d2b714f936441afda465d63825770b99ac14d624d706a4b72f468ae78a40f9d8

Analysis

max time kernel
131s
max time network
143s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 09:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

737fa2f6afea562cb125763e7fe026bd_JaffaCakes118.html
Size

43KB
MD5

737fa2f6afea562cb125763e7fe026bd
SHA1

e46dfbd6ebe317b0c2de756584b899785c2e2681
SHA256

d2b714f936441afda465d63825770b99ac14d624d706a4b72f468ae78a40f9d8
SHA512

170d8c3ffee2af8fddb28ad4c4160f00fba7226f7ce097a37d296045257a33e098659a08eb45b4822f2adad32afd634742e4736bc2cd6187dd56794cb07195ea
SSDEEP

768:SZyRWhCadP27OuHBSQUmgsNPeFPmxfhPHgsfGqqQ+qDVjF7Sy3h3Ap7VSs2QlsLx:SZyRq9H4SQUvsNmFPm1hPAsfGqB+qYVq

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A19642D1-4B32-11EF-8A22-66D8C57E4E43} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428148498"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2400	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2400	iexplore.exe
2400	iexplore.exe
1252	IEXPLORE.EXE
1252	IEXPLORE.EXE
1252	IEXPLORE.EXE
1252	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 1252	2400	iexplore.exe	30
PID 2400 wrote to memory of 1252	2400	iexplore.exe	30
PID 2400 wrote to memory of 1252	2400	iexplore.exe	30
PID 2400 wrote to memory of 1252	2400	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\737fa2f6afea562cb125763e7fe026bd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2400 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e466c9cc954bc32ec5f15d8c1c0e003b

SHA1
06b22f89f1dd571888e5d697b97dfabe77df73c7

SHA256
76c4811b019cd37a09a91fee7d091791e2c0366188c94f7ab51af9ca4a16ebd7

SHA512
fd555a52a36b22b356712b6c2cbc9d9405d8fbacded98eed41d49ab1463b856c973f4b1ee443eda19cf80fa0b4c05648758b08d49fb688800554f46c18bdfb47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4c9ea04ac9771185ed6d77ab009af08

SHA1
952732f36ec70a0d4d9b0fb511341fbdb7e78516

SHA256
0e8254d9f0415e37f5c9353a3f1f91ce7fd4ab0880f061a6e23f2e477ebe1446

SHA512
ea344b08c0bcc7c9945fa618bbe4b6c689e3cd1af39d18121990de4e2328dac12aee1182fd39b82887c6975db57dde44dc007a308e78cdff4613791a013aff98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f1a481fdbee4b1452b6bc3504bde341

SHA1
4488fa57ee920568b8f4a07b6cce603561a89ab4

SHA256
22de0e81ac15d00bea64bc4012337e3197453e0d5770cb35697534393d708ea1

SHA512
43af3b4f1e22d6d7a7864f4997352e21de70b72bd85c9f6249eb34170e3fc1ea0a2648cea20fa118ab5a02d77f1cd45861cda6dd2736fe2c021cdeef83fbfe68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64b9812d3ec02f685b77069b52a679cf

SHA1
3b628634cd397e44777c29b2a927dfe4065837e4

SHA256
a02c9cbb9c837815974d88040a7e36102b524621d431d31c6033d669e3aebbf8

SHA512
ea77080c48d19c1c41deb82b193fa564280f496e44c41eebacdb4c37ad7f36ac8bae34a2fa92308d2381bf339a04940cdef864e8fe21c195371cbac175b0dfdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
638453bd65d46a65804204042b887f6d

SHA1
147abca5afea7b0cec4a0c8f4268396460495b4d

SHA256
88399a9f4b4ac6460902175b10ac745ae7091d1ad48f3b00459daca61846912a

SHA512
24b4593437e1135571251823ed32e88a4c35a5a819f924590b275819e90853aaefc409c7fac1b31c8db9c0b27a882081ae8d2e88ff41a1da08bcba9b26544b20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30fbca48ee92496c77ff5da5911361fa

SHA1
e91f9dfda2693c9356c2b8cecdde804161e3110b

SHA256
46f11926b3fae6c3865162ecc22fa5a6d7ea38a98d70a21655d00e64609c8ffc

SHA512
b715cb51c193c88753ef3ca1fa15d8d7afeece37211e3917db48b5c700900d6d6bd3fa13821d08374af1fc5b48c13f7c06a17994bde2940fc58831c4c24faf8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49a9ff45e33d31cf9a4abd33517ff4cc

SHA1
ae4703346e1f170d8ff12bcc0ec1bb5f9bc1c52f

SHA256
99865186a6004b69310d0017a64b41fc870b82af8872ce1baf02c1d57ba79d55

SHA512
d5e34ae5365772ef4d53fbf6ba9b68073c09c262fd5a4b62b60026d6cb55be180296601ee65b76b3c15349b63d3672d67dc5c0760d95185647d3aae897c307da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65d7c5c52c5bdfdd4cb6a8716b7fba65

SHA1
7451758543b6d59ccabef9e2fbc4eaf03c5b5256

SHA256
057aca03cbee92eb5f24fc4637659375352e31ef3e9f33c6dac047b257a41485

SHA512
48cda73a52c7d7199519bb37925f6ee251cefff323b65fb0f7f3192158af866695f6c5d52b5d6e663447ef93b155d4fad4fb7b5f82eaf0c0dafdb04118502a5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a39f3fabec616fa586d59d10eeb9b290

SHA1
6c71f201766a4a0c96aa00232a6ec78a6ad5a020

SHA256
80028de02393ac2b7860890db043a5cba62075e0d1de7394bca1d1cae5fa41d2

SHA512
09f2ad9bb3cf9b0bd879e65685af4e3d968feb723fa03cf6acf2d25ccf5d99276c33be9a42f101110ceeb63641df0096f3ffc0a9b522ce7bc279b6ec596719b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA046.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA105.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit