0384112c1dad8e554861795a25c552f4d6ad62c215382b5bb07d8a1302c5d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9367bed9f53769772529de314a346fe

SHA1
1a8f3cbb1259f7e10e36bc8511733aa91000e7e4

SHA256
811282853db9467a4f17c6818ed7553fc5f7cad5d8a220f60f4bd8168b30e8e3

SHA512
5692e3f99ac1492c1f26e47c09654edaf127baa8d4bf69c69fd6c7696ed8dc6bfec8f9c8f0e5c7c184f2b1ff941b53b99ca3933142945db30b1e97e8d9d0266f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9ebbdfd93081a017e62323e7eda677d

SHA1
f656abf95b9dd37b33ff45ffdf0f6dad3eb158c6

SHA256
1c2efc1ee4955d104738c258fba824081c9967f63531a59375e4f5e4ddaed325

SHA512
bed45e793fd3e0ebd8f86f69638e41593b6446c94fa3bb7328110c571d4ccc4481e7b9beca970cf09f9fb98fe334059d2c4389b8732cd066514e770bddab780b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c40d0a28ef7a5f9d4b38ef2c6bb7031

SHA1
b32f99d015b4bc83e351b4823b63d1d6668b7329

SHA256
577ec6ee90e36641070fc4bfde0a47b47d0a5700c0061386abf5c4d826b05b81

SHA512
e5143de40474a9d60cf879b71d0ee7a55fabc24770bb8a5addc1815cafc0e34c83817879dd5a312fbe7d850e26287474a6b048deb3d09c50fa3da6aa396ca55b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae7a37b76c92c55487c4a0adf7a4b6c7

SHA1
882b927c876899c5b7e0d8b82c5a7e925dea7955

SHA256
c0cf7041c261670613c58e788294892133ab669f5d179f7005c986547fbf607b

SHA512
d2a52afe45019cd6bf162e24c8931fe3731c0f4c4436cebd06878ac19a32024a444471e9fa0d9c96ba19155cb80ca1654fa510d11cbff2c3b01b4d8f2bc94452

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7788ae9cc4f3437d717b1d355c77a59

SHA1
0a9d8e5661667225bd4eec0afb75c3a01ac1855d

SHA256
d70589c9be02328888223d6327d9534e3b031f146a5ba4a4d6a54a484c90fa66

SHA512
936dea6ab4fda55524fb877417ed459d3be7942224400d6f0645e09f4a40418a4937c99a8a490a1859a180151b1c7f6ffea235aa61a7cef2019348a329290677

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1121.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar19DD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit