446c3e4ec581560e3de5df343e84bf129b65dcb8f4fd124b903d1e3b63c9cb05

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
12/08/2024, 13:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ed3b848b0a0803d582dcaff20674de4_JaffaCakes118.html
Size

33KB
MD5

8ed3b848b0a0803d582dcaff20674de4
SHA1

cda686aed25c970a9d494d54812e0592dc201d2f
SHA256

446c3e4ec581560e3de5df343e84bf129b65dcb8f4fd124b903d1e3b63c9cb05
SHA512

d068c98f59ae07738a87cc3ea95b2411d336fc482a02c5b378be3eea4ab9e0dfcd99b18d0ba2c0cc4628c29566bf870d5a02b4c8de6ec5a7f61c93db18ac953e
SSDEEP

384:/5lIcWtm4dFGTHKtSl2Mtb9PsTG53nlowtjuWPkxSJSRsfzt/gvWaguLZ:YITnzlg+axLZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429629678"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4643D061-58AB-11EF-9628-7EC7239491A4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2488	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2488	iexplore.exe
2488	iexplore.exe
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE
2744	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2744	2488	iexplore.exe	30
PID 2488 wrote to memory of 2744	2488	iexplore.exe	30
PID 2488 wrote to memory of 2744	2488	iexplore.exe	30
PID 2488 wrote to memory of 2744	2488	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8ed3b848b0a0803d582dcaff20674de4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5074f0d6c226ab4c0b74495442164682

SHA1
c608ec3d608652b17479664f67c0e218b892e677

SHA256
8e0eb2c975e39bde61ee01c1cb37a1b79be8b23a08c31d520e30b458cbb208f5

SHA512
fd8c0a5c3ae13a61444db4f27352e5d734f71c116e09544b7b85907219e1aa0162440343a5103d03f21b1c49389d0ca31e74d5a2f804a9e6d7bfdc45bec6ec6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13715a0a89d25c2e7f076cf754673576

SHA1
1d3f3ec01ebe6d90ff4abd4aa7210b9260dc78d2

SHA256
f28b053eee69cb20df24338a38bd9e35e822e7dbd0f12cd1be643f345bb5fee7

SHA512
03df16b4cb1f0bc4723996401a6f87e2375657935c1ad5aebc5a152a9935163dbb015d5d53d359b6cc0db15895a175608cb5460452a36780c58a5de63e9a3b14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
139a2ba540bdf87c77bbdfddfa9b75bc

SHA1
3512dbea03e6a7467f9d987d25b31f79bc3bde34

SHA256
d7dbee2aa030dfd6042ab61addb977ef3ca238e94ad879f1fd20345ae37c978c

SHA512
7f92d769ee1df0639b451a94560b2fc2283a0d23453a77c230fd58ecf0661eca5006ebd16338939c466953137110b6126158378d48f8a6d2c25f74c75c9bcff9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6814303d79b833c7889897e3d9fd35a3

SHA1
2d36bd529dbca24e6d9f3c1b23c257796c581257

SHA256
9aef4ca47d1089de80743b58e048194a40abdcb79af7e2906040f8ae891d9d4e

SHA512
86d095a4af71aa8e56eb41c85225f409a012cd80c431cad42d9cc97a251a093f6741ad0b28ee28df4b909d54ee780c1ecfaf6741a37862d8f6e921ee7de25d04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17ec1e8faea0713fc701dd24ad4fc3b3

SHA1
73e899f4efc24fb52c581bc38b3aa6744cd0ce80

SHA256
73e3cbbcf5802d5ab92910414d22539ba4a7bc8e9da22d72183bbd9b6715e8b5

SHA512
1271fc3f8dcda059e04c1e1e9bbcbef70ad23d5832887e97942e0d848b8650ffde77298034f1b3cdc23ac56ee4f7e41ae86108cbee7582e2348c4b92077b8c52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4f2019f08c7ba94e14772ec6a9f8402

SHA1
403a84c1158f106fafe00ba23605a68fbcf51f1e

SHA256
6f073fdb4ff1db1941fb5eac7730be80b384f4debb98ad6e5a51e29be06aad54

SHA512
0935068f0bf791f0e6078d92747799c0d5a1f9f7455bc177daeb42e2f0638ce11655767f041cedda0392845ff4d9622262a8591ea73febba6dfadab798c18cae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5840dacf7bc13d27d4810eee575b472e

SHA1
1bc243c4d776508fd2f8d09d6cd61b88e371d630

SHA256
2a07e0db594a8b4ec55d0c41cdbb5b0987d27234a15895f758d3f85cfec00dcd

SHA512
7501a13f720fe10dd6a8b87226d5f6b4f14d1b767cc11bfa447b7d69d9be9f89bc77b571ec73f9e1838bbc45d928b21fcff061b430c70c6fd38998dc3cfbdba3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78d68cf20ce03ea047c9de1a5294dc4a

SHA1
f33ad487932fb5d6efea4b150a30e146b39c1e36

SHA256
55c57ee52c6ce66bd4aa6b8d6010951cb8fe633cdcfdadb6fb9689e5ecd8d4f6

SHA512
0d9bf505a1cc4112d85b495e1523a60b28a69e075cf9abd3c3f8cd197b518fa6ebc70a8317e7c7693d60d63fa5bb28c33a44e4c9c2a87a4e15cc7aca7afe2043

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5b817180157fc3736677f1d1f2ed9da

SHA1
520f8e87d940217a4f178e706d5ff0a78a80d2b5

SHA256
beb35d1dda2eecd0a26b8f9c9fcc10816fc6e908fe20e1c1d06513c0fbff0264

SHA512
018eed2e4df67852d35de3dc11a7d10cd28953df146e104ff79341da1ec8df04b4c7b09ff89f7ff4188c906caec9752100ded422bb8539b7edd5c9a49b2a07d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2500.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2570.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit