96d043d8ce33bb2458400036041f19b8e5b5bfcfb87a9c11f493c4b4c2d69466

Analysis

max time kernel
143s
max time network
150s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/08/2024, 23:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83eb5d1f1a7fcbfae236ffb5a4bb5c3d_JaffaCakes118.html
Size

17KB
MD5

83eb5d1f1a7fcbfae236ffb5a4bb5c3d
SHA1

93c0f1fb0ea3d3475a0422c1c4f8a7b865316b37
SHA256

96d043d8ce33bb2458400036041f19b8e5b5bfcfb87a9c11f493c4b4c2d69466
SHA512

11588e74c711eff4cf63f62386799a86ae1fc8dc48bf4ad2d0d5e9ad50ef633be5f50fe52be9d06f9250f63ccb36f9a2b5987716d442066bf4c5faaeb6cc07a8
SSDEEP

192:2CqlIsraqn+1t44F/luGTH/Cd7A9Ss0dBq98k/w1wvqP1BLOXuBuLbdU8d:3qlIc+t44lluGTH/9Sskg/gbBLOXguLZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5B936BA1-56A4-11EF-AD79-76B5B9884319} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429406806"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2608	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2608	iexplore.exe
2608	iexplore.exe
316	IEXPLORE.EXE
316	IEXPLORE.EXE
316	IEXPLORE.EXE
316	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 316	2608	iexplore.exe	31
PID 2608 wrote to memory of 316	2608	iexplore.exe	31
PID 2608 wrote to memory of 316	2608	iexplore.exe	31
PID 2608 wrote to memory of 316	2608	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\83eb5d1f1a7fcbfae236ffb5a4bb5c3d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2608 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
bfcfed559f12c93cf06ed2eac49a53ed

SHA1
bc9031f33d313f0920e8edbcf4015d70240db96c

SHA256
2ab08e0ef1e60c95598b2c8cd4507deac06eeb282082d4b94f2772b56cecb448

SHA512
527b349c0bf431b40c091379c69a51c78d4540d398d46759aa90676d3e7f4ea209de0282d58249aa3a39713c2f5dcdd6ef11b2cc2af070992c498b28f03fc598

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a5408a6e71a231d4a8171256b3fb160c

SHA1
680e17b376de413d55357d895aee5aa07da2bee4

SHA256
194dc6bd12fcf4ce93b0736f629523907c07bccc935213631eec84dd68811f0b

SHA512
6354fa960fe3e0c4e4487ca7254185284163b9e75781b19bf92707a87fd8b79855dc653e2209432c659393f8d4ee52b3f576fae00af3fbaea1e6fa88e59ada75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e2dcf6537d2356065fb412b9be8d807d

SHA1
a24bd17b6a10e1cf460637014d382aa1c3c55248

SHA256
0e92e44b64ab6890fef07bc5acbd5025072ba2313633c9e9e2b5b8928ec9f76f

SHA512
57a02452e5064bf89d4e4b0479eae21bba6579736321f57d43722207e41ea7c5ac8595fc56baa6973252bb06c7bf49f7ab5bb27bb47802289f98cb1e73417aff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
96cc6284a037cce90e2f67e0ae2f66d3

SHA1
0587323ff5c1a1c1a43413693d31423a0cadbf7c

SHA256
1f500d6db432c287c18de49bc244104ad75bc6fae4a636dcc73824a046629831

SHA512
bb4bdce90f51fad4d8fd5cd4e5f0958eb8fd632dd8eff16206c0bb76dcff9b3375fde5880b4db9c39054fd72dcb47961688d3ea28467d41c2cfded6cd61734c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b6ca636bba251c5dacdaacca90b2226c

SHA1
88adfabf082ce7959bdbfc5839ca10b944a2cf16

SHA256
a67bd93cc47b7214e53d54cefd3682ec2e1e1a44e7fa99f3a303da7536896885

SHA512
587253304f3a09192e10861a8ba705728488cc9a41d4f32a2bd15b52d509e950f879719952085889ded749c712bd1409690fb088b63ab09a9cecfc5ba8e2bb38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
23f41f85e96288cd16da0981ed8044ed

SHA1
a5d9cc226c0f30c6811a241a125121e5f3252b06

SHA256
4053b65225ea0b910630348cd1f97b36ba78cb77172a14c4838639888c7fb681

SHA512
fef815666fb401969b199e23828f7edea35b27b42f6e74b9685dad7ab09acb1789d5bda11205194fe00de9195760f2c01a18927311519c64fa53e1a22bb4c8e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
8f8e020271b7a6a112242f3dde967844

SHA1
74e7cf3fe37236aa55510855af4bff9588e4cfbb

SHA256
b57498edb705b4c54f15fe94def2a0e263ea2d398e2289adce251ce395ad2bdc

SHA512
80ef7f28106c3b49fd59ed41abc17594c37dc349effbd05e15bf2038407ecfa6986bce30ddc241fa7b1af7928d206527d3235c0c20f9bf2cfc08a1a57b648d01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e46f5530570bb2270f4a51b26c25a7df

SHA1
e7133a136b0a0030b69e34463a11d478915c454c

SHA256
b498c216adc589059e0220a36cd71e6ec56248c2016f92739fb9493f5e1c0361

SHA512
fd068ac14ac64c5ff807b2d407d91e2bff6805d2e087168f6d7df41ad714550b507ee6aaabbc5e6c87acedee438aa73daa6e6a6c59a176e7ee9b1751c0933dbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
fc79faf757d575b8d7819df23f7ab4da

SHA1
b847c4f936476de8f781604793ffe59dbb83ac10

SHA256
2c2f96c85554a6354e6dd8c7077918fbea4768032b9beb0a9bb1cfe884bcb3d1

SHA512
bf67ff98927a1a0da756dc40f8a52f635a469e993af125dfa93cff7c937c90038eb7fe39becdbb2187f4b59104c7966ad9a13820598426630f82ad6a8567087f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD29D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD35C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit