2049a58d168cd361a95990dc4e4cf33628191a34dc0e37cec79dbb3afd791310

Analysis

max time kernel
122s
max time network
134s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 13:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb6a0b270c467ceb4eab4b93572444ec_JaffaCakes118.html
Size

87B
MD5

eb6a0b270c467ceb4eab4b93572444ec
SHA1

f9f85bd707feb400ce3cd7eb27c0c25d17aeafad
SHA256

2049a58d168cd361a95990dc4e4cf33628191a34dc0e37cec79dbb3afd791310
SHA512

e4ed0a948c17622191dbd2bd38a538f0714ace62304ca561bd9078ad227b32023b9f8ffec015183036d247d85252d3ad3d39bc91b20867a1b8687415a2b233a2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000c0a00eb17cf39ef32e2c3968e36007510078aef7912f6b33bed11c5748fa763c000000000e8000000002000020000000741fad4e2030d1049100031bc72612049d64320e7cddc8de09a01373f4e72b182000000012996e607fbe08bc5897cff62f026a05948eda00a8190f187ea660576c77246e40000000715f700e57966bb782f91a8fa9e981e74d2cfa1f3e8e1aeba05780f6c21e444f92d77d340cb3f1f88743aaa332367f0756619d9f95e8dfd6bf4c0a3a58780f4f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D530F7C1-7689-11EF-A1D0-5EE01BAFE073} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000779dc56738a8559b263374b8f625e79094499f509633edb5074e820fb76271ba000000000e8000000002000020000000fa849faff3e7d69956eb68f9e43a8fc32ebfea7850f11865b0f84423103c875a900000007a9778010f89f9a20ee739718f3d51def26cac30432540158926c7f397a26557055cc5694a252539dade7264e4d1d721080521d0256f183752a4482f815f09cd1b71737e65659c968fe444b166eb35640be43c1affc2cbeaae71e48a120f0a7676981f337ce9d1ac4d1aeb9a5a5197509d235b449b34a252d9e30453b0bf991b2c95f223be103cae9431a29d3facd29b400000004119fc24532b0a107576394ed46916d4e8a57cab5d923c1a9d590ff07cb29dd27f135954d5fd7ba4d24bdcd31e857c38338e8ccf83de2f02184b5d01f35eccee	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90722faa960adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432913853"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2700	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2700	iexplore.exe
2700	iexplore.exe
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE
3032	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 3032	2700	iexplore.exe	30
PID 2700 wrote to memory of 3032	2700	iexplore.exe	30
PID 2700 wrote to memory of 3032	2700	iexplore.exe	30
PID 2700 wrote to memory of 3032	2700	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eb6a0b270c467ceb4eab4b93572444ec_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2700 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51c1e88679fa5acca5ca6801b8e9ef31

SHA1
22d44e49b1a33771b6d2bb42d8844186a048e527

SHA256
e291ce8f5b31141d8a8a515ab0fb7b22c4f3cdf3f713369384ea6ef126eeeaf2

SHA512
330d3064534157394f4bacb662c92fe4ba2ac693cf13ea1307e2fdb81fc4cc6fa65f64c1b92ae40d1d83deefd0f98c3f5c74451293fc4cfc5e0110e281ac8ff9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d70348217f24e65279be9fd6c3a4ca0

SHA1
913e3f3a733742819429444f700161930cebe6d9

SHA256
b46ab3eae7098f2e41cd5eff5e9c9dfd3430611e1c0ff32339d9eb7018f90a40

SHA512
53b9399b012f350118370a7216328dd68e75f16b30eebf4f6cf87a255af4eeae49cfae63982565e7011f9afba86c827685f1c74fd6b7f98b9558f30d5d64d6ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e9c362d6fb902b4b2368803863aab1d

SHA1
e95cb8e119fe3a4f6947d0e14b80ed87498d88af

SHA256
2599d35d64dec87ba78ebd9cca6b6025434369e47db21ca0c27255fc6544cdac

SHA512
748cedc6215aee78fabb2df24bb14ca83c7828270c671cc2baf05b73cc806543197f5c9e8d68acb630938400dc9af286b9b48314edd3f196646c6f934342cf4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
076e173f49f53fe06a5a2c24312189d0

SHA1
7da19ebead0050e910e41381d18815eaf4285e55

SHA256
8841cf8335072cc335078abc012df4ad289693d22ebf0290adf1a8f79a407c58

SHA512
f3a650c4c5de4febefd2babf26190d0bcb43d257b4d862cfcb73ce5f88cf0f22ebd991c19fefb7274ffc81fbf2a8a5feb79ad292e4a09b33f0201712aa638ddf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15c334e3f55ae541df52dcb56dfd02da

SHA1
3c15f6ea488e201fb1876fbe8a25c58e9579d1a6

SHA256
230f2aa527047a9b130533afd045ef35e8e7855b676d18bb90ad0d9e628a3ae2

SHA512
7c61be0394caff211fdb7a0500c90b0ea9fff232d4b417309e7a138439a0b3f531d3d73b370178c023691495b1e97d082a05b65960b1d587ebdbf2bf63a5b53e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
030cfc405166a339bd1cbdfbe7c9d2be

SHA1
e21d1d73cd2e4587186960301e99557c95890723

SHA256
6f1f08bc2ef2aebd473ad85447ea1dcfbd21e10c0747b1b4e1fe441300b52b10

SHA512
81769eb19604402233d7b3aa89ad24b61611684acb85ffb9b91dfc84527926c26660ee108fd7bec239d995fa9f512d40b8bf40fb120a508108893a10b11dd2bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13a439f608cfee9d6f508a44c29426d4

SHA1
ce6032f3c054666dfbe7404054a458f766311585

SHA256
b3ce91b9fbba2fdeeb42e3081e1022bb153581d6de17fdd5eef3245d7958b1ed

SHA512
7aab79d56bb1534a8248beb4aae2615bbc1690d2a571dfa0590d20e923f92d928fff3a118062ddacb1c807a5a18e44be22ad72c3a27eb9979ce7a2538baa576c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c8d064966eed22ece9347843ed65f5a

SHA1
97e07440ab0b3dee57f5443af7efcaa07365fca6

SHA256
2f34dca11c732c870fb0428e0436cdc7fa82bfb4a0520f2938012415a05befa5

SHA512
cc05b5515204a706dad1b77358efb740215567655a9776b3a25c2aa07d8e8367a5b90ec9fab74966300a9934b142c3a8b753a5b43e67da8346837e9c3da4b403

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
afc717533c365fd9302b80d2557b6f3f

SHA1
a6e01c43a495e5983cfbd98b5bc475fe136e5463

SHA256
25034bb9bd27f277a1eea80a9d5939762a1a89d15cb25442870641675eb4180e

SHA512
e27281f9a6449a34766bb602e0538fd84929c271ab6d81a28e7a70527f39c48d924dfc9f50e4adfa9b6462d4b005487939d054bd896683995f4b9e319631ea8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1efcba8c139e12bc1d10f501a52f28b6

SHA1
e44447880b380d9804f53710525a4a3137277b3c

SHA256
0317f066df804ce42387997017402dcf23b53ce13f46f9ec52574d2a5a28375b

SHA512
ee26d8b1708a095e11ed76713b9b8a37cdf2d3ee8069737ababb26a15f7d2e00e6948c61d89c3fa15ca12daf3c68fb846f1b5349544f81a76f113d002e0fba54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9900482782a954991ee30115f7d3809f

SHA1
27225434f2004b5a4aa5c9e5920fee740f7d832d

SHA256
cf25c8026b1e88f62fdd1d829c3b9fffbf3f84f48f4cd14c474ef38196c69f9f

SHA512
ca9ac3c98d1a64eed331a86bb640cdc3b124aace3fa2b0507cf67d78b082df9109812cdd8e631629906232da80f7e3b2decfbefa4cb6e135c84de1b44ebbb10b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c495976ad88582d7d1f7d1e28c9b61d6

SHA1
05361d50701594494bd8b0b3a18d4d6a26a961d8

SHA256
eb7a3127f4fbe8c432f68c60a71bdd87d5abefcab7586805b33baac6a83afd51

SHA512
67d0467e7cbf2384ca69a53e84093721dddcfad2ac41de07a9c928edf3278edca3105e54df9965b8c298dfda3742b37e7e76edfee1addd178e2f64d9ec76b52d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d85d9e5d15a5eaca2d4ca847604a813f

SHA1
bf1cf51bf6dc7e0f930b035b704b9fba3b333d2d

SHA256
52f8456e8f7c327d87c084a8d643846de3bce58aa1652f5ab8090a109a23da97

SHA512
05c3b2f4229a157c4166957d779c51966c052e8382963000ae0427cb17b71d7ba12b81006fff4b5b350e31eb64bc7232997ebc038a38ff9b9829aa442ac27d0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27d9f055b2a6b85e3ac5141103490d8d

SHA1
1c39976f1ca9f002bacb17b57b66244919cc6873

SHA256
b64f8236c7ea230a4b2cee1c76e737378302285bf85a17b1de96514fbd29b8dc

SHA512
6477e1007706637e0c5c0f3f970da24748a115fe173d6bfdd2077d524f1f8265b89433b85d4335c442d84c367f62efc2fa2a955a612322bd5a01b1c7f2fed8c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
047c0ec43aaab539207a4a6e2cbc980c

SHA1
7a7dc2a62c41747acd2fcc6ae8692dcef4c42eae

SHA256
18fc0ebc05b30190035f376a304687e68822de025fe0b3c6e2a1d25341c9661f

SHA512
e48fc043a8f3157334c41be9a1bf81d5ca8f2369486f4eceee8ab1485e7077232f8d27156bee7ee346d02fd8671742dd948db55faaa86e70e2982cf979c94276

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b721bab66f55384cc1e68da6f0555b8

SHA1
809601726e327339d37e52abd9e875fe4fbae6f3

SHA256
d56a2e8ca56b241172e3186ff9c075ac2ba4d7a460b534d8e5b282c5f3b2fb6d

SHA512
33bacbeb3c84f28b9549889b9b2adb1e954d5abfd242e4456bc6061b7bcbea0914caa42e5acf0fe85c6e5c96b15cd39df58ceb9490d0582cf984ce419c676adf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c5de2415f1b91cbbcaef5a55d2233e9

SHA1
22f73dc92564d42af6c1a70c3b4be46d2987747d

SHA256
92a9beca700995854b58e12f1b1ce615c8417cb4d3e3e345df18f6637d35a443

SHA512
e1a3c1e8d1db9aa3afffbd94c2f99a2134865bec6c461724babefeb57c64393b6d63fa870a889e2f934067fd14e793dbeebfcf9a8fe0542c7d3bebc9a63f0657

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab58BD.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar59BA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit