61af18e2193c453464aba9f9e3cb368a346c15416ff7d8dfdd1beec214fb1acc

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01/08/2024, 22:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81fcaee1adcac2dcd26728714eaa16fc_JaffaCakes118.html
Size

34KB
MD5

81fcaee1adcac2dcd26728714eaa16fc
SHA1

6f42312f54deafb9505205e2ac274ed55ed9411d
SHA256

61af18e2193c453464aba9f9e3cb368a346c15416ff7d8dfdd1beec214fb1acc
SHA512

42126678c257983c54e636f7dd32a002e5304fc10e8a1c53a85b2608ae9faf0353994a4de772fd708119355465f7f5dc46e5fc09f6ee914034518108a3db1cdd
SSDEEP

192:uwTlb5nEHqCnQjxn5Q/6nQieRNnMnQOkEnti0nQTbnVnQOgecwqYrcwqYccwqYQm:hQ/V8vK5rwnVx1u1AYM3mFc

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AB9B2341-5055-11EF-96E9-6E739D7B0BBB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428713302"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2240	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2240	iexplore.exe
2240	iexplore.exe
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2824	2240	iexplore.exe	30
PID 2240 wrote to memory of 2824	2240	iexplore.exe	30
PID 2240 wrote to memory of 2824	2240	iexplore.exe	30
PID 2240 wrote to memory of 2824	2240	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\81fcaee1adcac2dcd26728714eaa16fc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba2114cf19a8fc3fa3b8b3b44c48e7c0

SHA1
ff332bda8988c0aa4d8f9cc585e4270ca6cb557f

SHA256
1076a19802da827287890b7dace26efcdc101374aa1301154df059d42542e330

SHA512
59b244100a3041965876123c80e35b7d3fb3a331f7409fdbcdd897152d85269ed41a2b0e8511c0dfb6fdaae90d37a97baa89213ba6e77e42f93d81b263e08821

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cdab3b2e7146455f2b8cdc8d413ab0e4

SHA1
92126a952bbb1a5286755327bf0e7732783f59b7

SHA256
ab3b3fd77ec255fe6e05ec9f3288f675cf4abafd84fa8d36d80e58c5405e8d42

SHA512
d174c52929c7a139c81fcc4da41e6ea93d419e29c8f8bc69a037c9f0dad98818a72ecf26c4bf7747c6ae0e237889f136b876242d75b53669c28fe1d1c5fb1198

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23dc26fbb0f1c76d86744ade44caa0d4

SHA1
be3011208c0b8d35fec6169322e18bca10a00197

SHA256
9b723d67b2ff348aea4e25607b61860fe0b50a6be78532d1935244fad10bdc4a

SHA512
5d4695dfa3f261daab3eeb0f5b4f450e289b44d7031fe118eaefe9b9adcfb8dea718d6b12abc633ba8af720c83836bcfb96c3bebbff44a6b70bf1dee4ca3ede4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87da3b3d215b183b4fdeed1502f3d5fc

SHA1
526d3091da8705899eba5073da80315417ca96a7

SHA256
061b49c75424d3383284811818e3bf33abfad1ddc7aed796e23f08bf7c129979

SHA512
d7da34577695f92ef9695f719f3e5026f0d53d0c1e8ae27173b395fba9163251e6bf90232c28afc71d302f311aec116dca50b4e1929f77a19a1d42b5f94af546

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
645058087cadd5c44ddbbf4c8ea84fb3

SHA1
9575bc2ef3014ea8425d897a02fdee0d675cca8c

SHA256
1429eeace2505fba87d272fbb163c044c63042434129c325482e8e80fee68720

SHA512
1502169da6ba5ba2524413471359ee3161146a9b6225b9e60bd0c8db218574015a9db7355ccef4f20657a41cd1607dc5019d5cca11684cdf32e3d5ab202e95bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9179c6aa7b542933eccf2667ceb3d7b7

SHA1
1ab26c934d4ff414f0ac6c40e1c4fafc7ea44739

SHA256
2bdfc230e3df08d8e9301a9089e2a0bfafc6957eafeb223896ddab39e6ccba76

SHA512
c106b0986f6f534587a3c5a1966d387f160578dd0e327ff5f539bb5e6de6da63d755e4de494b49cfbb542ae89be93c7e550b7a06ae37b879f657db6a0e057549

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
870fd55f8737b97b89261ded7993b4a9

SHA1
3800f3f0830d2e77d4779c1b826c4f315b950491

SHA256
4212fb5d13a2ea29eb30cd493c967261e09e862fa5c9acb04bbb9b7f239e6a82

SHA512
bab3edbe74952d4db9d0ac2e55ee62e339cb70855aa7cfb0219e0fb851cb027bef77d61501084669c65fe4c5b9d9bab9f4df2fb6582b6791019d0fafa2784fcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2bdbcd701ca4399befde90a45af5f63

SHA1
6d21c0be7b45f0bdc09285bf55dd1c98d52a465d

SHA256
79f63f0357e3934268799b182a0d0845e8b41ec766bf1cf81ddd724e3d4eb881

SHA512
4ec61daacf7da23b1b2eba6d72bde584077c5d62ac10c7fc538337be01541c29ded2e84072fac758b076532ee741a66f14cf7a8e3d5fc1a873c56cf3789e0cc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66dab6e2510f711e7cc142b2beefa82f

SHA1
c105baa8aea9c2976fa130ecb64e8c69343b1942

SHA256
1352967e4137cf6c446c4c9ca2e9c9637b8db54a7dcc6cfdacdc2ee9f04bbfea

SHA512
b630f67f029cec7d61fe2a2ac115ba4db6b374f9ead7f397795a08d5927c19122411794a09b5c7b2fa440b1d9c9257c6b743ae2a20b42a5db23ac793e14ee0a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7A41.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7AA1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit