8cab11e6df4288c09e88920ffd99298259455e29a9b011ac9afee9a0ec999085

Analysis

max time kernel
119s
max time network
133s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 19:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec0d379535c43f251e9a8c51507f38f6_JaffaCakes118.html
Size

20KB
MD5

ec0d379535c43f251e9a8c51507f38f6
SHA1

e51afb251a3eac1c174b641795cd0da5438dea05
SHA256

8cab11e6df4288c09e88920ffd99298259455e29a9b011ac9afee9a0ec999085
SHA512

aa6bf7414b61a77f5607b94bea2c820409a717c634f3f0558407c1d884c7c45d73c180e8827cc70bf8e7d59da6d3b360083e0ec80b1fb8c58c6f0ed163d01635
SSDEEP

192:uWPSb5nA+nQjxn5Q/enQie1NnzunQOkEnt+0nQTbnZnQlWCnQtpwMBVqnYnQ5kNW:lQ/X4F

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5060511ecb0adb01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{473B09D1-76BE-11EF-B6DB-72E825B5BD5B} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000040923d5f5b17384b35115a11af8d44c369056e7eb9fe11d330eae6dbadbd4849000000000e800000000200002000000077604d33b1bb4696e1a3e2fa51d4166e45449fd22e7541f57283a2e8571fc31d9000000022a5c0bdb398addf32b9b1ffa31e7e4f01f4835dd81ad745aecee4c86c60770d3823f9986337b452279d847a3a9aff424c48f5bc82017de5d57be51b9a3299eddcd41bffe352d7a8a665c81f9346e9d0ef47cc4721e286780a38537b3a9da5a2c7e9dbe101590b7bbb0273ff3369e1c7d977619bce243f327a39d5729dc884782ca9140eaedc65d505d8fe3e784e5bcf40000000e0dcd94ac039e00d3ef59568559694be270bf21d65bb1eff898b458915550ad0afaa287dcfdd559e74e53a580b5683ac014014ca721440aea42be6a800b9d23c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000f0b1e504ec1cf65ca0885e7f05c793c4a252de2314566e7c088a70c02ad0fae7000000000e8000000002000020000000d0fcb84f62ac737aa75ea389cdb851df70946458dfa32d95582062b06f78d8a8200000004041115d1bbafa27e62cf5f0d687acefd590f9289910159bd7d80d650394b20140000000077292addb124ff55ec5dfe4661f906ebebca2cbf297f563631dda2706396e045fbd65211401c5c44d1628a17b907a8b273be9f764730355479bcf686a5f7c00	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432936380"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1040	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1040	iexplore.exe
1040	iexplore.exe
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 2864	1040	iexplore.exe	28
PID 1040 wrote to memory of 2864	1040	iexplore.exe	28
PID 1040 wrote to memory of 2864	1040	iexplore.exe	28
PID 1040 wrote to memory of 2864	1040	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ec0d379535c43f251e9a8c51507f38f6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1040 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb0e06698d49eed5c65a791f0c28459c

SHA1
16e1acf74d0d9c753c41855eaaa71e673117a5d4

SHA256
281c899b1ec12ce8986449b8afca95038cd0de3dfe059a371365e2384b638b02

SHA512
dbbe760dbc8b7735a360efc5143bae23a2ebcc31c80d71ee1014538a02fb61ded8a7d5c06d6f448aadcbbc8f1f3ec00ac0d42a3e37b0f40f31f598487175651e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e6cc08d5f36c1b6171bf2b9428f2997

SHA1
e111486a0475167fc4a9370e795a11f4424821e8

SHA256
14602088da72ac3ce8877316cbb42e41b512cf75a23d69a822ed06ee2d54304b

SHA512
a7537f65735660e238a72f4f34aacff46d9b41d2bdea20a6cd0c120f12df357ef0d7e664760275f4c7e579eb7423cbb615f81afd897bb8d57be5e5262c29d44d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb04c4be60fc258c14b5611433e329ba

SHA1
8c1f29f9b061931dcca48f6cbca049eb050010fd

SHA256
9f7fd181ad26160b085dab4c60781e1c9d460ca39fde652e5afa96b913ec49f8

SHA512
eab8113634de48e621c5a92c68e126aed69d47b7fed4344e667a75f55c7eea534f0f3e6ebfbbb41c7fa9efc4642371318e15ab48ebe5c34d9d93e2e67a0e83f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4adfd60a6712abf0b31b342e63bddae8

SHA1
da094a542118210aca704ef1851d268e3305e44c

SHA256
b4fc9738eea8cec748ecd4ca33737a13ccc82d02155ffbd06e307d5ee34de3da

SHA512
f7e529841d8f368b4b452ceafa4636e9a34a3ba2180e1575c366ddcfd41994d6a829510f47b7bc0f6611921086ad0445fc80c690e3c9167cbe5648eb0aae9e1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f79ec093aff95c4f9008d341910ec559

SHA1
baea6cbfa106c36aa32416f64e80e1572b538ccb

SHA256
b064d74ef4386f65c19d21cd8ad51fc5a86b7d70aadb299ea0d678062e4622e2

SHA512
992c482958711593b00a13b43c01e33db3fcd2d6456dd891aae2d7f4a18784e5012d0285c4ffd36b43ce5162f2c8709710e9df83b3de17a441d035a8e9c9b86f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3213ae6df8794e1fd86f445fbf2ff182

SHA1
2b998b05d7abf1ff09c03155562359da84f43cc5

SHA256
ae82ab042e9a5ab2eda6502614f79b433b1e3433a3e54d4be002a4a982771e3a

SHA512
a69a798a4fc1bcbb89c68b00eafee5afec86c87b00bff1242d8ea7505d1ee9e570965d029d9a2fa4c11e2857f3ab829cf941cfb8c9dfa23f57cd68ed6a9cbe0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0efdef97ad2caad1496ddbbd4ae5b166

SHA1
b03ef3897bb2b9f0c9f738c1897423297ee0255a

SHA256
d813c3a9481020d624ec0bd624c9c2200f876c01d4eb500f3e2dad4c5381f321

SHA512
0dce37268daffb331b61c32adf1a8ad1106fc6aaf76c6d22c4cc06028494f4a3698c8ef5a09581f7b63bf77bf5682f24bb0f19d31f6fb5143c83d65eecd8d3de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5fd55ed688131b4c3d43838378b7d967

SHA1
b18b7b939bcb9a5d200deb209738b2672ffac941

SHA256
6967334544242b1880cf1d302fc6637f4bfc88adfae539d6b20cf5184a7bc40f

SHA512
569e8a00aaac04d08efba4ea9038eb4bf45e8b6cf135642b596f77475d37e4f21f62d5cc86f1e957182b932888a3f46a65bab24455b68394e99aae11ed198747

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
931e9b565bfa24db4d476a9fdaaa18ef

SHA1
7173a247bf938492d17bfc85cf15ea447edfadf7

SHA256
458fe850262bd4cb639e8851bd6aef92ba86392fa4b3603184de1ef794253b4d

SHA512
8b1732378ab8cfe0a72c11bbd864ac4c429803537e6f913efae8dfde06b09df84983beef0a9d1aa4c3a06f7906c99760943d6edf7d916037f7f965fef401356c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78c6e451f1bded7195353fbb4c9e6f49

SHA1
5123221763e55336461f33e9b1dd32af2ebab01e

SHA256
f029a243f7d8277461716aef4bfc0c0b11343aa3740fc33cebe0dce62b60b66e

SHA512
dbd0c6379e5e3878c0bfced6200f442b9a987d207dfcfe86e4a6cffe3e75895aed51d2a48b9feb1f8fb2661b5fb8fa2355dfdb8ded2e5ef0e942e06287a35b02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7489bfbc2862d7aed3948eacc1e3e0c

SHA1
6537c83033fe83832607b1dcefee66694459c307

SHA256
8769bbd67a4636133543954063224e43156873432af5ba4dd8244fd9f4845006

SHA512
7038a6ca0ce887467426726e3afcf7fb4446b8fe96aa094b4a62455e7be2a3ddf681a6596b2edf23218386d5f18419614bc3731ca2609469de292d5d7e0d4f0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
942c6c29063b7c4132c858199ef23a92

SHA1
1b4e5a3db250c6d77838a1e51555d34773b4fff6

SHA256
ea3feee0eee58719d9c79c1c9feaad779ab040302008e6dc92ede89689251485

SHA512
e91fcce70063edc78fc271eee213742208be7b129dc57a14dc1a38ca68cf566e237aff1fc2f7b6ab358aed32997003e019b3d7712afd901ebca999be9d3e116e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48a5cd298b0d074018ef3211aeb5aaf2

SHA1
675ad34cab45ec06bc23bb22d05c8d21a14ae0b4

SHA256
85b58a6d2f811717dec53be2353e382c612bf0db051f902fa55b35f753290a86

SHA512
ae30051aa2e252d42da136bafce152f5c74b9dde6ea8c4d42c602f5a2b49cb7e4ce5ea9537e3ed8898a1bdcbac66c8d1b1e35971af17a92e337bb354e3280386

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBD4A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBD6C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit