490e3a064f984f450539f0036263357f8ff55b677f2a527f1aa85250aa431bc9

Analysis

max time kernel
131s
max time network
141s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 05:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

893c9dabb19c73fc956013b8514ca706_JaffaCakes118.html
Size

31KB
MD5

893c9dabb19c73fc956013b8514ca706
SHA1

2321d5664aad1582e63f07556afaa0d8a7498233
SHA256

490e3a064f984f450539f0036263357f8ff55b677f2a527f1aa85250aa431bc9
SHA512

77545449605fd7f82407da14ce6a17e70d4d8104cbf5abe02ad14890a227b75c7d1e6998e91ef60b354f519a12bc509ae0d8479a813318a90fed1bf62d35337e
SSDEEP

192:VWCk3GDG7GSFGNGeWqGUpGtqhybOb5n74tonQjxn5Q/PnQieGNnEnQOkEnt1ZnQe:ACk3GDG7GaGNG9qG8GtrQ/VWS7EQ/jG

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429517386"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D25EF6D1-57A5-11EF-BC8E-E6140BA5C80C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2088	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2088	iexplore.exe
2088	iexplore.exe
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2304	2088	iexplore.exe	30
PID 2088 wrote to memory of 2304	2088	iexplore.exe	30
PID 2088 wrote to memory of 2304	2088	iexplore.exe	30
PID 2088 wrote to memory of 2304	2088	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\893c9dabb19c73fc956013b8514ca706_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1edde443e34e9573109146a96033e271

SHA1
8add0307a2a357ab5efc483f172ebe4669b1d255

SHA256
20cfc19996fbc6fd72dd9dd8fd2ea5a2b7e01c1dc25d00cebd77fdd283ea2df3

SHA512
3522d6c3131956e6a359512e7217b61c8a2ad6cd1f1ac53c6dc6b90800f52176f37a90fe294f286a66cb7cb499efda4cfac0d65aded74f3173623fc3c65b8d22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e00b88e5fe28f7f2ab23c744327d794d

SHA1
69efb529d2e9a7ea9d67738fc8ea0e052b5ea617

SHA256
5270c0d0ccb60da1afe2968fe662df492f4c44ded55ba3be102af3b385ebafca

SHA512
629d35373fe4d9e0d562088b089c0331cd845bc71c55fa0081652ea46fe780091c15fc6650780c645f4a969248d0450672b246eef47b5984332257927f4627d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
659767bd387f33cf5e978782773e5340

SHA1
1442e26a0b45a5c7cc116e8a2b8b6ea181e0ae6a

SHA256
147cab06cfa356f7514a15f5ed19890d849f0109d8104163263e9593ed8d948c

SHA512
6921e12c0ab5eb5927489890cc34518e9fd90e193488b09ac43bd2c261554176bb5ee8dff3ace601d152e8c6f5063bb9a6cbd6e23e1ee150b349a6d0ca69f4e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d089ab58e5eb9a3b6df850cf30d1eef1

SHA1
9df8afd9d6900a8db171ec42611473e8ce6e3dce

SHA256
56b9e40220f7cd4f902fc8d8d0ac7a30281d165d763056e4f342518395b98cca

SHA512
872504b29d5f69d5786beb3bf689ca4b68246d2713d3a2653ac1d655def97bbed9bc9f4223a4f81ab4c702d796ea90872664f0f742216d73f1e09837aa7aa32b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b7f32ef170a45f13d72b5196e62bd8d

SHA1
18a7cd7f5da9affef6064cc32bb4484329fcc84d

SHA256
c88ba38c86ed1d5db5ad069280af9673216ace3f404313a270c8fac7cdbe95d9

SHA512
455c003fe05bbfed46ce41afd92b551c6784ae3033efcc0baac30719266dabfd1f53eed2900725ca68dd25bd2e46b7255d02f57edf70983567bce6a93c920ddc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8126877484d03f7a00e10145711c26fd

SHA1
884cedb7bbffeeb65d6794341b706aa1ed72979e

SHA256
e29bfe228af687ee7cd793649fc594ff487c449363666c572d0dc92c4fce24e9

SHA512
81363ff62a82b51d9d0f572496f964073e872eb783881273319c782b7f08ac1ce32c9cbea79b40ada6aab5dd86d397554a42f011fb21198f2e628cd55d2fda31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a6eb92e4f1bba3e56404fe9b7c837c4

SHA1
fc94350be441a074b027bc58292f6ff6a87bd511

SHA256
504f4f9ead3620b9352a55107c781f5bb4503c389922cc0c3a2ba2d9f2b77188

SHA512
7d123d238820d35510b46999f75bfcbecaeed8024c042ec28783916f99d4dd6263b68f93021eef95513df24dd13bb9feea121e4a5895035f7d4a14aa160f4749

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d210d3ecc636251062fc62a4065bb94d

SHA1
ce551a54da5281b78536c098ad6681f1cf7a6520

SHA256
d634d92400675dabc8fea23c34d0b981238ef308f9f150920c246984dc5ce39e

SHA512
08bf877a0285fa12b921bc9a11d6dc778a93400dcbf25ca27f031656c30a29eee58cf27200c4c0b3662006fae11ae18633685a60817343e7a5b01f0a16860782

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c974fb8aae9254946f44f52cbfa26e2

SHA1
e7d829e6eac04e00bb18a34ab22b16dc89534c4b

SHA256
93e113830cb9ac0ec8144f9664715e786aa2c37f3a50b0a5656bfe89d6bddb20

SHA512
7b45c21a9b44ebb7862f8b50807f65919cc6cae64b65f19be3ba0325dedec3149a37811de886f378f7284ed182847fc69e7413208c7576216f6f83b6b5a573a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB6B4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB724.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit