67879f807ee435c126fa2d268fdcb124780c671b92c4020710f8700e5bd24c33

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eacc8be42e4c8bc47b6913a65a280742_JaffaCakes118.html
Size

4KB
MD5

eacc8be42e4c8bc47b6913a65a280742
SHA1

8ad2befecf4cde40178ea32c99a3ab89d4600c6f
SHA256

67879f807ee435c126fa2d268fdcb124780c671b92c4020710f8700e5bd24c33
SHA512

55704e7fd862af42df96739111e1bd145b27f62705b73a93f509bdb9f0de1770256e939d9d5b6156a7ed6075bf2ad81aa88a56acbb3b43c81b6fef16d1b8bb61
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8oQc4XDid:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDI

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432890754"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000007bc72fe9e11f91997a93142987071c72e9fa1b5d79f02bfd4f78f876861684aa000000000e8000000002000020000000cc8a044392aa3d5567672c6d4d21def845ba2be6b694639feea542f6df8da09120000000a7761dcb99a69c99c427c8aa1bab314720409648a32e4dd86314668f01a7e27f40000000057c5085987d138b3ea7d951a2a6f9712faba72a4844490f9b41fc2dcf05bf3f7b4bd263b42e444f49df02a67dab620bf91487c9d279befe02b648bdb011044b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000fe7789a7498c9684f364fc5095d7ebbd6d13e408ff10632c30f99a9065e0ff19000000000e8000000002000020000000e0a91e009f891d82ed8c4b2f45da9a5e5fab8ad6108a36842a3b51d9d50746339000000054a545bf134669d0dfb49c99f460f901e2cbe48ea18cfa2d4a136cd3d42e05b0ce156a8583684a246005ae9b8ed30db4c8ee99231ee38ee39733617553c94ec6d7cc075953d2834893416e89f9d5cfee67b05cb087bb78d3f681e99fe014b0a0d3f3dabe48b806e47431385fb97c5fbc04762c08014cbce0c6b016a720b77636e9fb12c30ed01156f7730c834c2d084e40000000e0749c21b1f314b9ababc2ac18f9e28190eb866d5728ef178c4b702aa78f98ec6bdf31cb575f7f9c7f273c28c28f5df7f214d7c8a0c8422e4c876ccf1da4939f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0bdf4e2600adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0E716E61-7654-11EF-BF50-D686196AC2C0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2380	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2380	iexplore.exe
2380	iexplore.exe
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE
3020	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 3020	2380	iexplore.exe	30
PID 2380 wrote to memory of 3020	2380	iexplore.exe	30
PID 2380 wrote to memory of 3020	2380	iexplore.exe	30
PID 2380 wrote to memory of 3020	2380	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eacc8be42e4c8bc47b6913a65a280742_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2380 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53863fb765a5c8f7d70a6fc92588ea75

SHA1
5d6b41f6c1e67c6a6ddce94aa2844b4309782e20

SHA256
338aac127a114cc05747dfd1b60fa8401da3137b5853667dbd83dbd8b7e50159

SHA512
06f2912fa933d2584153d9cec7527f9430b22884f05eefbf59a8a458d3c77bd2db6e1999a7ae45a97781b192e51c1c591c61df0cd13031e7d4e4147f48d3df26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
daea78c0ebbaf709336ae77acde83f8d

SHA1
e6f74ed8764eba95fd5c948148a00f09412a713f

SHA256
eb978602e25b8963fabe19705396ba1d1e88e3ac37e8228d90a9f12f20a70d50

SHA512
1cf17aee63035e659dc0c9e428b97260067d12ade7ebdd9a60405ccd6da7d7ff87152f42d486eb5f40677797841895b64b87bb530322cfafb80b9f0f5d2a9c68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77eb2c7f84a77a3b89b55e9ef6f042b3

SHA1
9471c02b54eba0e971f0c14e0b495de2d8b494e0

SHA256
39f3bc1f87dd2c0184d123bf7c70fbf72f1aee5b19d043960e55b8913fdc52b5

SHA512
323cd13b126e2c18cddf157c08b3e97d425ae671eed8a11be8791fba77f4faf0a2cbaba1ac985b16b506ee1bfe344369c03d6876546b3a4273b9a026ec1bdb27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38036f439ce71a47bc71420d7d94da26

SHA1
2e7a95e55b74966c4129d4b46523b2bb7c03faed

SHA256
1e7680f4f752254116409f0c9f13fffdcc32315575930f1757c37a188c1700fa

SHA512
03264eaf77dda9b838f31f6278856975714d4bb86ff08d1170ca6fe753c237ba0cba45345efe9c71a7a8656e47cef010ac7503d07b88049014a110e607e663fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
978244c598972498027ff1867515c799

SHA1
baec3946331f16c55740a1e232c7c465328c63df

SHA256
059e3f430009d2e8543c57ded1f728bbeca5c2b51abc1348b6514e84f87f8ad6

SHA512
891b07786c0643e4a1ef39c8abb6d859e0d80e49853a8a89adf4a4f41dedacb489eb935d9fd1ede2c06b514b5392ef17026e0a9859faf12f67133b68e51cc861

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17f3fac3ba6ecf93690eef4d106217e9

SHA1
b0afe63a30d226a4d34c8c3dc5af11c89a9bb23f

SHA256
e33413027bef4407ea86b7aa0f02dc8c4291ee370bf2ad6f64ba6c14fc6d1fea

SHA512
eff3ca5a137ec76c6ce682a682548d816647dbd469e9555bc4f948a333f9d76a32d689a17cb5eed8903f76134818915fc86cd517c36445f3b2dc017ef38aecfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c2080ddc244ddc1fd92dac97be321d9

SHA1
89109bd61ff1d014b30d63dda351631409dc81c2

SHA256
9e038a962a598c80ac2ce83a0c30d5bc23757cf9fab0d26100e36ab09fd8b9e2

SHA512
f4d8195cecf02b33a95a0daaf51c8a180855133867fda948728136a5f754b2ddf0c3f5b51fed4b85e6b1e439b114b13902dc3632fa24879af348cbeda5751fb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25d8380c1cb1a9276354587e806bd5b5

SHA1
f51c05e02255bfccbcfdb9a494d0bc2d702f1e2b

SHA256
87ea7bdc31600bd6f4cc87224250e8f7321b679244a43066ff6b9e1d8f849cbc

SHA512
9cf2d8fdcb06a1f91c744790f8ace2f2f904fe6dec54f2feddea4303545113baa0bbe023dcf6bf7b0145c8427469fb0d1b729a25aee1f355bb8bd229eaba968b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5223f25916aafa26af08030b39770132

SHA1
05c2cfcdd926455fb5c60d675a585aa61bc1d7f5

SHA256
20a33c96fea56a065bdbbd91ba694ae1fe9e2fed83c64a410a5007365e04ee96

SHA512
ffaa3dd00fa4566d02a77addc99f3f469b5fb72fabb46667565422fcb7ac22839b48410e528b94cc349c02fe0ff35fba74652bde98fa513536750cb937038566

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62fa5726ce1d66a0819ac6759f0f7f09

SHA1
5814af4cc27da8b7db773e2991e0bb98f1975089

SHA256
440343af4429f6c39f419ebf5da751a38cb4474922c831be6820ac0f0c93b493

SHA512
ba1c7ced141f254e741339b7e9a332f05727f975999bd5b1cd1810e60c0bddeb269090e744b3a2fef66fed71a8b5253c065d5ee7f7025dfe967f20285602874e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce18d08dc4920f98483abfcbc6f7de8f

SHA1
3ae3c2c82bcf994327fed4610a28b961e6bb41f7

SHA256
35c8fe17fb8a31ad48266db2d8af3c0613b32923b673d649bcc17b01786b8db6

SHA512
f5e3340e46672e0b7be195b112519416eef4ad69f00ee0df72c57213de9ac0dcd00acc7d68c6cc65a435b5cf0bb8e8bed81b9457f459c1818236cf4ccd46c064

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
faf773ad604ea1cf3bae07562b7bbefe

SHA1
8880ce62f119763ae1bdaf1622ed69f66b92bef9

SHA256
4f236fb0396033a439ecf7f79f02f073c13f8242446be9e3aeeef866efa7daab

SHA512
83af2320097529bf20b63e3643576ed4211cd4ed28bd212b34d1942d06a77fa69d4b24baee37f98a1fde992eb91b32431d8be200ed0ba5281f648ec2effe34d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cee3254ec87b4daa3ae1aaba39f40edc

SHA1
468234e4d2bf8f3d9b113dff903cf5006bb24b33

SHA256
dff5876c3a6687aecab4220b2a90a385d6791c307b550dfac1fbfc5897cc4d68

SHA512
1f3c30e7eac8f511abf71a0575d3395a94f84f7d19ea0924366083cfe1272b87c9aa20675082f20aeaa13c04fd0d270ed98145a5e0dc5dfac5dcc22e1ec4d2fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE64D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE66F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit