142cb6058c0100b5366efc4ead987d86033d3ef62c55d018d2715dcc7daaad13

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eacba62e23311b73c258324aafd75711_JaffaCakes118.html
Size

122KB
MD5

eacba62e23311b73c258324aafd75711
SHA1

6b58dac0c44a4574611343b3980eb6c1f32b8f06
SHA256

142cb6058c0100b5366efc4ead987d86033d3ef62c55d018d2715dcc7daaad13
SHA512

8dc95cf353b4961137412bf189d4febc21d83fc5ef58ba0a973b74176b6705f1a849c1cb869d828b231ddf8c428d8307be212da1a00ae98c0ac09dd7a315f89c
SSDEEP

1536:S+yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCsQy:S+yfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C349D671-7653-11EF-B8BF-428107983482} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432890628"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000347f829edcf5d0b5a87f919cae6673dd297e549ab2c2c6f8d4fddcc33259a621000000000e8000000002000020000000d6736db6f666fe68516dc927161ba57465f204d47fe3cc9c360c9df986ed6d04900000007e9ada519eb48b0373a111fc3dcda549bfea8b98c9d89621e8f97a0070afadb7b3309fa70941148d3644ccc5a6b2f02b4fe318c88130ecf6b5d51019445e5bfdaf84c45e9fbcd10665cd864977d45ac474590ef8074b4a7ca43f7dbafe9582ab13c81099fc4ecd71dcb900d098a3d0a762379757718e3aa1ed121aaf23f3a69bd82adb49cc4e6d79bd2b2897e470a75240000000fefa9b4515005c3220392747eb5b0ecae253bf731c5c599836699dadbdc8902f2d7dead276a655ecdfa0bee98c0a97ce5e064afb6cd49b75a3d21a9804f21cc6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000f5d286c4ce8a88f5b0652ab3cbdd24d462bfd745f8d1a6979b75d2ecd9b3e306000000000e8000000002000020000000cac8e7360ab661d9edd981c9fcf0fde378ca80157f68e03d03509a0daec83b2e2000000072575ea74fc5ee015edb5dec4f177e5d995786cd8e5f819e23f4156cd554a6c040000000fa3f89890d0070d565cb08ecf5138f4331b74f2a0d9c803fa1b726dba79ac6c8a0f66846dabd5cbc5ed7295a3b53955a7966612a38d9a430c0bbdb4ac9115f4e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d07dfb9b600adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2984	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2984	iexplore.exe
2984	iexplore.exe
2156	IEXPLORE.EXE
2156	IEXPLORE.EXE
2156	IEXPLORE.EXE
2156	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2156	2984	iexplore.exe	30
PID 2984 wrote to memory of 2156	2984	iexplore.exe	30
PID 2984 wrote to memory of 2156	2984	iexplore.exe	30
PID 2984 wrote to memory of 2156	2984	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eacba62e23311b73c258324aafd75711_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2984 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bf1fa654b85e9227f1ac4403d37e01b

SHA1
3060867dd1befd2d21732460a629aba5c68c9271

SHA256
1d576ea7cb0322fe975c95146fd2d0cac0267b3ecda79bf47e9a147b549b2926

SHA512
ccab1fd7bb504496663e629f2b4373250d0b209db4ff26bac2e67ab20753887425fef1c6a8f9b04459fea3c05193ef817a736978a52eb80e18d1f20e294bbaad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e38dd5f501436ab4d4944d7c9093ffb

SHA1
fdbcfe9178818e1152663d0250f3e9708380cf2a

SHA256
56a8fc397080657a141045ad25d06ed6ec126164085fd791f9b1d890f600b04a

SHA512
918c7601afe96fa8711682cf0c3f88dee052c58129e359fd6e2f0594c0da2cb5507661adc00c7c04a4420ab7b48c765d6f6c443204f1ea70bf7d7ce71ded446e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c86dee9483747e0eec600f93eed7458

SHA1
f2d1a4c89aa9022d0864255c68ceedd376e639b5

SHA256
a274252235ebcd08af04915fa7ed842a6355728359b5f91e8cb91bc7d95328b2

SHA512
1a86e2d0fdb536c96e4d939d86b9073face9dc24bb4b5f6cd37d08755420a837c2fe34c3bbd5065c6062a41e2630771d03bccd3734868c1e3a566c82aa6f6bd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a6b110f026eb6f8d211545d0f97eeee

SHA1
22178a89c302811eef2c576f17496b86d237c4ef

SHA256
e523ff187332d2e6bf4bc23c369c6c9af01d3829b4aa6dec69c5188dd73d8abe

SHA512
c14841c1518ee4fff684ba8641a5d962397c93ea2dae9d6497ccdd66f23c46ff1c1542d4ab8cfb905d974fb6713f1b12f599fd81a3f17ab88a3c205fc0629321

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca00d82c5b20924edfb8e2193a48533b

SHA1
d71a59c667d6ddc4e55d931cb3e786faf0880b11

SHA256
85e703915480787ebf5bd0d839ce21ed162c5b66a8403042fd8fdae7a4b467f9

SHA512
ea442d877131d0ef261c27ea1d6e04f558ebf7d2b14442d2bbbade9e713fa41f0d8afba7b86efdcc330706d5a2cd2ddc4c96eb5f755a30efb06c8d6d4a1c2136

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff20d614df2780f415b907193e57f4ac

SHA1
5aa3ec736f7ad0830f720417b4aef4bd73496821

SHA256
2ff83d920c071fdda51b8c7b93347c7926b62ce1ede39de978158e25bd901917

SHA512
3af6a14142b81e9fd6d3040b2b13fb307d4c54b3bc4eb717818b899481e2245bae9400e9592b349e402c41db9045bb370172a335740c340032b3e9d67c9c7238

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9bfc04c94fbbd7c0d586cf591dcc78d

SHA1
86edeb17e5bf8806d12b1d9e631fadacd9e8a9be

SHA256
c0231ce401249fed4b75c4d10b6e4874b3b0031c20f2583610d359ceff75c6f6

SHA512
bf6a98881a248d2f728436e6ad3c95ab719ae9fdf66a8f4a526026f93edc3854311190dd82935653e3a2e393fbbb9d790615abe75483353297eeb415207122b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3dfd2d5a53599f6ec3f76f1204d401cf

SHA1
928112025ddaa94d30f158619305ba6f24d1be02

SHA256
5feb5aa2f0d277f708a13fb5537bfb84bf7f4d4a1efa26e80e895571c0042017

SHA512
0634eddc586be35b72606950f980028d911f43d3a10434db35e0198a54dbf0637b787b353638cf051d54d334dc70521ce9d2cd87463301a904f6379974d3c384

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03163c119395ad6fd73fcd0458e52351

SHA1
0dbd971ff63d88a26092ac52a2c61791ac62d7ac

SHA256
89fb08afa3718b6227a22bd531f4b7dd6819af98c246a5512685412865cb17bd

SHA512
bd8526c64f3dbfc480d41818b501f7a4d40c5f1d92896696c4d3570e4bda769f372f1688c1e93a1315cbcd7501171977630816e6d9769415726ba33220fa46e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68c08d99206a76a4ee31a9b50bb4d094

SHA1
95f45a57748829b360d9ff0dddd2ddb25039d04e

SHA256
aeefba164ae28d48ce6ae5d7a12e0ccd492345b4bda87a75bfe7825a77cdb604

SHA512
bd0c13fe4ec285fa6214362c8271eb0db191f86750e1344000f7e7f62fe664253faae960c6dad11917b218843134cd426607cdc30e92341f74c06ebc2de2e1b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6805f2d3303e7a1aeaffdb06f7db3fb7

SHA1
235a6273fbbc8ced2c6e25cefeb2282da55d719c

SHA256
30a418dc0e8fdd7f045b99ac6d867c5a76e425ebde70b82c3725d36a9c334373

SHA512
3b5b726d742b43eb07fb2cf63a08f99bee64882a0fddd9564d538209e71e49b3d70e5e68fd10c4101b642bc721878369568f6b37aae130121ae5ceb2ae1e4e84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24f6e8cc93f96aad607c3bd3430d3452

SHA1
e3e85439406059dd660aa2662cbe0d9f16340eec

SHA256
e0a365402845fe4ba2f2a8ef0f7a998e921382317d58a492ad370d4979b5d498

SHA512
05e0a011123f2535d8ecb1093fc255d30f3fc4d107540273f465e8d50242b114f5ed07687dd1920396e90388a0a7474d6a13d3d746ff42b4a0d464dc35d1d191

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74c47ca02e512ed3fc50485f250de7a1

SHA1
21770056669b6d01c48fed607317e77479b2d469

SHA256
c75a9ba3286c52470be972337a8ef65f430e1f4a721ff3bcef760ddf17716047

SHA512
b0de5d4c2d3ca7bc7d79ef0466953004185ec8cd0a3b39a531bc99dbaea3ec0a048391514feb436994dececee1abb78b6d02703ada4a0ef7df16758271aa5151

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26e8d1ba3c56f32d77c5f5f88497885d

SHA1
faac4efd49bc0565c8ac97462695e755606c3406

SHA256
ead9fef09919d81d403d366eac440672221cf9cd6050bc1075ddbff14f436946

SHA512
649a5cd8fc145130e365560876340bd89f9e090ad8ada50435a9936c2b19bd3537c6827a41871ec80e4f1237134c68ec125d29e8461ef3452ec234bb588243e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDE22.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDE35.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit