2740d7a7da698dc0f5e0dcacbf3b9d0040deccc690436377ef6c6783504641d7

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 18:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ebf364c8cb7d4732cd04a72da232bce2_JaffaCakes118.html
Size

15KB
MD5

ebf364c8cb7d4732cd04a72da232bce2
SHA1

eb0b5332443d774b3bb17268b56acdde1ad7fd50
SHA256

2740d7a7da698dc0f5e0dcacbf3b9d0040deccc690436377ef6c6783504641d7
SHA512

4539585a8c17172b1e9053e4c784be81400f9433d1d4bb7710be595a948f37157fe7c698f8c2762f3193068e9f6d7b6edc1aec6afb316214b786a6eb5140db9a
SSDEEP

192:Kd9FKa12av0W4swDjnNh30Qw4sbRrLoVXL8hIT+SG0kr/MX//1tDAxdl:Kd9FKa8pDjnNQb1LoV7nySGnc/PADl

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000782a13723c6c2224d4bd392ce78f7b8abf3057537c382cc00cc0eea21ddfcd55000000000e80000000020000200000000bfa3e238c6e3a2047a32754c67781f2cd396b71b15d42553be3098644e17d4720000000cee23a1396c5c597c5ceaca1c621839fa6400a732dff617d1a9f55dade8ebf9540000000333d26102080fb46934f76d23f28e94b014a1548ae6bfda3531fbf1e423a38ca797946403382303b8d682215c6432377922a0cf412e6c702ae0802fe28ece6ba	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70c64b7ec20adb01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A48D4AC1-76B5-11EF-B44F-526249468C57} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f035510000000002000000000010660000000100002000000083c636e637e1d20ab8d4536647e70e473b99a19adadcad683aefd9c5d2ed4b30000000000e8000000002000020000000b5938288549996eabdf62438e75bbd8d6cc5ddecb458dc42d81d48067849e1cd90000000b5e80369c22ae9680eed5363e249a6a429f3d636e9abdbbec7afd3154230078cc301d0f830c325330d6ce957bcd64a1d7aaa07aec5ce8ab0837953c88a5729ca8a69ad70d28d105deb3b539ec6b5259b5d88a4a73503e18783b4f2bf12910670edd5cf4c36f41e3a4271c322f3e1d07cce3134f015b22cf6e5bc141607e1f5a77ab03eb5b3edd19a9f8b712756b721da400000004f169180f746484c1e795ec4b54d498dbd92fe4a792790c16a7ea9105e883b9b052f3e090f84ef4fb6ab06c03043542f7749baee8f7dabbadc71d11f2c0beedc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432932667"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2520	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2520	iexplore.exe
2520	iexplore.exe
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2556	2520	iexplore.exe	30
PID 2520 wrote to memory of 2556	2520	iexplore.exe	30
PID 2520 wrote to memory of 2556	2520	iexplore.exe	30
PID 2520 wrote to memory of 2556	2520	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ebf364c8cb7d4732cd04a72da232bce2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2520 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e89cda6a9225fc2c7c00fac729d4f430

SHA1
e0f252553ac458141e4d738265e50265d62ee852

SHA256
1fdf77e4f1f552fafeaa67e6dac594840ebd506ca3fc9c42e789887fa3c77823

SHA512
27e25078b88d1d1a40b948895a4ff5045979479feaa185320f9e75efef20ed1e67776b7f12b563d57be8a21ee7973e99f29c959823813791ea50c28a66c923e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
325f284f0fb1ea5d535559bf88b91496

SHA1
00c54c75ebbd9da5482f5620eea3b20cb5859864

SHA256
b356790fa26fd4e25f50fe84f0b582919422bc09b2a2ea9689abca9c7047cf6f

SHA512
7517b9af8ec2e4769dcfaf6ceecf13ba41e2fde6da1e43e72d325be4a6ea4672cf13a10097ecc8046d537ced04a203781c99f5fbd513aba4a673408c9b6a149f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a40bd126ecf2289447841e39291e83b5

SHA1
672b7e0a8ff15fc94ab9a57ef21307c5c9ff0baa

SHA256
c06c8eb8e026b94060c8863481d64baa7bd27eb6a8f77bd758d2cb8765d3163d

SHA512
317ccee99c9756225aec767c0147bd05474df196efc60dd8ad1f46e3f50f698f0a154f37abbe932965fc1747da8637a91813c03823e269fe063ef71318e7e035

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb303d7cea0522029bb0ca08ae1e80db

SHA1
ae577cded4054430d892db4ada855d56ec90b0eb

SHA256
5784c3cc8eb3a67bb6660285db0f19b8b680e161e25ddab9c7e7d4f8bc57c794

SHA512
a29072c5e9563546d3c47ea72d1cf0dc56ac0a053657a0aa2c3ec96d68b1728cd4012a3ab5531cb2f805f3216fe70269d8c6f01b36093df1b83a420d39993d66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3dde77b67399236d9505e7056f6ce9ac

SHA1
88d085708cb1b1406bd94160f99e3a4b35f72fa0

SHA256
11835fa103e88d9b544c0287137532073159e324e3f8d4f4fe0fcd6ef2eb9c29

SHA512
fd6f0d70024c0846152e6dab51c45b52546466238530ee896db54de04f2939bf63caccf79df617f0e53524d2fcdb27eb82a6afe1ef9c2562736798bb61a47197

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41b314134015402eeb24a0e0094e10c4

SHA1
f72e9120382b49d68aab03142476de430aecf8db

SHA256
b168e48543215f6e714eefd2f9e1de8907d5719ad4188e061ca5463444c5ce05

SHA512
8f00badd428c4167b690a9fb9f00b55b473e5828b7f3eeae9ff7d6f186c0fcc2c70ecb30d52aa712d968f32c40e1ab5b4074f3aed14d04e6fbdb509a646f88d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e4c4304c08bb5fa3a6f7d2f463600b9

SHA1
d78c59aaac4ab21b61b2d0c92002234c6d3b33f3

SHA256
f7cbf6420f97475ed1162831c57343caa483df99ecbfb77e61bac820664a9def

SHA512
ed90520040a1910a7097fd6aa9aa677aedc9441688b2627215f09c95101946b791a10165d7a81df08510f027519d3384f6f3cfe9c0b7ea5bab16a4f8d6920709

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19ce7917e8b1178338572db86f1fd816

SHA1
e63328ddb830a5bf15b7d9ed904279a9909a9d1f

SHA256
50cda73f791ef6703603c701d89e9fafd058b2f9ab86d7265aec4739d968167f

SHA512
41ab5a7c1d25cff494fc5a9c0bae20ae44626bb9d9e39f8b4bbccbadbc890d698c6bf9ac2195e98f7b883a10d9117002691beba64b02c2103552db5af8b27e80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
096875d984d0c7d3de95f1834e476bde

SHA1
06fdde6940cb70bbfd78734f43d6ea7df9190fd0

SHA256
0e3a3f648ab863ac2ce285d6dfed183b17a8e45f72a06b67ba1eeb4bd206ac09

SHA512
13cc2e87a7641309751bc8f88606c7c9976476d5bc779fe1405ce9b17161a5f639cb5261625f23bfcec3e9e037feb9e95f0f1064b86a23d0fa208a0c2dfce817

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ea8e94ce75edac92287ccfdd6db7f24

SHA1
00691f33622ff1de970881983d553799ebe1cfae

SHA256
66b4ba9a7d4dddfc10a5f996bfb642952569da5f7dd55d311d6118d4c174fb87

SHA512
4983cd3fee02d6818ba571f5200c4e8494aecfc782ec610edef4958f64d277c2754d415d72df5bf81634f877345057836f3a55a08fa6a733c33642009e3b89bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2f9b7ddbf89b9b50807cb71ce065749

SHA1
34156e0777c5f69afc76cb69de2920bd65ba05e3

SHA256
a74433d8e44852724d978ad125a983458d3588f11cf6e03c3096be1b5b827d9c

SHA512
8e726c41f121e3062a1e6ac61dfc5232b2f94677e5c729799d81b3b606eca9106155f28b9ba7deda3e66b9660252bfe0f1ec9cd1ab452fb4058186946cc496a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
530010a28171c7383307b7b5852d1397

SHA1
2c5810673f27cc6e7ad41f3c954f543bcafa0f59

SHA256
3246a8421340952b354af51428440cfae2e9b4056f5961594588882d0306cc76

SHA512
c69e41b4ec30e0a7687cd2ff90c01846f5b43933e69aca30d31bc653aadcdfd8511a434f1f1cc1b7f2b5df06680a3551dd8ac768f2596dfd310e482daa70fad3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f5b4a49c632e25b7331bbfad9179b88

SHA1
76484025067a037241a5a3c5ced432aec4f413b3

SHA256
cb163a1363e83f635617b0676e1291ef0e0f10271023b1102620804a680e659c

SHA512
fb7f31424f3547e4ad839f4a8a9485d0d2a246e587c2a1a5ca73a1f9eab5f38059f4e8d55c1b77935993f005da3ede1aa0b90be51927fa752388e27bf495d294

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20296c4e42bff26daadd527824ddafd8

SHA1
7740a44d2c5d5f717c97d1b7bea76c1f2774dd40

SHA256
920f4294c7c12ce46936f821f324b57291b7bf1a2d27f7ae121084013701e1c8

SHA512
1c39eea6d74a74e7ec022859ef48d9e6fb216b275c8d247101a37d44732e78623e31acfae389ef11f668adf72a0dff05dca6ddb4960c923398f4ddec1d5b0de0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e831cd527142d1b882364faa0d1f7984

SHA1
e2145137135543eebbf592a7100609102143771e

SHA256
32ba5bb55f89f565edcd05a84ae867f7c173f2498bb8c5488ae05845798348fd

SHA512
359d7069ea44c1e5275c567a0c77bc8c2bfbd050036cc008c57b509c7ad422818e67fecded7e8c729ef6e447489c43516ae7fcaf0fb940c93ae0827789e48857

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB9A2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBA50.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit