7875d68e453a2b746f967c2053978308bb029c8a072239f14d6c2efba3c8497d

Analysis

max time kernel
120s
max time network
132s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 09:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb06e3a837de2b969e31bf75e7aa667b_JaffaCakes118.html
Size

42KB
MD5

eb06e3a837de2b969e31bf75e7aa667b
SHA1

e406af84034bba787ff29c191815d5490a6965df
SHA256

7875d68e453a2b746f967c2053978308bb029c8a072239f14d6c2efba3c8497d
SHA512

a155d53b6d0f08066741b4c9265503d74f214199cdd8afe4e364f7a07973c56fe32543d276cbc0c305da8905c08adc45be1d8d753359c6ab0a5f0fe1f6a5171c
SSDEEP

384:sHg5tw2s2Vx+i2cW/qwmdptS/HkPAZKMU35jJzQItAtW3t6z5F:P5tw2s2XP2cXj5j6Iawgz5F

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c40000000002000000000010660000000100002000000051b19138752ebc13248d91c20e81c3a2ff64a257022d7b74e5bd622044891664000000000e800000000200002000000048ac71b88a9d1296c462565d84b0fb440183aacff6c8b2bb0aac1a0526e8950790000000ffcd2f039417000d51e5559b5598213e8734d18c652a461b6842ab024b93299e98e34e3189f9dd719bfe1cb1d7166da8d1eb078eb4e6903bb41dd69fe389c33e2bfe687a63e396df818297aba8b211afea688a8a31e90faa58155b6958d3d13e55215578353be58aef458541dafef7d579b7f63a1fb1568e9394fcc9defce4517aaab4d6a5adb21715329ad28997d3ce4000000034bbd2218e1b2d6ec7e48f097fe4d6ad9ace4cb59b5283baf80031c93e8888348e4e6ec4106d08018e36dd55d94f7e6c4532eecb7521885d760965f9b2494af1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6FA5E491-7668-11EF-9081-4A174794FC88} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432899507"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70432f48750adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000fe6bef3e361e98558971101a1eda98e6a38df8d96019a9f3549bb75e8df71c50000000000e800000000200002000000085fa8d3cb018a8123fadfd41d4f58feec294d26489cdaabd4cb2c164bdfac0e420000000cdab7d0b142eb8037f5474bc815c47bb144ca5f249e0412da5176071db08c82f400000000cb76abceb251d9c87346adb99dc38353132eb2404ea4815d69a0fca0c466fbecd26c18558b3a745a1d988ac521ca1d041d8f280bbfc95a0154608b85152accb	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2504	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2504	iexplore.exe
2504	iexplore.exe
2396	IEXPLORE.EXE
2396	IEXPLORE.EXE
2396	IEXPLORE.EXE
2396	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2396	2504	iexplore.exe	30
PID 2504 wrote to memory of 2396	2504	iexplore.exe	30
PID 2504 wrote to memory of 2396	2504	iexplore.exe	30
PID 2504 wrote to memory of 2396	2504	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eb06e3a837de2b969e31bf75e7aa667b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2504 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5d89b5ff39d4a1c8535b923d14c398c

SHA1
1331a401bd0ce9958adbe9bb094204a7c439547d

SHA256
25d533052ad91625d2a07b3c8f6f15589f7ae06cc4434634d65e73861f8de0de

SHA512
4857cf7177247f0ef6ad8ce4d8ef31b3f218728a8e1893ecc99f99e87cc57d613af8849a7a795fb3110a02aedad42493cf9425861cb0eac494389c9a73d5e365

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c570db7f4349d92a015a3e7a1707a76b

SHA1
f18ee2abfdf714bd83ba0f95f4fa311a15ef1838

SHA256
9cf51fe1fc43235c28a33dae7f2ffee72cc7d1845509f9bd13d33c2a11c5767a

SHA512
33dc21e685a1da98637f43e1ead1e70237c5713f95e17a6c1b98597e4d907f0d0f1b0d3cf05a613528bdc84d1c56442a24e6657c8bfc4e9f8ff0e5ffb76e8644

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a880b4d4f8feb1a46f43cc599105b57

SHA1
29cf8903e657208e7b6c5f5aa7706fc93bf8282c

SHA256
6aa391fa16086881340b038b39f288de2f9e014f8cf6569c2a15a86847b6454e

SHA512
a5ebca699212e6c40edc318def7f2c94015c39110024546a7f22b0c867edbe33a535dfff207a85072c234f69d07d427ddfee8784684ece1e81cf502fea9c371c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a983c40fb5d9b1afb1c4e90033c19645

SHA1
6877224469b9ca1631a1a0c14020e9f5b5466e73

SHA256
74c01ff4a3d7a50d319d40d7ca5e10d7ffe4a1cf463289f010ecfb3fb754c431

SHA512
faea9a935fc632182de476bb56011c6742fd2c06f6ff4778a862600b1cf54a72dbaeff5689e536bb1199ace654f608ef3937d233288ec226cd46e9bdf5c1be8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d05aafc00a58828ad8730e737ec8727c

SHA1
429578244f783ba80fc936865b8f65c303b4f8ae

SHA256
9be90de0c39355cd611aa47a4541c67452139a0b0d9db4c0c518a894a3f0046e

SHA512
84bdb2768805ce540786fa7118452173f59b26d51afc868cf817b2d2eddf10772b7880e30d663b0fc8d88b11c1d446fa4fa0b14ae933738cfc7ca7a0240ca001

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01831ee2029ffcf4a4673211c571f020

SHA1
c55ebee9cf7bb4fa2c76e6eb60098f2d8529404f

SHA256
e6f1f2ef67960c1e27f5069fec5b2d081ca01b0ecd2cbfde136f2bae9588ced6

SHA512
1af84373703853c8518e5c92f8f3c726160cbd3315383df1b3527f5b28af7ae6e8683a45179dc8b2834e81e3fd76d5cd892357cba0cb848df3d5ca8009f4e812

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
172004895538ec2535bb7d43acf016fd

SHA1
81dfa590b8274a19f4e981fe984804ef5189bd06

SHA256
52c9d1efe791b043dbb208026b5c4f0a4b88bc2b95fd94422fbc22854e3fbf39

SHA512
d6aa0d1771da5243fd32ec48b322159eb216d9725ff82bdb63b1024e7347a0c71ed3896d464218892c940bdc6ef7f9ceeda7d302ca0001912cc413d5048a2d6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2c3ad9def25205d0c59c005e91af1b3

SHA1
76256ef8700a23de7a5ccbbfaf1463e32c697709

SHA256
3d35ef898fa3daec652a31a134419eb45bb234239c88bd25631d1ea1bd671611

SHA512
f4d7d6b486cbf1470973ebb48ff4e721e4b9b0b9f4d37c0526061fd83ef21628a278a604d2f7533dfd2ec26c8220b813fda848f66b1388c96d682b03f3d3864a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2017845edbe0796d8539ed8f253a9fde

SHA1
739fb854c6dc8c0aae3e833d4d75f10c5de143bc

SHA256
4ff8d4245ee496345d2ad023bd558679962860609b0d8072bcdfe28c28d46495

SHA512
740ea624180a8063736fb35a9b469da344c2cce1cee248a9c386066c1eef073d82bfba840d89da9f9aa10dfe928958d7e87d2eda9ef5c5abb8a53098ac065f9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41b5b2b3017e16933c82040f057c11e2

SHA1
2f6c426977389afd80020a2439ca3ebe77220124

SHA256
748e72480b2d96c1b2201d84651377e892a8c107c687433e8f42f36497078a48

SHA512
a8e2897d2cde27aa6771ae2751ff26f8697826cdf5956eccfcd36237c1b0ba41bf5b6d2c3008eabc3fc938633fd454d26a3675fbe9e70d14583a3ae03e18173d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4762dbe29c763f2516ec7122c7068b6

SHA1
aa32b933552fdcc96f470ab2f89a11066c6e1bff

SHA256
8fce3fbd949cfa66972b3ccf4a4f11bae92531536813187e32b76498e5b5e0e8

SHA512
da6127c64cbe9d92fac64bde924990d4785f4ca71e58ba6f7d527d6157c372bac00a96da681a5eb64ed8cf0fc451386f4e36768dccb53bb6d87444c572b678a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAA74.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCDCC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit