6b458f82ff8949304b3a828dbee591fbd3718735331a5b32ad0bdee787834539

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 00:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eec0e3f4a1fe90ba0b91570ca948820e_JaffaCakes118.html
Size

10KB
MD5

eec0e3f4a1fe90ba0b91570ca948820e
SHA1

b5ed76be86491ba11057a08692cb47639c90789c
SHA256

6b458f82ff8949304b3a828dbee591fbd3718735331a5b32ad0bdee787834539
SHA512

41b483d2c997afe4b2dd4a69b88d30dda2e3c2d443630eed01f46b3cc4ec8305c2f3fbacc63f90db931c66c365fb5dcc9dfa39a07e301f2da90372ff4bc483c6
SSDEEP

96:SIk445SYaJ9ay7Qy+mjSim12qL8WLv+vjbdddddhM2U8HMT5ntCDHW441D/6:SIkSYaJ9aQymOfL3mvLqeI041D/6

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000f1a8ddbbb502fa3c2588ff2f1e8dcbeec1aa12ab4de36fd9b204783481cb065a000000000e8000000002000020000000df06965d8173d7cec44666b8f3126f9449cd7541104417fb4ae740070725830c20000000fd5926e54a365f45b4f40c33e08434554c70bf41f35a6dcfd3412d9aa715231840000000449bc3d2c9841c744f9237a970c52073c2e49f64da5e62d7d3f9e35ca4742b84bfe0f6ce28ee12318858023eb896653edd3a6862fed637f81be7d37ce147af26	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433041383"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000dedf5ca506c5ef41442792bd5dbccce5f37f8aead2080bb072a4bcb60d7a3623000000000e80000000020000200000006bfc4edfffcc07818c113f60ae2c73ee4405889f537bb0c147fe378da41fb95e90000000923b5f9dbadc664ab8d61ebc47d91f55c64f32a2d26f1c8c2cc376bca076851e9b66f92d31f6d9c8d4bf072d7d9d2f62b0752d3f8cd377210e36baf2f7a5e0cebef0ab03b149bcc29ee81dba8ad0565d13cabd88987b213375accdcc230b56a7b1724909b84113fe657539d5c9ea6ef63cc7e8f60063c3ca72fbdcf0955a04aebfdf5f528e8372fdb0a266ea372e06e440000000a3cc9e54ccdbb8706ae9bf971596d50d666da2bfdf022a1233cf5769fc94fe72021ea1adeefc629931f95355b0ad3788421b9fdac6d3064f997de34dce779bf8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00893bcabf0bdb01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C1508391-77B2-11EF-B59A-E61828AB23DD} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3024	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3024	iexplore.exe
3024	iexplore.exe
572	IEXPLORE.EXE
572	IEXPLORE.EXE
572	IEXPLORE.EXE
572	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 572	3024	iexplore.exe	31
PID 3024 wrote to memory of 572	3024	iexplore.exe	31
PID 3024 wrote to memory of 572	3024	iexplore.exe	31
PID 3024 wrote to memory of 572	3024	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eec0e3f4a1fe90ba0b91570ca948820e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
570bd4d3d6cae7572148c74727ef6ffb

SHA1
e48fe86808108c406d97a1617fb1db6b791ce764

SHA256
e589349d162f006b1f27c18b6bb7f20bd41d159238c856011d8da7d440c677df

SHA512
89fe817e0b232dd3e7f67f2c801792850df6cf85d12c84120f7687f4c255bcc49230f91766add548bbcb75e1a98b06c8635cac256f6e76da79dd65e993ddd107

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8bc10432af70f8c43345f3b1966bffd

SHA1
61da12d31604e3966acaa07036c6ee38ab35b60c

SHA256
4f56b623294522ad415bed47d7de23ea411af57fa4dfc1807e0f262c89cd146f

SHA512
d28c53553e28603c82228068a608cdb18bd7ee8f7e0f05a7e5ef61e02ab561d941deac69a6ec8e4e1ec4d1f467a553eb3654ebf3268b10c40b994f31b87fad03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f65df5f69abe0d6a8a3064e133e12acb

SHA1
7184a96e1852e6a5382a25ff5eba0f02feacd06c

SHA256
62dbc02ce9f0d5855a4ff8a71a8479e40177f4b953d34473a4931d1e28549242

SHA512
8328af54f9c3c698b57ac572ce7e5c1911551998e4cde163e34a41bd06e9772e6c802a3f5935230084f725213617eca6404f1d8bf0bf69ae96593f3821fb6245

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db10c2f207d90b0e15b20014f63a2eb9

SHA1
3d8fa94d94ec12eb9a02f1359526a1b31af686cf

SHA256
e30f515c9dbf20444ad85abd331bfa5139853e8df8f6882cbda62e5898e4d299

SHA512
08f5589c6641d9317d2503da7c8121524c666d4da160cca70f7b4cf682e8b8669051992caec0f4ca41cd33d3530967e4d2d45d1c3e3c9c56f7914403e1d347d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e0023c6ce79d13d733ea417bd18fe8f

SHA1
5c5990f32e857820920ef42a0898b2e028860a09

SHA256
1a475d107e265243c71d125b82c5153a632ea9eafe6a788a5d8a3e63d4871dd6

SHA512
9e925523a99967e1eb5b7ac972ccbdf289910ab3d428d6a0e304e85439b0087503d5cba651b89d1759090a38f755c4c03424444f5378cb245458a838b22bafd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85d2d828573dee43312eda84b3e1f54a

SHA1
ce895e534dff2e2ac8a0fce13d8041be49afa547

SHA256
3e437b3ed54924068f8df1588199e2df03dbfe0b85401705c7d478a48070258b

SHA512
bfd28624fcccc39d89f1546e5a07ee440b6cb6d8942730b743ced7e8c9cefd39f48e2d0540f833ed6f1f2368598e42d8c0d482ae6ce863ec9a27cf867f6e7f2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9366e27bc4a78cb7328b262e4d7fe0fa

SHA1
3456965a16b5ec2b40a18ee45acb4f8adbf4148f

SHA256
6f0e8496f16d41172304446aaa3e0dac7ad8bb26f3f8cde0cbb6355cf8964f81

SHA512
38e0e425ee39d6c35b6ccc93ecacc5569344afbfea51aa5f73e78ca6c141b4f0f9896ff9b30bcd406fcbd23721e698841a59b84d8dbf4496b74b3a0f701ffc35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c134c62144c6ac7f5067643fe69a6ba2

SHA1
e53f3038fa3eca2b67aae92e49c80e3d3c7cc98d

SHA256
97cd2c48fbf71c48781e85a122d5e74b631bcad4e106872594d4a5eaafc19bfc

SHA512
f1116b6a7a288c80f7815f8d19deb3974d7752fb7854ca2b1c0224de90afe7d0d065e9bf850625b6f9c67249e7dd1bf7d343946f1b1321f0c5eb8f2708343255

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb2c5a9357d8bf4585359d5615d8ed12

SHA1
3c05381ac8eb5753de3105f7fc7e7fed33f9aaee

SHA256
67de0d226ec39aff46c9d4f8d151d3e52323e1e97412cb6e6c5360a61e7ada65

SHA512
5a59ae0958c69bc7fc96cea2eaebfa804160924615b87644de30f341165b4c3e399e2e1202ad5112c3ca84d81457b9728b2db97df342287424f0787b5984fbb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ad6dd0579d5e4497caca8e99aeee15a

SHA1
9306f7d2b54040461709c83d5584851f78181e73

SHA256
6699f5f9d1423ce09d2234dc8dd96f7f80244c6316eeb32979754954d470cd2e

SHA512
9001f6ce71993329d5ac7d14b2e7a0fac1ecfdadc8ae35af9fbad033da7331aeb366fb1bc6bf1492353f320c37e6b636af2cde571967375f5ed8c7ac086b2e44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b590e48e0787b634089276b6d84fdd0e

SHA1
2d54d2141ec5bfdb99fde0b8d1e6be316df898f9

SHA256
dcc3661abc1441324185385185562dc6c298c04a93db030937e993771d9f33d4

SHA512
08703f34ee0e494492cbc40583afc3b0c6ea748345aaf207db5527d899821628985e7d3e367e8fec258c779c3d111496045d15cbf7d2b9be26e1004adc8b1159

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
458c3a89a9419516b0526e5f209ddece

SHA1
a4fa12cbf9cc338cd254dc0f0c1bdbeb9db282e3

SHA256
0a7a07ecff2802cd87287cbb38370c1999acd3fa34e508494f9ed60b90244ebc

SHA512
300cc269f8214e2c9f547717b13458fdb5b0fdc850486022a30d078c8744fa4100426c35da44d052ee340c4512eedab899bb2e0b131f3d2f2c6320b3ad4afe20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5cdf3c852af3b56b32bd1dd4a9ad1c13

SHA1
4a45a0da2efaad7e7871e7430c01e31532a086ec

SHA256
dc6ead27db148ab99438f11de304b49c4cdfdffb8a5479a2101595ea4e3ec55c

SHA512
eb21943f147311180729040063111d082a336d2117424fed3a308630943c31a693678ae0a532449a9700daefd54d90ded3d26b440f4d16aa42d20ac310df15a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDAC7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDD0B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit