3d946154292ff87f5a221da6c79bf4be27122e4ff55f7c3f3f73a7a959fa226d

Analysis

max time kernel
135s
max time network
128s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 01:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eed94ff31f08db014139aa7b7d739e41_JaffaCakes118.html
Size

178KB
MD5

eed94ff31f08db014139aa7b7d739e41
SHA1

7ad0c5455ec556b773e297d2b053e74196e06109
SHA256

3d946154292ff87f5a221da6c79bf4be27122e4ff55f7c3f3f73a7a959fa226d
SHA512

1d0aeb6d965228cf8f3c0c1d93d70d4823ad93a9d12a8b43879f61c9bfd458ecca780c73077583f0b084ea1481ab441087ed1caaa17eaab62e568dec85987c86
SSDEEP

3072:ScyfkMY+BES09JXAnyrZalI+Y6XXI6EyA8:SBsMYod+X3oI+YS1tA8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000e371da973a3dbea25a6f2da960383553b41fe0cd1c1aba0422632f99e8ef2986000000000e800000000200002000000023b682858fa41b59a6639aa8bb4dec79ac9af56760eec16d7a2e187a0f8f68e590000000d9b490bb04f7c2e954ff4f4b6080bc888d9f78c256f5dd02d7c00e6a7f2f66bf7289e9a7633e76dc4b98bb1b7a794d585a5727b12efe0fd4e797c3072ab0395977209eda1159793511da7510672aa4198edc6b451174070066791bfca871dfde5763e4048ef0b8e46996742b4ad8eba09ce2c35e9d4b5e5130855af7f61fdd108424f0a2db2a9f855872e6eedbb8f07f40000000a8d52fa630aaff512ecc07dee7965505d67485357c22e3be8aad850789a2dc90cbde9bbca22a9226d93d7794488f4dbdc7d7f0da069230f61dbb7cd7f4eb677c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{28C07FE1-77BC-11EF-A5E9-FE7389BE724D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000a90b34db530d35605772f5521e311b5a43ecbe4abf7508b8bd508dfa5d8e2da2000000000e80000000020000200000001b150796e670efed4d34902a500acf66c73ddc9d79e305e5f0845b0bd929c8dc20000000149e8c42eb2db74fa871735e354d2fc128490e6b6bc6080a033fae34922a15a7400000002d0070f34b92af2d690a1e7bc40c1ba98ebaf9ce22aa27f4f78ebc2c002374bfca5811e71850fcfe0294515567c5dcab14a7e71cc552b6b0438ca7871b3d3e0f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 209541fdc80bdb01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433045418"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2308	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2308	iexplore.exe
2308	iexplore.exe
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2552	2308	iexplore.exe	30
PID 2308 wrote to memory of 2552	2308	iexplore.exe	30
PID 2308 wrote to memory of 2552	2308	iexplore.exe	30
PID 2308 wrote to memory of 2552	2308	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eed94ff31f08db014139aa7b7d739e41_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2308 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c408b6ca38af545611d13f1eec333d78

SHA1
bf16931ae25de8529140f7ac831d30a4b25bdeed

SHA256
90fff934a6a0963601553df9b4e94aef3e5b8c6ecf9e25133c8121defac0fd32

SHA512
a60dd667a6a89284e129eb63770def3e4b848d80b12fb3efb0850d70c07af2eff8d350449165e702ee75ceb5db6b7711d607be5f622005b6da7115b0fff8987e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c382a05df1c54f1062fd43ea96b7866f

SHA1
9d923c39e99c991dfbf9aab7ba437ae0757dda77

SHA256
142b7fdc25516005671b4319eba99bfa5f6df105b488c095aef05ae49c091cc5

SHA512
7b86b0499228cafa29ce1ca6e76f0597a79ad5723e06b306333db9277b7dceb6045c67cbca0d7ea6a83c3bafabff41071694168932b7badd5abe4c7bdddae1a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5743bd70792f5b3a27a2d4c60a2e8942

SHA1
520a26ad8228e0d3e3e977ec85770f78b08677b1

SHA256
005304b088c87538884ddd3c921e41681219974b40c5488f1bb14d5751552da5

SHA512
edcdae0ff12415dfaae140fcd7c36a675d9fb352c1789e7972bd4fb94e432f604b6ca68b1fea9e3778105dbe8a2cce8b84484baf82900c63195e01daed4e4647

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e103ef52064408b6a9b5dfbc5a2f0816

SHA1
f78f203f2824620b84b22371a45a634e6815e7f5

SHA256
6d2e24a852588ea25299fd3305c69b8dc992f44f0c0ba52ce1f08001eac67fe8

SHA512
ffc47dec023374924ccb56cb73f2ff6972f5b2fdac2ed79e809dde2ef68fe09244aba18931890593db4e9dbb7d9c23648fee7f06ea3f0440fcb585801e227ad0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c31dfb42a345f010e1bfe48d778007df

SHA1
14e352369f3beb725b6423aa3092af2c92bfdd13

SHA256
0611810bdc8b897881c90b010c0558dbea6b256525a04687d18e04ec308ebd50

SHA512
5f4ae2bf7dda69680be266be6a48c650ff97f7b8318ac148e133d781dca7d1411c00ef8d5a614c9c3c3589f7a6cfca5d2ccfc589657f22f4fdc0d290da31888f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c769e09411f03146e127264bbc426aad

SHA1
643db7f0391be536987369c318b619fd7f261b8d

SHA256
1043ae2af66a66be19046cb94689125dde2e43670a84ea1a3ecb535eb886b97d

SHA512
8d59b1ccba686a02fce3d19e6fc6d39bb9e08573ad35a09963f88b69237fb213b356e18ce199bb3d91787ccbc6243efd450d74539a44cb728612299d2a4edf01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62e0ea3c97a09466a42832de3367b4de

SHA1
400218c71cea4f6576b17fa9fdb5e607583fee43

SHA256
ad8d310f6a7ff4e95a0cf22e74586ed4bf4667be80993b49f2f010aa205ab76a

SHA512
888c82aace9be5944ee18b3e21391eaf190b4caca586b0d9efcd7d40ea3395179b81c01791a31b9ace3ad63aefbcd124feda28cecbbbe5a8e1c0e2bd2eef5c12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd58d6034906ea88acd3bbeae7b0377b

SHA1
087a1d1ec91bc8e41e634052f489fd2b2b86fc0a

SHA256
599a3ec5bed518ac855d280ad74bd484719f179c30a9d6f9fa385a247711c9d8

SHA512
b9f1476a244ecdbab7e3d3c070b5f2974c2ff56dfd5d05b8f26928a3b479e172441653c9f454156b6fad5629553704861b67170712a90a26e78be6f8b07995c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9188d74cd939c56a80b43b6b087562f7

SHA1
955fafac1dbf95d23dc7aba6047d65997e04b87d

SHA256
bdac0b7e30315666a5d57416be5c37001825225a174763caa3c331325fd2198e

SHA512
4a3efe4cdc18d84cd92beebfda1ea82ef80ec7529314db82f58b828986a05774ff83df99dd6e290dca88115d4d6086a4781aec7bbef9989cd776b2314923a556

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50115f9f42743993b622b06ea5a02167

SHA1
ab10087b6e8807f1b6aa6138fb0dc1c9ff414d6a

SHA256
87fa60e94c984c619f814fa4aa63417f66dba085d81380626059938c9b627481

SHA512
6b284f058e63cfc720a4800a38a1eceb7d4c800585e05d008504329f3312b0bf28c529d99b024a9553a603fdce75feca21e55cfc6ae52d2a3284be10907ebc07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e66eb1f58fa03737ccfe9323ff7dec4e

SHA1
a186f9d81b975c3d31eee68951a7c9c1d028adac

SHA256
c052751716912760dcd60d85feb3cec4dc41e00f9a422dec47203a90e2dca994

SHA512
6d521d7ae2aef3d282e8f0cdad7872d03b1c699a64172b91c83bbe9724fcd2d3995749a8977742214802abdb72bc38ba4716a8051f7cca35315bb6f9a10a8923

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBF2D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBF9D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit