48a41606a7822fc5e2a602bafb1b8a2bc73d566fa3783f2101b48268828ff543

Analysis

max time kernel
67s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 03:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

76d89ea01eb5aefeb992dcb52c103e24_JaffaCakes118.html
Size

12KB
MD5

76d89ea01eb5aefeb992dcb52c103e24
SHA1

7b1a01f5bf99e1384feecf4f0bdcd5984e1e41ec
SHA256

48a41606a7822fc5e2a602bafb1b8a2bc73d566fa3783f2101b48268828ff543
SHA512

8eb6477bbd22773ebd284269eed7bd22db8344649564b0a3e98f8098350c6b734d457dfa53a747fba72ed600f4c121aacf4b7e121cbc653fffb478de545ee640
SSDEEP

192:2VQlIsr0KXyJxVCNN5mb8k/w1wvqLkZABfZXnVQ29601e6uBuLbdU8d:sQlIcwVQjmN/guABfZXnVQ2960e6guLZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428479922"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{49A9FBA1-4E36-11EF-8031-C644C3EA32BD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1068	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1068	iexplore.exe
1068	iexplore.exe
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 2240	1068	iexplore.exe	29
PID 1068 wrote to memory of 2240	1068	iexplore.exe	29
PID 1068 wrote to memory of 2240	1068	iexplore.exe	29
PID 1068 wrote to memory of 2240	1068	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\76d89ea01eb5aefeb992dcb52c103e24_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1068 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5fc53ab2c715b21f1469927b08e271f

SHA1
832c4be81e0774f47cd3b1409d469e2f366aefe7

SHA256
007cf9c8b09f192b8f100f4a0364535fbed5d1db3402098271425986ed06953d

SHA512
d7826fef8ba167975f9d631dab370c3a8f28917219af3cbc5009f5008b47c5bcd578451f0ad5fab70d2540a1620b5e3213c06c42117a7c6ba6d93f04322181d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
309a331fe500000b92584fed6f746e6d

SHA1
835e818aceb2b0b7b1b84b3590894370977016d9

SHA256
ae3077b69137efc5162ff0d1bcc7bafc81c5fe39c875c812eb4db10536e584a1

SHA512
1d8b3b75a87f573dfc5abd178c9530e97c09fea246891319e678417b7f952c6f29e6b6a29016972b9963cb629a193045ca66e14efa822a596b051b5c8b7b1a29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7dd2fd48079acc6df0dec8f17c5912a5

SHA1
15a77ebc9405654b2fbf1b4b61985986bd7e92e5

SHA256
b1011e434cfa2aa520b2ebe3ae227b25052987b0e5f9b41c6cbeebf9f3d06669

SHA512
25509bbf925d3453cb22303f54b63f0443e722aa7b3dc81b02415c11bfb5514f2a28e45e0dae8cee4c4e919a646c045d402a1f95021456488abeff483c9d0940

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80f11efcc5000cf2a8160f8238163b0f

SHA1
61717ebf64525de044dad6fb6206696450fc89e9

SHA256
6d7b682f660e99da2e635b6bb7fb76716fbd1e448fa4d03baa41a1a34a232021

SHA512
04257f67d6c8f16dbb89afa748e05f3dfa4f085a1e1615861ee4461426b04dd356b05dc5b3c39ea6b98eb6f16bdaf0bbf29ab8076dc9fa21b1de4bf52c96bf14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90b443eb77d862f755f1045bad211e87

SHA1
deb64ff169060a29b61e8c22a452a72b095284bb

SHA256
26da2ff66469f1e7eccf9a2581a5a83f400edf0c4f9014e753cd4ecccaa02916

SHA512
0a01b2f564e142d4799dea308d76a22550fed14d895f5bea8e3b487dfe6fbb3eb423f870553b1b00504c0963d81f9834290d3e200cd26e3b0d2eb5d065efdbbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1891a06a861a19b878c4f1b94257670

SHA1
a8cb25810647c2e5976599b803c74d80f9109303

SHA256
17911925daf60c298c2e79738cc6ed560490f64a5d3e7938e9f17516d5692e8a

SHA512
dc523694ababe3d8bebf2780f5b43b496d542bba56c7ab4dab4ee162472f2d6036e333bffda5e3896df0ffbfed821d9aedbc3023942fe6deb7e5099271c57942

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f74924e26211b8a21bdde9cfa7643c2

SHA1
2639236d02a6b9440800c32ac5e6d4fe65451dc3

SHA256
898b45aeeec6b7a09cfd3b6693ab35bbfb5b8fc4394acd7492923f914da44b28

SHA512
0b3e3989f77bfe242150a6430e3129b202d0ee8a9da007bc29ec07cd7ab90082ea1171b67ef1282898771d1e6b3ec34b8c2518319febadc5abb102544f49a6b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5391943c1ecba7344d7600f4bb7e9164

SHA1
8fafb465bab016a762554e9ea173a7ccbbd7d9df

SHA256
00a55b2d5337888f0eb6707384ffe06f0c27a6ba8cb2bab4309655fce61d9c38

SHA512
24cbcb1123a9ace982f85c4bdbd247c3d2a1d7185e7994a3a4d5a283ba8b0b1c842b835cde0a207add4e1bd6439c722f1757147155d2f61354e85416786eeab8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6afe63c3edebd781782fce5cf556c65

SHA1
c5159e1620aaad70c28ecf672df7fa74e40742c6

SHA256
cf4cae0b7f365e5def1bb07614ff0c839629015a9af2e9488a930b16fe142697

SHA512
9fe8a750e1c9226b9ca469f4b1fbf976c7e91958747c34cab8d87cdb379576ea10c7ea32f3871eefa7a38c7ac64f8fdee567fa6f324b4a00a2e416f2191e58da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3939.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar39DA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit