6b0da0eb048e2aba36c2d1c9ebd938f7574ee672596a80e1729fce3a34571178

Analysis

max time kernel
66s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 18:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ebf146a1f5cb3691ca9c10eceacf2347_JaffaCakes118.html
Size

4KB
MD5

ebf146a1f5cb3691ca9c10eceacf2347
SHA1

1cb6f321ea527966da72617e2c5b062e72387b48
SHA256

6b0da0eb048e2aba36c2d1c9ebd938f7574ee672596a80e1729fce3a34571178
SHA512

64eee8dbcc15e8e458f21fb58a1ca48a9eb756a148834fe263b11d9bad50408031b3c127edff087423d9763dd36ba24113a49e44467c9ce4ee520cd9f9f9f779
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8o1HQd:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDJ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FA04AD01-76B4-11EF-A817-DAEE53C76889} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000000decfb544bb75c5ac07efe5c71dc871d758038233c2ba0f50d33f299f49cff1d000000000e8000000002000020000000263c916b69f93eddec5284d53096c945a1dcc194602ec4976d90715bfc787a9e20000000c5a44489b32cad6b3d44cf03a49303c9ba3e95c5103988cfbc502aa5ff1ae46a40000000552a60add99dc9425d566dba2dbcfb406aaabe8723f0a74e75b5290b97836fc9b1110df855196d707d48421955f48651ea6fb2f252e927fdafae3ab87e4a42ab	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 601770cec10adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432932380"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000a0e62f38594acbf0b27262b7515cd20f7d34c9278bca507c24617e54824e6f1c000000000e80000000020000200000004bbee7b1207b1915628a43d8b7c782e5a6fd3496ffd6b69138540621e886ab6990000000a54234aa5337e87bc81774ef5bf3a374ca4de1aaf0b8b3f60d1550413c8dce410f61e9fa0489e8957747b06ed6787bddd9fc9ed8b97f2185c5fc38026db6760f156259c8f33c28f03b613de4d1c8c119cb5ed3c1342336251fb719c92700f78b289221f1a68fbb25c0442a74280a919f8c1d4d39dbd722de5770a35d1cd3f6b0ae06eeb52e3c865fa1b2379261845f5540000000225ce99169f3b3810f1f4a0f00a4e3fe7aed13c5d845a126b81cfe8c5a41c32bb8c4436f9fa93c77459e4af1dd1614da06ab0e35e48607e9a99a01b879458164	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2972	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2972	iexplore.exe
2972	iexplore.exe
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2340	2972	iexplore.exe	29
PID 2972 wrote to memory of 2340	2972	iexplore.exe	29
PID 2972 wrote to memory of 2340	2972	iexplore.exe	29
PID 2972 wrote to memory of 2340	2972	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ebf146a1f5cb3691ca9c10eceacf2347_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97016ef95756b358aabfde052ff3eacf

SHA1
c0ce9cf5a9033ff2433dba882a995054ced74d5c

SHA256
a9173b4f56d194b2387d4aa49ed454ba2ee90779b77cee76dbe7fb14049428e1

SHA512
be86ef94b180ff4c557ef242d9c9982ffbc25043131e06295bdd5f55e0bd6e01cfad9739cb33e6f43efc4f328d9c5496c0c0f89bce135b55b8ac2c22ebec30ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92a986de2fd57ab152b47ec42598b356

SHA1
255e5a435da778148a316c8ed91cbda301a0a787

SHA256
df3446606dbe83dc8086ff42c4ba459d2e6a4bb24a7fda6a5e7d4cd1972aa416

SHA512
ec18ecb6a69bee344854254b5c7db5964d6120eb7c2d7852250cf1d568826ffb1e95745df18c2a22e8a263350f1d1f4a397972fdaffa271506805f0bb20f05d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ca0a6d4f91289aab09a393d67fbd39d

SHA1
208bf1ef7f585133ca12f7b86f597503fe583712

SHA256
def4983c0efd842d8ba617994915480d2475d70351a0db3be2f1729d64e9bd9d

SHA512
c69c5609aa333e5ddd91fb57f7e1b324d907e077a4f8aeb4bba9068689197f72e57514b6063a3453fcb678bb73c8b3a3f319daee24792829cd10b54fde42db48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b99b61c46670933a7fe47627f186ae83

SHA1
6f886c8dcd16358f8b538b737d597062c7cf32b4

SHA256
e8f856d1e157b14bca1fef18a3c3854516dc767fcd82a54429c115fb46213996

SHA512
9328538d50bcf443a528241d73f0e79b02a0ad774b751ba8265f61ce7460f7b761f291e0df4df08e0cd9b1115c75e5efb4af28275787d014146c1563de074390

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a43244ee8b830451f9abfa044ca32958

SHA1
6f2d0079c48649f52bf5347051f957f6fc780c40

SHA256
7deeaa6e8dc38871c4bfdbe0e79031ef2e5d9b487fbfa1b327587278207b00f1

SHA512
66f247072d34f7c91dcdde563963e89182bce1d11b97a2ae6c5a32adcbf32d7fc71541bdeb89d2fcf18fd23fb08714807d797c933e4998a3ff50f9f4dbe5c0e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36e0082685cd4699e6e8edcd697f131b

SHA1
af25816217a92090420119ef721dbc8df3760c3c

SHA256
44c6739b6f563da3835f28b68aa268924fe06d4b0c7ca7e1e0f0aaf5a3822b87

SHA512
270d90d7c48eb8d0a91f9355e692cb7058f75e2b8bbccdeeb3051e9e5091a997882c02cff5da22c9800c66a7d223ff2a99a6a3d9479fafdb579fd3910dceef32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b396d5b2eb99ed7607c9642366ddec9

SHA1
e1012b1872ba372ed78ed94114f0d3c5ca698b1f

SHA256
6132fe37925e0cb0c7996ed7f1aa5308ac7f47a8bb61edacb51e380371c6003c

SHA512
1b5cda9b0ab86859aba109fe537ce6256e93f7c33a96e0183ee1eb8ef4cbb635c891dbae5f55ab1c0baef496211123a39f92d90cd259e099e8884b08bb5cc31f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8bcb4ee8f9101e0cd8f653a948622a9b

SHA1
ad763bf71de39fb27e438789ffb01922f966c55e

SHA256
13c6bc3286d66558cf6c0f4f1a79065ea373c52bf27e49b9ea70d998c6a8ab04

SHA512
d903eae0e0e956b6a0f9f35b0b6a2a7b0a9b947e843c4658c865988740323bfbeedc2900c50196dfa9d2bbb55178b2ef22df9496f539d8e7796e43dfa8f20312

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3fb6b9fd348e11af2a28f8bc7179f60

SHA1
3201dfcae5738d14eea9ed693a4bd7103fdca491

SHA256
4b4ca136f59cf1dce390e6d7c78c93d3a47aa530baf0d7343ffb7aaf377082dc

SHA512
02850957a2541480bb4e25e6ea4fcb3dd6668f728e73c422f341f4dd65e1f9692caa63b8327342b8e5f3f1872db84fe109734b2b31f660ea83caf912efcabc3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf978c01fd72f2dfbddfa63354922285

SHA1
9ed40240b3ec2eb80fe9b98d4ed18f73c1c7dbf1

SHA256
11ef61d54637e539e505ee7a059945d425d7682aeb7d64d6a45cce3d4a6ba77d

SHA512
a65f16f9c85383a6558be8e20ad874a5b91ae9fa7c58c0c07a60b2a271c0d48b18164790f84549bf74afbe03888b9110db91972ecdb42fdbe15b72a330563d92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0d10cc4abe9a5e2f4524150bb5768eb

SHA1
534732f2ab42432c62ac17557f7b2b1b5c37d5ba

SHA256
6072917f3e078894f47e9b5bccfa3f558c42dcc4662820cdee318c7a2abe3512

SHA512
99ef50e2330c3b05b83db8e9944fc5045b0b3f3f3a9938531c04ead56e530951e54e6f71995a1f4d286ef3e43711d873f70c5dc30ea581ac8852fa896289e452

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02400b044192d8fbf1bccda62a0379e7

SHA1
2d87cd55e99492848412df171473f019c8f371c9

SHA256
77036649dd33bab7cc505cb9e3abb0d8bed032f5f9222a11a00ba1ec479527e5

SHA512
cd9f71e4051dd347ffce9b1a21f55d2589d5432cb0ac59797d7095c711964698ae29d18d2bef08cca707a4061f3fc7b40beb01d391c1bebb1965b508e4a3e3b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
779d065484427ff141422171b9616fe4

SHA1
7dafd9e726988ed973632b9ba315f2c00d7137f5

SHA256
678ce8dcbe09f0cf96acf782712f5bfe028fcfe8307cdd3e5d46a277c37ac29d

SHA512
c9b4094043f946c7bfab809a3440087c9f49476b0e036177de9743e0e5fbf5d7880918f73f05b9a303a7a9b79b538c36281abe8d23feacf193f6e8789e2432a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
440ac7fde27952ef8e60a01f4da92f21

SHA1
b91f90a65597e9e568184aa99a91290d76ba2296

SHA256
d501d06f1a9867a80257d17e8a7d29525f96b05484958cbfded6e7d65a0d3fbf

SHA512
81fe8592ebba14fb729a46717132582a707d7d88bb82e0989208d4a482a815a6436e67ce4fa03583905d3ad5904e791d0bc4efc080b5df9420a41c8c0405b2d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aef5ec54f950bb6874987286af3857d6

SHA1
1b154995b3b458b67e3f3ac54242cdae37e32e0e

SHA256
e7ffccd8ac96894b317618d8f3b27295a446be13f3a56982cd8a791d9b9c0417

SHA512
ce421cb5d4aff042e88231284e2eb173d05ca7a969af3090610a36b301764315e0d4d8d632c1116becfcf7f3a8daf00a2641f254c21686a1449ca0cc5b5402e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB010.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB023.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit