bef79645d05d769bb68894168cf3baf2ffc3ff544972c9ab5016889ccc3ea161

Analysis

max time kernel
136s
max time network
141s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 02:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eee5adf8ab2218a410b9ae7e55ee349a_JaffaCakes118.html
Size

213KB
MD5

eee5adf8ab2218a410b9ae7e55ee349a
SHA1

0f82a453a154b0cc79dc21369addbda4d4b12969
SHA256

bef79645d05d769bb68894168cf3baf2ffc3ff544972c9ab5016889ccc3ea161
SHA512

e3ad464fb67c59a7f34eeb76590aca2d5c947fb66f79bcc399966ce5cb48549a0562a0236368f31a838e0262277795cec65795f4ff3848f5c4c03d4f25aa8b45
SSDEEP

3072:Stq6VO/ELcXnyfkMY+BES09JXAnyrZalI+YQ:StqRZysMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433047384"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BC7D1191-77C0-11EF-A1D0-5EE01BAFE073} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2736	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2736	iexplore.exe
2736	iexplore.exe
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2500	2736	iexplore.exe	30
PID 2736 wrote to memory of 2500	2736	iexplore.exe	30
PID 2736 wrote to memory of 2500	2736	iexplore.exe	30
PID 2736 wrote to memory of 2500	2736	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eee5adf8ab2218a410b9ae7e55ee349a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2736 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
487bd1dee0cbacbb46b1940f5d8fd91b

SHA1
051627f08e2c6a92f1dc6f11ffd91cd60d73ea38

SHA256
7b7a2e2a20c94d42b6db07bac9cf1eb063d6a239f050050b8e61b749abc595f7

SHA512
bd62dac830d344be4d5c3e297d2a3bedada61d7db537eb2c800a94e9e238d0f83a35e8cc076ce7fd03523072db1d0fcf89baecc88214c7c1c22a455de4f7120e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a14e1909cfa51f62271cd4b6f5219e1

SHA1
bacde100f6f79666e5db8b4437575f291eda6f87

SHA256
ccf12936c55b55c51d3fe137a110a866af54fc9ae9a6ea94c779f86d278860f3

SHA512
673cef889a10ed8c897143eeb17fdb3623e444289a56e41c84eb27bc1b77ed82e22ad7358bd24b2dc09f53f4119485cd1853a5944398d7d45ddcdfcf91019a99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57a619f7f8abec64d94977657332909f

SHA1
be6acdb656e566d009641483bbc86093e2252112

SHA256
52041628d7abeb82d3b52f27475cf9a83d8ed4ad63c3d178c3e1028a61459c17

SHA512
fbad04eabcfe4b0f8ebc2507901c8c5277cb2d18694037f831bf9afea2bc44966f4db331e301cf2847158ebf81c79afd8461517056deeb515b9854a13f9346c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
602e0d80e1f86197bf02784560135926

SHA1
905ea3d09c8d280e315b15f17069238564472fed

SHA256
cba6758e0837538b9a6808b3f0c02226bc325e4c12c7c57ac6eb9c760b45d1dc

SHA512
339b3f189a5de3d7fea49e4b5f7f597af1d16716bf27aad7bd6ac3e96099edf7bfc6614f2278d394aa48f0d12124657eccec08f4fe2bce00ff4397df017cfe1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f7b282d6c10417a07f5c0924ed07d03

SHA1
b99b12d1321301bbdc759acf59d2503586688a09

SHA256
32e2c0b3f1519397a8b9011c8433b1134f0398d690ba49e3fa7ecc7159ff7ef0

SHA512
5a69f72ff7bdea6df6c99680fa94c4702fe96f939b1c0cefd8ca5260dae045f57ba1a34f41b7e6110fc49d664eb8af89c62a257ee90bef7a04134a3671f353d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a85b0f6e2ae58920d6c21fd3dffd6f9

SHA1
fa2d16ed54c9e6a124d1442ed1161d866f0319e2

SHA256
b3768abbb90f30a70af9035aff924b39eda3152df82c9af5bd0bf6d571455c0e

SHA512
9fa2e9b2b9a84fd6fc55bc9f4956d9086ae0d9f284090366c0ae0c87894e33c92aa364fccc6c5ca4343c879a484d3f3a27722d1bb19d986d8d1b2082cc43d486

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a570319cb04bab63e3049bc49f0bce7

SHA1
b5b50d78a1a7b6ba622f24b142303ab8000242aa

SHA256
e697c45e0385cd2d3e47f4abd859383cd5aa6e07c0c1803894575a4b1b185f99

SHA512
6ae77c5545e332ffdbe3bfa3f4570506a41cd2b2576518fe0bc5a8d65ecdafe4e2ea0f9d56dbdaa0127f7fc318b2c1f43cdfcd2b50605c716139124de17b58b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eafc9f71f8ad75443b69c79f3fd6e48e

SHA1
319ee8aa2dd5c0e1cae30c6ff1aa79c24226914f

SHA256
d41edd071cb1aab83d4ce5437288952add4594cbf37ceb4d2c5114deb5adb0a1

SHA512
eb41516e9c1aca66ad755df22b98b71eab45655391e01f167122b0326a041aaf1f7e66038ae9dbe84143902289e02f1f4d234292ac4ad62a8fb547add6bbfea1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac16395a6d5a9125e51a4111227a29fd

SHA1
89f1d8da70a5c30458a03cb53135184aeeb06867

SHA256
626b3df04f024991d99275e43c83324057a434169c9868519672145ad4139659

SHA512
ef6fbfbe91df14c125d803ee67c139292c01922a38656503d6344f9451d45c5f438408445dd5c3b9135619596f826dc4325f19a18adfe68c3faf18f4cb1a123d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14509f4e5bbbc3fbb1cb085b1088ca1e

SHA1
b991cbc35f0432bd5c0eb5d03d5f4e63682d87be

SHA256
6136bf8a03be1ca0792da5a9970313ccd783f49634bb0f7759687765d190471a

SHA512
2281829dfe7e10cae6b338cb0bd88f6cfb350447e52c8eb9095e44cf422018063735e7bc4197cec14ffd0f7b2312b78a4b5e767071acebf989bffe3d30bc0008

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b29b557646024040d27b97a6ac506964

SHA1
8e2ff2709afbaa3d61415e0023dfab335aa63f7c

SHA256
97297f7993dc70bfa7ab03165be3137886e0ecc62f850470e2a430b35dffb70c

SHA512
6aea5a5323cc71fefc7d81be0051a59121516239642ccf488180068b09d248d002baeaf5ff8a6a6eec411f97ee857ce12b5fccf96334131cec822a760798a729

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1c433e016a9a45f35c6930294862c29

SHA1
7270b4e5f3b53b64610322674671563e3b53eb92

SHA256
d926a025fa4073a1a431818f7bd836e05c5f06c3212a6eb7a881a611566f3dd9

SHA512
cf2bc878482e509cb638ef25b90370e0587d72b0e134a6cf51c01aab3b84130184e47600ccc00f94015c63ce3681063b194322ddc3d496c6bab4e8a4983a360a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b60782f778e6938a18cc8847f6a18f4

SHA1
49e10cbd33cad99913fdda563f2ecada24e1c1f7

SHA256
04f64212aa3c997a2f6dcbb3f02aaba78b8aa2f5eaae92bc2967137bd65d18fa

SHA512
67a1d574bf39679724b55538be62b2d5dea52701ea05ba20095f55bf51a35aacdd4fb9781b33ec3e368b25538b1b1a46aeae45106a24bd33acda655605d76960

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8371b431b0d9e7ee87795b463492921b

SHA1
776fbb8aada2e1e36f69d2282a1cb7e0d321b952

SHA256
a671f410fd2dc78290af33631aad475d83bf99ee47ae519f4337fbd7593cb21e

SHA512
dc27e7c86822e7ef2b622a4ebfbfd60fbbe47370a670912ece36a9c4cdf5eaad4e82644aa2631f49fbe08f5066f4674b4d1f66bb56cb96e19e600c854d412b2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4909ff3fd1ec84900ccbde8ae8aa68b

SHA1
cbf91c5ab94febe15f4b5bdfd62873572af983f1

SHA256
70dbb0e124811aea8657104013c99c4a4eb29f70099f616ee642ed0c6ee07e36

SHA512
67f6d444397180fd8c805467b9e3f785bb8e7bd1849e205c5a21f650b9c192fcf8ad0e1cc10c2567381bcb5f73294cbd69b4859a1f6cd1d2b8c761c9cfda6725

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
181dd38b21fccd53373dcf3b31fa5657

SHA1
6637d59f83ac4e0c9a828a459446a7442662c05d

SHA256
2b277197e0322caa2af24a5b17ec1706e54619d6b0e3a88e03117db007ec6fa6

SHA512
27af94311826e88d9c1af57f7677e3ecd953a245fe939e0ffbd8b1c9464732b649db49b8613fb6d82dfdaabc0a723892013b9731992a4bbb561b8d69f2aab6a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c9e307cf2f82d01dc78a9fd46b52452

SHA1
308e42504386237f014b543a18e9682f85bd0acf

SHA256
6ead681f409adb45b0c8dc8fbd141de81829a3255039ebc77112c023d3173539

SHA512
633746841c872f82e8926340b734709382bb89417d82ce21273b863f1e94d8256c7c38bc5274f229d37c7fd5317f555f78bb7d3aed0156e2a40cc30746b4d7a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab404D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar40FB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit