042f01c6ba6d2068ab16d429a4e3ff268707a4f17c0a2f14053c9d7b00573224

Analysis

max time kernel
141s
max time network
141s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 10:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ef8f0d5bbec88a37cfdf67048732684a_JaffaCakes118.html
Size

141KB
MD5

ef8f0d5bbec88a37cfdf67048732684a
SHA1

85598df81971a4af4f594f1c9e42425858c6b4db
SHA256

042f01c6ba6d2068ab16d429a4e3ff268707a4f17c0a2f14053c9d7b00573224
SHA512

a44db614e24210df288af9fe21ed4204fa48fbd4831bbd9695580007433706b1b2e487b7286610ef9a00e024a781345378557843a4346157b3df756eab1924db
SSDEEP

3072:Sjyjw5x7dyfkMY+BES09JXAnyrZalI+YQ:SjyCx7osMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E4A70961-7800-11EF-A429-7A64CBF9805C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433074938"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2780	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2780	iexplore.exe
2780	iexplore.exe
1964	IEXPLORE.EXE
1964	IEXPLORE.EXE
1964	IEXPLORE.EXE
1964	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 1964	2780	iexplore.exe	30
PID 2780 wrote to memory of 1964	2780	iexplore.exe	30
PID 2780 wrote to memory of 1964	2780	iexplore.exe	30
PID 2780 wrote to memory of 1964	2780	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ef8f0d5bbec88a37cfdf67048732684a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2780 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64f206259a1f3e1d7883eb4c3aabf6d0

SHA1
bc394f947539ce65ce8a7269bd1594abe8db1861

SHA256
7dab1fe4fb0b7878892b8127429e6ed891564bf73380666e629156e1c02dfeb7

SHA512
0125ad0b1e8eedb0ca8b0b21cd58c68a8aa20b31db8a918b5fe1e3a083b3a8893a801be1ec515ad08dedeaf4e49ecd3f1e9a7e8339c6f0e6241c6ac97496b254

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4c36d565c40365baa403c81342315ae

SHA1
f76db9897b38d38813892172fe3ca400d2a9e0a8

SHA256
3722f37e2ab9e51a7cf8a6a59390187740f7d2224cf648d51b4712574522663b

SHA512
773d2777a726722e2d8c8c00ed826baa8be60f77915321dc53d1fbd4bd83ca0e1da0a127f6018e6e3567effa941f223ec3a3637ba34f25b356ecae2b96da52c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f15598b8f7629134cc8280913871fd7e

SHA1
b3064cb328639abff9b5042b67966db83101e670

SHA256
885fd90887738024bdc5b66fa77c670b58767150b8c637c2205dd23d67d21cd4

SHA512
da4982a5d3653c142be512f70295e67f65db7c52881770d1c72dfed4e56c63ee9dfd3bc98a0a9fb8f6f97d956af7369495fb5fbd0f2b7569c9e1313469dd1202

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18851b297dadfdfb1b1b8dcdeed9ea04

SHA1
20223ded7f8603d759b5a3447785fbbc7828fe91

SHA256
63d3581b6b85ae6e4cd6503ad27774e6f2ce3aa6fc03761be74e632c79bd7143

SHA512
c9eb1ba7404644a392ddba8b57739305df7d86bfefa5669bce654275f6edbd97d8e433b87c955a2e38850ffb36247501b0038e0e9545cb61bc95392ba18ee352

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3f759926307511c3cba0393cb9de067

SHA1
ad9c0d82df84981afb3599049b63914bcae12641

SHA256
a99cf189f721f6ff6ff20f07b34c3378ba2326507cfe550904bff90a668d13ae

SHA512
6d644cffde4eeb473845b3dcf2ba38a6d68fc22c0604049d0f22ffda8a200e07ee8a785460654c16b648f3bf2311314314964d52cf6acf63f03aceed4fee0aa5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c08653a79ea8300d33f043c3c1238f8

SHA1
d37b7d5d5a5fbd82863fb0e32b33a0d29d7c5b4a

SHA256
a87240154f5e8a57fec1a7c463035f2cf463f9de3fc7b2cc99c0df873e946e34

SHA512
0e8cbfce995eacf605b885c38855b290c5aa3cc60e838fdfab8d14367837b4e1b8e06069b7b6dca577047b4d04a7fdc4ea803b03ca8a1611a1872b5359189143

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cdb6f0ed1278babb8431c51262178861

SHA1
b0f317c62bf4d35d940bda209655e7b8cd29ba11

SHA256
90d67935b9d06bdcbdd428fbf972509463e70c2efb01500be0f6e12ad3d06a80

SHA512
8953792422d6b8ad11f55fdd16f92941a1922e1504f562ce5959dbac5304685dbbda14310de6018eb651bf69f0ed009288efe5a2e4d0b2630052379642436bdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46c7611695aacf678b7a0fbb3b63761a

SHA1
1d36475e6a8898d0692ecd2bba91191efb5a6835

SHA256
f67be0ea6e1dfc71acd443ff1fbcf4e09f3a68c4cd964c80907050da409e1422

SHA512
8378120b2a5748b2d52dc33a2476a187ee8f0f4b7ab301b4c788e50a20dde9490cf6d4f1eee8860f6cfe89955afad423f0d64c0f32cd437764a1ef451fa86f50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6865bb7b7a804ecee73fb55c15d5bae0

SHA1
48b2aaf1548ec33f7d9a26fa4bf40bf54615da5d

SHA256
c6e1fdab70fdc5f2984bd496973c3d95e286f457d18742d7fc6b99cb1b82f6c4

SHA512
a7e8da7603c75f40948860660b123a81ba6d3a5be1721f817f02e36826ac99e6a2a1c79e532211db0df00139187eba30841045f773e712536475dda00799f70f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5c72fa9023b8244ff3b750455bdef04

SHA1
5535ce34abdc07ee8ddf13078ac13aa3946d3120

SHA256
5a905f57b3cc8d3b2cb8f243b03c2137bfc33c9eac2ab010724c7c6765563a95

SHA512
1973c727ccc5bc5797fdd37f4509269d2464f23f9ec4ece1135b5e6d8b59c784e4a4c501332d2b468344c9b52d90c31ca99cbc9579e9118cb4883b8fff9b12e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7192ca54523a545c5fc0b006ba3b0480

SHA1
d0b6a62720b37768adbc13f03d8ae3560f1521d9

SHA256
0bb6807dbf311a2fa831f18b40498b24cc9b531318968b96b0599f897fb608a0

SHA512
c863aa6a193ddddfcea28513d7c47dd26bc024aa8e0fcc425d01822dce6f4d86a4cfa5bbfe52f6c7aa3c596185df3b8044362c915b917901171df8c7c599eb05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de6fe4942700abd38d5e9439fa7f6e13

SHA1
e335aba3b1fd16371fc828664b83564d771a9c16

SHA256
c3d92a84a4ee070ca97c2a86d70a2e0a6c289a2530afe828f8f1d804e6ee95d1

SHA512
f84f3cb40a803c3194546ff67522b59e466d0010eaf77b6d6cb8902c2f6087fc0a2dc88e1946f58d8c48b361004937ca7d9e4ba80232e7eabbb2fb4ced66f38b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d40236ee98e836ae674d0a136b1040b4

SHA1
6e63803a2621f31bf139fd866084ffa0b33156b5

SHA256
9bbd287d9088984f98367d709d6b82d2f4ebfa303dc7c273c8c5d993935f1387

SHA512
655a75dfd9b7e35efded5d008f63a47767894ad833226724f8122c85ddd5594c887985d83d4ef2f467655f3287baabfdb5306a9ae4d96074a475a20fb05f6715

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf134bb492cd7dc0f7718cc4e009465c

SHA1
7bdea1f7dee8eac8e043e94140e57b42e37ca43b

SHA256
55d1db43edb3403e405e2ce167e01f0ec132a0a01db54178b998bfe6c6b105f4

SHA512
a39a41f16dd726b08bfb5a28c8f48b1a2a25e00561b305e09c174b05d36365869120243e0ddf109241c79a58573fc4144a36aad166083c769aa18c58ad7555f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c00c508942a28309f2368687e7378dda

SHA1
91c1f286a9faaa0c94e934c8a7b3a387b8b2fd57

SHA256
5efa49be95ba859ab2ac99fc69dcfae284722da938f6c9d4cc1aa4999aa51538

SHA512
3ecb904e07c6bd804ca319ae3eb19b04102e14b009fd6a7d54f6baf5e6f35bf185fb7ee643c18be793a15c47f6b8a3282062b0e2463031e92e0891fdef62b698

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2c4c2292fc0872583598135ee7bba0c

SHA1
641d8e4f496ddfb17d0fd3e8fef87e975852602f

SHA256
3a4fb01b3601027454c1926a6eb4b1e7a5f873c244336982f49fc1b9dc5c1dcd

SHA512
a50a8c3a1c2f4c3ae1248bd087c58ed3e9af3a60d81c39379edbac9c45bf06eba7f8f01b1838d23904b3355d8f9dfe6f1a406e69b5efe14929770a0ce1e2ae3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e708407c38041d1079900df00f23e92

SHA1
b72520ee145ed001d89e721a8f8e15b871406387

SHA256
54da65d01c347ad91ec4d471ccc8cdbe578655e2b923abb7c71b9c995ba48d00

SHA512
2fb9d9eca080ca47a69866628fde14d370a6297346e7b6b603a6e7b3b3559c4dbe26cf73131fd6f1940595ddca3c4ab852ca2203f5b1d1b1da0050719bd108c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d954abfe638a66dbdffffc235da90e3c

SHA1
6f6ea5f5cee01e55e44c832720adf44f0a9c8c0a

SHA256
0c61c9b3b4e44e7f269c8407ff25c995823e3fb0b55da7662a9a6fb9c192d309

SHA512
25b89bd4fd6de76394f7b6db0c0cc77a783aadf023cbfef33819c14309267621d95316243856ab3f4d2aee4bbfb94f0486014c154816287d52cf0319162c2e01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
530cf966ad676d0774930c49bfacc2c3

SHA1
a25d8337a467ba377c50826c74b2f81977770918

SHA256
827a71350fef2c18f9e51069b5ea8a379d22146206fa33b462b60b5a47b6bb65

SHA512
55c0994d86e6ea5a00227fdcccf026d86bd9c38a168bdba046106ea21a8243b747fc92c4932013ff5a77355b6a63290e23227e158f8aacd558d9d927574abab1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB453.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB4C4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit