46bb93cd9e1bda0c891d8fab1d33068076fe61dc6fcb5902f4c087c168ce057b

Analysis

max time kernel
73s
max time network
133s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 13:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb669f5baaae6b2635766a52d925637b_JaffaCakes118.html
Size

35KB
MD5

eb669f5baaae6b2635766a52d925637b
SHA1

34ba3032b930e406579b97cb8f999f535727a9c4
SHA256

46bb93cd9e1bda0c891d8fab1d33068076fe61dc6fcb5902f4c087c168ce057b
SHA512

d5f8ab23ea83a9f34cdd733cb725df4d7c31647ffcd96050111d1f1caa056d1fba2adcb151c9f0ab372913c24ee13ce65a5c7a28c23ea28796d18a5bb3dbbacb
SSDEEP

768:zwx/MDTHg688hARUZPXzE1XnXrFLxNLlDNoPqkPTHlnkM3Gr6TIZOf6sggf6lLR/:Q/zbJxNVNu0Sx/P8wK

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432913320"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000002b8085857d68499c0b4293901906b9bb0e8a6a072e350d0db80d660d4cdaa00a000000000e8000000002000020000000ba629bc48d5087b739810d669ba95d9f3d3d9f8b24cdc456081cda07956385c590000000ada90a60c18b2452fd9900e7bb6547343a3cbddf81dab6a338846f01241429292e9eed525aee7ea4e5af671073f4a8431b3864e1b5769047e2080f42f0c0f9b40913e1e585c44c68e858d8e411f1fe7e1e6a1a7c1467cf3efa6eee48db12d647d44bb74614b6a48ed6318876542ac240f4ebe0aa5235397c5899ddbfe95684a5b93ee18aba772ceed063fc4ea9d39b04400000006f8f2f03baf5b02fa971fcc1d1159bef01c9be1badbd6e40440a7b0be0fd90a90e45c1a4674025daa54412a79cb1b1356157525bf9d029747a0a7ebd60ee75c5	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9539CDF1-7688-11EF-A817-DAEE53C76889} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40818c71950adb01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000dd9622b7c9fadfb1ffb9223bcb61c6e49fd4fe2e0ee988f9fb40f38d4ca648a2000000000e8000000002000020000000341c51d663db5274752b6a64a9d4d89b0ee8dfef786307e6ec9338b39bc8984a2000000009b4e1857840287ae7f57fd58d858eef950bf8eedc8d0aba6f4ef9c71adf2071400000003537fe4b75c30dd1cdbb72c0603e4b7047fe815081e73211d456f848278daa5f5b5f27eead753b585be7e8b225e7c51d33e1159d5316c8b16ebb363615154404	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2904	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2904	iexplore.exe
2904	iexplore.exe
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2336	2904	iexplore.exe	29
PID 2904 wrote to memory of 2336	2904	iexplore.exe	29
PID 2904 wrote to memory of 2336	2904	iexplore.exe	29
PID 2904 wrote to memory of 2336	2904	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eb669f5baaae6b2635766a52d925637b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2904 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
163cf84a0140cec6373bab0b3930092a

SHA1
cd38e51137429a81a9bad1d0a4cca8f79705643b

SHA256
2b3b6b3620036c754c599862aee8fd6f6bb3700fc8bf24e4b5abd415d65b3b00

SHA512
abae6302619043e334fc891304a7beb42720c9c348de16627696d2e8b84c608677a65446c29abe3bf8f086caec4d2d7f73eefa592926392dc3fc10a454784214

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
491cf4483eb840fa64313030f00ae4cc

SHA1
88e4620992ed67f3be9d205a0a60fdd3ffefb42b

SHA256
34af83068723d55cdab47bc47edfbce81a173025833fd0a1cc428f75b0236241

SHA512
8096f62168b19eb1f7da3beb736033767a353d86f068c7d35d2caf7b161804fdbffb56871d404b4dc629ce941227b2cdb3db3bfe9bead5d86759aad0d00f31e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
540317d8deab0e3e3ed823421427d9ee

SHA1
ad565bd31f3af400cdf86cf0bebec46e46a617f1

SHA256
880e216cdbd3de240d11aacaf93d157b81a1a351726b5b4d6462bdb5617f28fb

SHA512
852edaa343f93cfb3bdbd70210f047c78d90844137b9f8a01508952c5389f5166fd42f58ab1a0d35f6a1def764241f9c0b746140e7d3682cbdf833fc6ab58ff7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
565e4fe38a1aedb831e658e5e42aaeda

SHA1
18c385bb3293365bef90bb44431eed4357b3b71a

SHA256
4625567fc35ef1935646c6ae38726647f729ccdd3430b278c40025f62af3292b

SHA512
6871c4c57d3eab1806d078160fe4604285f91b838eed07b953f3a8ca5183135ec592d0be2b380ca19d4aa302e81833fd13482f6d4d9968b2907c9d99a37f8d62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e84207fa824e889c6ef02138da8f3c2

SHA1
d5a394b8ce025bbef3aca02b3aae51ab04cb1340

SHA256
902b6c02e6d212f5a62770658892ed588ae263f47bf54876fc2581e20676508b

SHA512
c91cb87bfea4b17104e17317efc617d75a6cda1b81c25e61a1c99dae22cf0d74332d3b4ca0e845bdf8b69261a5aa2ce4696ed4a9a81d96863793c93bcea85e25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db1b07c674a1c1d7008a0957cfb50bd0

SHA1
5216f22de3b90f241fbea2846f477034cbba4611

SHA256
78ccbdb08e5890d37a3806cf875d9f31edf3440482722532d28999bfd31cc1a1

SHA512
7baac5169a37bdafd1529ab57fc9c39992690a809f7ceab02ab2f4f8aeffd94a4e5a72ae5272d92b2ad2d6b5d507221fcfedcb927f54df65bfcc2bf9b7a161ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
887fee002dd9ddd4bb27e44fc5ac6ac2

SHA1
3b89da15c069b6c93758948d2d4dfeffb26c8a19

SHA256
c8c4f9a216465123ae56ff96a737e9ffc5fa744c2aedc8b9902d54fd972b55a2

SHA512
f5ff2923e827bfabbbe5f5c9012548dec2aa47b210359730d4d61bdee1b2f7f0f09f6d8733747960d3ef4a828c03d764695033deb6ea22659598e0cda239140f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78e225f27d35869cf54ed58f2230d5fb

SHA1
1aa99f700e5f20c4c7a7d041f2179b8e989730b6

SHA256
03ee208eb60076a22d3ed50374ab17f58679223eb8146c171b04f7f7b09e0a02

SHA512
18689103d0e999fe3544eecdffca265d74ac68b920c7128fd6fb507dd9fc60b2df864cfd62428e96f88cd947be368eb1819ca3403204622e2c2d636a4c1c03b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13715c516c67280fda45a2b47bdfa817

SHA1
15867cc8a76b0904873c26c4d1fae8e14bdd7e7a

SHA256
01ee7658ba8245a4fc3126b16fcf193d478a05877602b193bc9b053e7da02400

SHA512
d04fbfadc97ae934b6ee05a0aa0d9958c96ea9a741644320280cbfef94dc6b5d255cbb2c07e46ff64865b6d32d26d2511ce7251513af68bd2d45efc2e3db2966

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ceb84996d4faf517ab5ecee8322fa8fa

SHA1
0899b129a8b28dbb9d8846e8f1fa1b60e4aa2ffc

SHA256
70b8cd6fca8dac026afa104be1e70f82eba809045f7ebe523f540a5c6baf9955

SHA512
638ab4740f5f3620dc8c7e07f73ed0822b17c71e9d7bb9f9ff2447a68b7b304ee89935e50dfb539fcbe2d68723a67edbff14a8f970c3e5b3f69f112330e5c16f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d16be8cb8b0dbdef433c1e112e23d33b

SHA1
a64bfdbbe4acc53e79319008c4ae05bec0ec0d3f

SHA256
62be77fca1a0cd47438c718eed47ffcddda59eece39d5d1837accb559ee142c6

SHA512
cd6de253039c3f9390f79cd933fde2ceb1964f970d5e59962a25b03d09b08369e8e778d2fc085381d1807b156d5672ffed5cf299aa04662a393c2e0e7235b046

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
500691f51564b58f6ea76ca400731731

SHA1
5aa1c9317f124467aa73a77869024a3bc7e1dc92

SHA256
36420e179f863982921be5d6809dd53d5a172abdaf5e342cbc70d2f7102122e5

SHA512
f0aa14098d0c965fc8f2337e3c466febace6b390a5365cd23496c30b28ca52b74011524d3f4415248c44cb598e1d03dd723adfddde20141d2cd6e9672cb2cc38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WHDSWW5V\e93d7024558d2ee595265c43dc1084df[1].htm

Filesize
162B

MD5
4f8e702cc244ec5d4de32740c0ecbd97

SHA1
3adb1f02d5b6054de0046e367c1d687b6cdf7aff

SHA256
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

SHA512
21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9869.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar98BC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit