eb0685de830e84fae9e081ff04c9d418854e8658fe15e2b604f9e9bc8e26c457

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 07:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ead2d1216ebe786b44042dd7e800dfac_JaffaCakes118.html
Size

20KB
MD5

ead2d1216ebe786b44042dd7e800dfac
SHA1

64adc9c0a079fe353c19c2291648337b503644d1
SHA256

eb0685de830e84fae9e081ff04c9d418854e8658fe15e2b604f9e9bc8e26c457
SHA512

362376a81855318bb6dfd629d9cd51445b82d7c84376bc8ca76834b272ea6a8415c153767ad33a85e9402f19728013971b5aa6cdead2c1138c427f6674286c66
SSDEEP

192:b+dCHhx17FvlrlUHdWqllOW7tgXuigB2DTWjQoVfGGLg04p4qD5BhLleYUkzPwwk:hpUNrgoBdMoFa0Y4qD575USPVOM1QBV

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f5420000000002000000000010660000000100002000000072a666d0e33ca6635c581b0d0cdf1092983d1e1ba1a8296da7e6f7cebd8684a3000000000e8000000002000020000000add64839d81bb244a2df7c2b1de4fde73dd923d6413e08630b4116af5cd9c9fe2000000096455655f95feef844ca07124db4c39d24bbd77b1a74d57037632679c91b44d84000000082ff9101eec5c3b999cb28a5623d19e598e0bb7f4976563b190d8330b0dfc7ea4542b0702e8b8ccfc93528686e7d1c390ef438782bf29b28d508db381560e7dc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{568E4C71-7656-11EF-9F10-C28ADB222BBA} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5095092b630adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000b66c2cd98fa719be54c317c91b05a85eec024ace63cab5da0ccdf9d5cd4c68fe000000000e8000000002000020000000b0689db1e0b02265890a694524525c83d5222fa00bbb1fd42a1ca9c87f203edb900000008adcd654815843d68831f26afd6426e39c95126e949d26cadbefe80d4f81b4bd42a96cb428abb41ce97f9ca2c00a673155eb1be218364bbcf39447e55662fdf689ca3fdc1bee1bfe74c4b467f9b53fa5dd180baa2fae59022bf3fd0a313a39185579743e07ee7e532bbca42fb2e8464ec0f863f7a6455063da2f2660becc68966fd091774b2d3dec4287d6b35db8491c40000000b6ad816cec650dbde4b61f4ee3f910b1242036cdfb8bec6e1686597d48ba1d90de9fb782d3896210dd147aae9ab928e78b4e0077b98b403f9263d656a2d2c0f9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432891733"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1032	iexplore.exe
1032	iexplore.exe
2052	IEXPLORE.EXE
2052	IEXPLORE.EXE
2052	IEXPLORE.EXE
2052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 2052	1032	iexplore.exe	28
PID 1032 wrote to memory of 2052	1032	iexplore.exe	28
PID 1032 wrote to memory of 2052	1032	iexplore.exe	28
PID 1032 wrote to memory of 2052	1032	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ead2d1216ebe786b44042dd7e800dfac_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1032 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6233ee7a6f10e939f100e48b13f20c1

SHA1
7c3efe87794ad91e11545cf837b7bdce9917d25c

SHA256
ce6429e80d8c0b76e15e62eb909c57d5f7eb8ca98633b95aa2f04cc3bc9ab64b

SHA512
255401a7eb7082b2cf809e973cc2bf8e911334a82d57ef8a95e9612bc4b950fa7bc6489863e198b784127b106fd309f4411f81258ce83e5b8632a4bf116b98c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f69cdcf69461312c958de795acd8d67

SHA1
ad43c99abc2708fb0056ac03b865d62c928e3f7d

SHA256
a1aff4dd16fc1dabd59002bffefb096488ec07cfdd66b7cb8401e75bc0bb1cb4

SHA512
d678d219ef83f843f008321db10b502e4125bc5c5dfcb86a79c6321be8b87a7f317f3947be579a9457ee71bed23b3367f420a64a4d1873fd8a42b92decfe5b22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8314681f0030676866214171c6d9ff4

SHA1
7a3b66d9d71b7df4c1fdadb3f0d472832e77d2ed

SHA256
1e1e98e122d256e5bef8d6006b189e11288857f0cf2095a8d8716579b6b770d3

SHA512
d27db7da75547c75158fb566966831cb526305d52e0c24f4417947db78bbe4c434971ee8d948591e1bd7bf391f2f01ef8c7db43d1eb8980318d4ae4390a450a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6058d0633e949c3f89e84a4b2154369a

SHA1
5db4da1a0ec4e1ccc7f4f19d98725085a64b7acf

SHA256
9ffd2ca59f78a5911787ee44e13f2d9d48a6c07cabe6add8b29933f45e80a5e4

SHA512
1bf43e6c826aa72efb3dd4a5b0d376405944f65b2fb64bb327d48f51f9781c607fc30c078a7361e2bc1779c50ec140acda44c50a7dced9d07893ca3ba99ddf90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b082aaef0cacfd7c56afa361d8ab373

SHA1
ea2e1f9f43726923d0fc644cb93e99590d818407

SHA256
25a02da7ed7f698e138279f7c0f97a783778a9fb426e6ea6a0d7656c9fc7dd96

SHA512
0db9ea9d07eb7beaacd23017f04f0cfc6f559748a385b313812567c977eb939f7134799bb466ef773d2e6b2ff0d9b39072905e7d629db01c9542b49ed3e8dc1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5307dedcf683b2c2880a947bbd1a4913

SHA1
319a48a5a1affae4a396163fc68177bae4eb2a3b

SHA256
db00bb312b4f2f5a8479ef1ea837f68d2d14b1778615900f90b3d2893b717afe

SHA512
0dd7845050e915e824cecbbb339f5a2f686a1a44415973102dac704fdae93e5d36e64806432ad3e0387579a121bae15cd46c685c37f5c9df1658968d034769d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3cdf810bdc49df77e518d2e0736addb

SHA1
7bbd3115ebfbd70d845937e4bdc86bb7adb5ad90

SHA256
c0fac1c29f2c9de6467d43fbccb41737181e0e1762e3cb7dbec91b455ac21708

SHA512
3103c4b6a23af7331314fb5ca5de858c1994a71b80817354b3530ffba8f2a7a01a7c799d671daa8e3c5bb9b54d1bd55a5470841d5f266e6a9cac750d1bb8aeca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc8cc0fa7c44d16774f02a8cc681375e

SHA1
8971dc6d45b3b761a5b00a82569fb54533b959ca

SHA256
cf3545585a6d3ffbc73f9f6a71a2af2de112a12b94627dc21e404a64685a7f09

SHA512
3cc18687e8514759e590b857903a2e7b0e0f7b88931f5aed9793a62a3d446f5843ecc659d6ec444df945f7796caec19c606e1725a558ae5b0f70a1a90bba91a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9764fe7a119fbb8941a100674b4d9087

SHA1
45f9a27a0690ea4037a426551c60542f9001146a

SHA256
9a1f3d41188c6ac945bc6120bbc11754db3c2003bff7094524ccb3749689bbbb

SHA512
d364c38a30e90eecfb4c34afebb6d2ca671e9d0c9537d083170c1fe881753b32a0b6e8415b331460c5b4bfb143d1e40f2fa15c5c8e975b5f57746f4199c21fe9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b218406d224d9bdd84afe9ae3895332

SHA1
11787414b0e92c82b7f605c87eacd85dcd92f846

SHA256
f0b03d9eb6c23b1e56f7392080d4fe0abe0594a35aa1901f370ce5725f2787e1

SHA512
b02425ad08b3de96e35a4565b388de8386d85283ceb7e0dc1aaacd540b5cf8735393474e1d9da4d53e6a949c82b4525a2414332abc39c52cb2ade28ecbaaa71d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5590be19ecedabdf2b15e77bb71951ef

SHA1
6e20ab5c750d137e58e2ff259d78311dedc850b1

SHA256
436dd1feadb48dbfdb5f2a6295859b74c2c4a9b88eaae2d58659071554f3df93

SHA512
cff3644f476aaa80e7b0259793e8f7f651248f423d3c6c2d158d03fd7317c3525b0c8c9265ad2afa463c7da91d58ab1462421954feb14058c62745e81da9b717

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA086.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA0F7.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit