f64e17e9aea4e171c60c2b78b6f66093f736cf2802308ee60808c6bbea22e0e4

Analysis

max time kernel
142s
max time network
143s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 18:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ebed004df1faa8fc31eb9a3e4a70314d_JaffaCakes118.html
Size

68KB
MD5

ebed004df1faa8fc31eb9a3e4a70314d
SHA1

b470cebefd34f27ff71a2879d06bfcb694cef810
SHA256

f64e17e9aea4e171c60c2b78b6f66093f736cf2802308ee60808c6bbea22e0e4
SHA512

c48091eb42719de5072f7b66567471c6b258942fcbaaefc07488b4c02804407e48f2d001e95969bd2190bf2ab3b62de8d09d03275e1067a9edb21a34d9cbb41a
SSDEEP

768:JilTgcMiR3sI2PDDnX0g6UekehlTNoTyv1wCZkoTyMdtbBnfBgN8/lboi2hcpQFf:J48uhhlTqTcNen0tbrga94hcuNnQC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9337BD71-76B3-11EF-A073-FA59FB4FA467} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc50000000000200000000001066000000010000200000002c71516ac7847f3408ff28527d641d3b6e65b2dbe33584ecbe1f3ba1cc218dad000000000e8000000002000020000000d01e4f5c38bd5d8585b6c55ce2fefbfe43eec0f8a55281108b5ec1943a430e22900000008dc7cda43091707df1b89b0336f3a0ee4c6c0847c895c977b5ff907b721c3b9a0ca175ab111102817a605c6497a6a227749998979ac5ea4268614ccf181dfd30e602d014e05f1e9c7ea77d788b5039971c139caa2fc3974cedfd32fe1fe3f976ebf0683291d86ef854648de0d58d8d81d9ebc66110d1381e7ba8b23a5f5b942685ddaa0f57b6ed4921fc8e33d2554e484000000021ddcf3a3c39aef946f047f6ee1d0af5f0b313a6d5fc6abb7cd57020a3a09f304c97cdb33487b1b91c4c303ca382e28b32fb6eb501cb915e1aba3d969e22167c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432931784"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10496d69c00adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000a5bee14b7c34ddef4ef3f144c5da42953f5e2ae4da8255723065165f51db470f000000000e800000000200002000000017f5895aea2de044cb02d4e18b8f727ed62f8d9925b68009bb858977fec76d9320000000958d59350ab45f6d66d2472b878e4bae1aa7bbde83ea2cb97ede7019167a3fb240000000e3b6eb3ac8abbc587c64c6dd06d449a20a3382fc9885e277db1eac39cc1fb2a50c98992b323faaf4b3642b899ca266adf1c44361a8a9aa670365e7c6f1d1ad61	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3052	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3052	iexplore.exe
3052	iexplore.exe
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2228	3052	iexplore.exe	30
PID 3052 wrote to memory of 2228	3052	iexplore.exe	30
PID 3052 wrote to memory of 2228	3052	iexplore.exe	30
PID 3052 wrote to memory of 2228	3052	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ebed004df1faa8fc31eb9a3e4a70314d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3052 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9cc3a46c76b6aea281012637d86f4f24

SHA1
baafa4c548bd17225e8635bd42f5152f0dd3b3aa

SHA256
36f9cc33020d27fcb12b84ca623e457c4bed6b9ed256cdb43b5404535c135eb5

SHA512
9bb81c55014ead0854fa50a4acf55ba05f64b891a784775e4f94ec53271f0781c74ad6992391e20ec999aea505094e0857091f35646fae1282e5d7023d894876

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df1b45ca2a0027c0e4b99c9ce5ff6047

SHA1
95aa937b0dbb92ebe0e2ab54aacc24cb6a34a5a6

SHA256
57f0fe224987f61820f8526c8fd0a5bb84e61bd417f67f1c0b01d6e38bd5fb47

SHA512
c42adeef3123f981206f310e974d40704303a7de9af3a055043fb777db42e445c728eef9cc44f45096839d88455b189e52f27033e1437a50b8d8889c9ad43c21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40049d006ab70d38666cb8fda03d0f42

SHA1
db141b33ce86f9bd1eb29a22fc7542723b0a3a4f

SHA256
b006b07e86dc91ef2132a2a86514639c20d7290233daea31c85fad865265f28a

SHA512
de19eb273d583a64cb7233f86b2a8fdaeecf8722954c150cf8f40f19f8c42e008adf401ac56f314b28558dc0ebe0ef37e3d747060b4314e10b809fc9102ccb72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5f9c5d1b67d3f1ead79cf89abb7488a

SHA1
747dec1f48098ececee1f665b10e91f7428d25e8

SHA256
0dab971fbc017eae2f15ba6360046c0ab6f877eb50b975685c9194022d12279b

SHA512
0ba0eb1ec9cd9cfc86058e8ee99a2bc185a52b819a418260cfd6f620f087a0168d678af2e81ed1780abb508694bd03472747ca5ebcfd01cf306d162749f8dd7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
106f79c58cc643789d098d4bb8f124e7

SHA1
0ff1674ff945e65abd87595ed5dfd4a431318955

SHA256
2e69082e1a1831aff53f12dba8e8b0f1cc0d1eb3f78a1c74acb2dbfe4ffb5db8

SHA512
0cb63c6c23df587e4460df3462860c8bac009fb00c3942365ceee5a8b217ea325d969a78fe63146094cebce737b27a6f04775ce853cd8f9e0fc87b3d4ab22d8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af516ab5d35235dcae21409dc9943d9b

SHA1
efdedcb4f0e85c790bb84df9b9d2616e5185d77b

SHA256
ce47a3875e140f47c6fc8eef0c965897557261a31a0740bea6d2b71f8217ffee

SHA512
4fe8ad1b6b110b193fe4dc73fd75319b3ff7cd9682ca70111edcb5ef2e3a2a62a29f51a815f4033268d2e5bbc153a1f2dca1af5dda6f13ee188ee0d601b2e231

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79a5db4cbc11f590012b97d4bab2be10

SHA1
0ecd793ffaa6dfae41f030f0c991ae675cec7f10

SHA256
4d75bcc350296d1c530686f767dfd90041e9a4d5e01ed33d0c7aae05cceb22b0

SHA512
5ff5a6512d398407a4d7f98c2ea7566a0d5e20ac7f7b45cf9ac1bccac26446c163c78c6d030e8383d95eaa3c8e761ece5289e46b75e2fe9701425f5a87dc4f67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e2e0956f6f018464edd13552085ded4

SHA1
a629b9a773fd4d301409973fbca5c5f32921b049

SHA256
0604f496eed916c5be4706dd0cd0aae581eb18fab791806865cfb56bcae6b8b9

SHA512
42072b9bafe2f09031b3d37398506053f0ed17e4b22cd15884ca9c08e4436ffef49dc902de91e25cc2837248f4df90614b9aa82ad4cc1f2ef9f05482a5cffea3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dba6d6dd40985dde90e919ebfbf59034

SHA1
ae30d8918b712d2aac1f4d034144f55dad4ef376

SHA256
33f04c5fbd6dd6fb0ce2c499c3915f38a4fc169f2d2b457bb9ad80c667e60f61

SHA512
e137c75e6c6ef2afac70c826f7a3ae2cd35a4f94c3bf84697e1e8e5d3a428eca1ecb344d4743112e6ad286d9453f0f723045723fb7de329095f47af4d7d5b732

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cdf00a9f6669ba326d0f068ac4bcfd03

SHA1
c810ba497cb241b37132b7fb35f6b09570c99feb

SHA256
b0f2ce2b22b3eece3f961a75dd1b802d20d76a5813fde670a9c5579e9e6e11a7

SHA512
8c9ca3d2e9c7ef79334bf24419111b78bff3309f0e2b7e8b24aa07df949192f245187084911fe7b1e6388371e69cbd10fe9e61fa4ba047058d6517c781db5dda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
071c55ad90d757eb3375f2f597c87d3a

SHA1
d415f4a77ac5cf5b578ef96a7f6f8ec0407c5095

SHA256
273e2f3e570a40983bb26efaaeb822ea5d0152390683bce5abf33fdf302310a1

SHA512
16a04bbb846534a6e171a03c302686aa7a393cf7406fb2896a5590edcbc06d12c1b98889f7f0bd6abe2b5590c8d817eb8d30bd04854f8c6e6a6981b4f1ae5b17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3636f16b588ecaaf2e95200488fdc39

SHA1
cae507b19f0c885cd48821d601a705a1a0127347

SHA256
bdf650ec1af3ba7b8448f229dee0e4685d96d354ab60c610f08fc9a6f93a7245

SHA512
6888c2740dcdd41c1c0e01067842369aa7a5e18acdf068828560ba3288be7cc06bb8120c8ccdf756e3f160369baf21e95262a43c5a6c8d368f4268c0158d3445

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1cc016479b2eb5d2c5e21716cca17ac

SHA1
2bff077cd084228d2be17209c1c614ed71225d6d

SHA256
f3208b3d4de3cfef49b65b9f45e10870cc992fc5580a96e76af76e9a4cb5dc5e

SHA512
3edb2dfc0edd676f6742437798417e503e5201568b537e07e521ce1a2f308101aeecd8ccd4ad2395ebdae8ecb813710adf06da46c964c07f40b924581e5ee64e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a75eb177474ea2f19a1a9a72772acf3d

SHA1
c37aec1cf58c63571f75213d9499bfdf418c2375

SHA256
d8e49820ad4b7a3e0dac296af09da2cdcad0963782268091624f629b7b615a3f

SHA512
01e35815d32b066e2b68dcc5705ceabc3447d793217010874a138cbfa301f38caf17bf44941fe6d9fd94547e446acaab755477b851eb3667fe128fcdbaae530f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD8E3.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD9A3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit