ffe02d08cd3a4cfad37a7314f33d61a87495fc22693242e2f36ed5412707ca1b

General

Target

8d4a6e12265528eee7366cde0a027b1f_JaffaCakes118.html
Size

19KB
MD5

8d4a6e12265528eee7366cde0a027b1f
SHA1

453439c623d87d1a985c303d640e47481644f648
SHA256

ffe02d08cd3a4cfad37a7314f33d61a87495fc22693242e2f36ed5412707ca1b
SHA512

9468bc8db659a0c562e6f462dfff283b09378b5f23fa318c85812c4caced0ebbba25d6c6eef3ac158ec0f44efd5d9c9fff63afcb5465de9e6662c60a4a69bf99
SSDEEP

384:rklIc0Vptb4MxsGTH/rgaAC/N6Z8F/gbJaguLZ:b089glaxLZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F97FA9A1-5861-11EF-9CD8-667598992E52} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429598209"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1488	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1488	iexplore.exe
1488	iexplore.exe
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 2472	1488	iexplore.exe	30
PID 1488 wrote to memory of 2472	1488	iexplore.exe	30
PID 1488 wrote to memory of 2472	1488	iexplore.exe	30
PID 1488 wrote to memory of 2472	1488	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8d4a6e12265528eee7366cde0a027b1f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1488 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d21b421247c7d637866f23c78dba4482

SHA1
b64bd637606a26e39194f791a8ef0f092b4f58d0

SHA256
b046caf1cfb671cf6606d433a6115397a80a1077ce7d9f8cb6a66272a2aef7bb

SHA512
8d76333a140796c17f203ed477e8deacd6d4c5e2edc5bbf73945052b6631ebbd299f6f39c44529373c539786a0a469f9f645316d501795b41d6818e2488f9859

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
47ac1435188b1c01b2cea3b049ca1d1c

SHA1
274073d3bd17d2b63e7c7368bf4773867737bb60

SHA256
8f3ec072bd6ce53a64b44825dda5a1041bfe463b9a720ca61d96e5b61b223705

SHA512
d54d1f7f85eca7b068f3bf984eb86fbafcac24264029d59bfda5df1a3c604210c165b5f172422dbed58031bfab4a78827c8ae9cb540a945042d09ed089fa78a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ca0a4dea415aff6db4249c5f66b4a674

SHA1
1b8201546329f368810767985cbe1a42a847f161

SHA256
6743596426a01fd8c2bbc20f345fb752374bfac0d9a3033133846559580869fa

SHA512
235dc0249527f3ba9599bcfda3377e8552abd8f0d5c70829893e6744a4d8b1e7257fc8dfef34b790379d39e30d9ac28b288c9049d3e38d306e4ec1db0957e45a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
49b43d3a9e44c8db1ca8aa3e85bfc921

SHA1
bfec02a9f0d53e2924754739b6ffb539691198d4

SHA256
d17d53800b2385023158efdb6460226965f8bd9871cba200badd10f0d9eb6bec

SHA512
117b891dbbf9818095375039f07fd9ac62c359e4ab9de33487ebd463ee8da47a6d95090d3812a997f0d125c72e2c889f94e7ac98636ef4154290e3905ac76b4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
741aa7e95092d235c8772f09a8dab1fe

SHA1
a8c027c6ab660555efa70526c0856786b9c381a7

SHA256
c14d7590006e6454251910d1c522f24b1a7f806b44b6b2db6f73be5ba38d54d9

SHA512
fe61fe35c8704c42dc2a64505494ad0de8d86b84952783643d68dcd6e9dcbfa2be0202403d46cea2f2c1ea5997178e43b8058778cfefa4ed22fa6b4ab867d529

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5dd51192dbfcf101ebf595fbf4d1b6ad

SHA1
4e0e5cd2bcf0349d2c1d893da1a0a9a22b169644

SHA256
752a934ee26f237a322ba059a3df580c412ce8a41d328a4d060c0e46ae412891

SHA512
31b59bd007e36f2743af980f43e1c06b77c3833e359824cb6871e927a21d2f38b3800755e04c103c15321c194e307ba32e6510f9c008d9370ec8d752bdf21c1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE1E7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE297.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit

Analysis

Sharing