5b017ee415bbec0504105e18c8d06c50f2a349dee2f2a7b535567629363b9381

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09-08-2024 23:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

840ca6eaf5058c0bc14d0db372cee211_JaffaCakes118.html
Size

13KB
MD5

840ca6eaf5058c0bc14d0db372cee211
SHA1

e404fc77018134e6b2b3b043bd68d87254f7a155
SHA256

5b017ee415bbec0504105e18c8d06c50f2a349dee2f2a7b535567629363b9381
SHA512

3f638f3bcd12587eb2980b0ece0c3f74cf259dfa4cdfcdddecda0755a29f2a0caaba7fa4af19a173160f6a93cbd5aa52cd1dbe59d9a45cb83a48cd57df3e44ad
SSDEEP

384:sKLlIcQVejK5/gukB7ZbnJUKx+0OmzguLZ:VwglpK6xLZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429409320"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3605D661-56AA-11EF-A372-5E92D6109A20} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2096	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2096	iexplore.exe
2096	iexplore.exe
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2100	2096	iexplore.exe	30
PID 2096 wrote to memory of 2100	2096	iexplore.exe	30
PID 2096 wrote to memory of 2100	2096	iexplore.exe	30
PID 2096 wrote to memory of 2100	2096	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\840ca6eaf5058c0bc14d0db372cee211_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2096 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2b83ea0f0bf052a5ae86f32e3cf5a2b

SHA1
ce50de1e6447c27f21dc617b9b4922ab17752791

SHA256
d594cbce0e4c3f3d71f2ade52a296f3030552af95637f1abfa4bf0680f5c3e3d

SHA512
8ff6c1d384c96894d4d24f7961d8c8f866a3516c5585ec99278a6d9baf263393ea43805f05bb0fd7f48998c70d580acd4efe3d5df4f3df81e9018245891c68ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b73044c6f89bd9c3a9d233636be9bc0

SHA1
cfd53fab85bdb7d18cd15079510926e239c002c6

SHA256
9c6710e8b09f2df6edb3bd549675d8b44918cf56d11c436ea8a655064a5c6b82

SHA512
4212a01a3f2f2a3a7ac0e6b5f5429207d71f2f25e98550e61c070fdf7eb3cb6c625c947cb85646d4a17d8991c9e904e030558b5dcd0c69bba705872ca0cf98e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a7ba07ddaae2e306cad710247fefc4e

SHA1
1078d95fb8bcf4528d2a91021dd12c3b3011835d

SHA256
9e859bc5ff5a74fd4f5b125cb0fa0089bbbdb446d47d5e28401981bba70fc422

SHA512
76af08f12dca562748afda224e4916b4e5057d30016935973b47a36b59ea47fccec006b1319b409650d19e7fcf10f5c32491014b55793c8f9de4603838dc212d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f67e0c68308c4a997b2a739a4b896696

SHA1
af8baa81c7787ba66c254637f1c96f8549b60f02

SHA256
b70a61f1b6eaff97d6d8eddf6858e5a509a696a8ceab3b18ad16080e0c3654bd

SHA512
dfa0efc27622fb2906dcd9d82a894383b03340822f2b5e46f86dfe4211d631283fc51fe4e1c77e8c373d7e93856a7267424d384002705572e0506c84e324c1b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ba446f968be011d618da593dd3d4e4f

SHA1
74f6134af081403e2015dc5815cb2ae86c3c0218

SHA256
7edb346bf0ad33e1539a1f46453802cbd2f70548c654fe993b86dc30478e6be7

SHA512
6da250c42099f12bdc9a2c88af6ed3a433bc29de8ecd56ec0634445b48e36f449699527aed1503193cea780a2c05f608ecedcaddec446b01854b2c850d2d8ac0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4be3f9a61c493e2dd60562c7a8b40476

SHA1
5daeefc6a157b87aacfe6fbb8f0e574fd5baf248

SHA256
686fbca97943e346f9c4c5319449df4968e056c164804b2c82152c72a4cfb4ae

SHA512
7bd7c128b5332025bed74cc9930d1bc759cdd9676981c079150f6a9184fe38f8fbab1553e54f71e0d6065247629affa0029a76a8f81c4387b45bcc033ea76d59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebf7c045e820f3828788aa40d2a26c85

SHA1
5a84792a40e45d4bb00fb4e9f7e3f24c5bd61869

SHA256
af6622bca2d080b9f8330f3f139e45d84d5e792c45bf0dd81a34291b7b8aef78

SHA512
a11d3e32d572799a15b748ccb36f832029047aee2476d51314af9da173b215f5827089bb5520952b2f0bf625fba2f04f1ad83fe5f30389a3d0d5d11d84281cc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57d064149b4ff6514b1fc588269b5627

SHA1
66f78a0ee1536f3bae9af538d317272e09a72f62

SHA256
7316b804b856378ed65005074376eb4042790bb028bdc2ce676430bafb0f0736

SHA512
a1e7109a5f81b22bad41c96029f377d7a1fa0deb199913d87d81c518644d833c5537f24fc93ad8231b9dfbe485c2ce6369b78c792a22b548324f3da618750c1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0d1cef4e62ab61ee0e9a1efef1764f1

SHA1
9a14c721a2ee81045ce614443dcfbaeed66a7bc4

SHA256
1c182ea3d3a84e2963f8d0f6616fa77f141205e7523a1f6b30666ea61f3a2772

SHA512
90fc857256b16ee1462cc5662563846cdb4642f73f1807211862275fb7bd22a5054e0c68d8665a3eb8ff57df321718b99217da3cf7ac63f9a38e5762920c897d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA8B0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA97E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit