387aaa4703c15988004b50e5a182064dbd7c40e64c438451e067e2ba097249a2

Analysis

max time kernel
130s
max time network
140s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 13:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

964ae35ca2f4cf276a70f57014ce5298_JaffaCakes118.html
Size

23KB
MD5

964ae35ca2f4cf276a70f57014ce5298
SHA1

cb8222acf14eafface157f0f81ed25177aa0e299
SHA256

387aaa4703c15988004b50e5a182064dbd7c40e64c438451e067e2ba097249a2
SHA512

8106f213bf64fe21b7bf7c4d6c5222065cae3a66913ca692051c7db89ae62c5c48eaf4e2d3d3d6750d3ca66301e03920e21a88ad0c3c8789fdba3be695b37057
SSDEEP

192:uWrIb5nIjaWnQjxn5Q/KnQie5NnRunQOkEntGInQTbnVnQvCnQt9wMBZqnYnQ7tv:IQ/PcG

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429804103"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{63138361-5A41-11EF-8A22-66D8C57E4E43} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2380	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2380	iexplore.exe
2380	iexplore.exe
1268	IEXPLORE.EXE
1268	IEXPLORE.EXE
1268	IEXPLORE.EXE
1268	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 1268	2380	iexplore.exe	30
PID 2380 wrote to memory of 1268	2380	iexplore.exe	30
PID 2380 wrote to memory of 1268	2380	iexplore.exe	30
PID 2380 wrote to memory of 1268	2380	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\964ae35ca2f4cf276a70f57014ce5298_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2380 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28bbee2d5e832d7aa7d9b996839a628b

SHA1
e5b83516639428f0f776d652d15d98a1e3d6e525

SHA256
20c70ea6401445d148ae46fb4d7a129e0fca4166a0386923e2acec70318ec009

SHA512
ba33d9aedf86fc079768b02185bb33deb242991ac1e7bda6d4ea926eac589222fd239c292b1ad60dacc6c31caf73cc1d61c5091f5e6e13ea4fecc8ea8179be77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8fef823f56efeb66877d79d8fbe0e82c

SHA1
bfca63672b4907e30875f2888d32e048c3f200a1

SHA256
b2b33ed1a53689980469edc7fe6ef8f1121a0d23c01559192a3f94d75ad091d1

SHA512
781602d5d2148cdde9bf8678fb4cf5313e44ab016aaf0838e42d467c9fdce912b926aa480d6e4f8532c36679c20fd0bec318635215d8f17cc193c8af7b5fedc8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
759e1b6d7800d6a0a079410c3d6adaea

SHA1
8e1114b4b3020b6878909d0afc639e3ebd709367

SHA256
5497dfded7b52177d18fd6c3365bd1e32a96bf4522968f0a22f159b6e5a6c061

SHA512
faf0b944ac1580f7f94beca2d73cefdd6336b0b9bbe77cb3aa4df1a14f829adbdb2ad146d94d7fc00f5043a182f63ad46e49179aa21d22b8ef8fa6ab26a8fb33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a648f2b1a9488aa0c17e5d842478c6f

SHA1
aee56498aa05c5b8b3aa2e47dc350cd3e4f2c3b8

SHA256
36de4b02f962f33d5aaf07918f17334661b47fe98cac5c58d5db96a7fe75a3f9

SHA512
3f1c1bde2e681372180c4fd31e26ae5c41db6bc6c533a370d78128745426da08491f1f2ef45391a1b055915572b23cdbc69c545f20d322e496f680b7451de3c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c94d8e308274fed630d231420317bdca

SHA1
d5d650b392268702daf9e854d35cf2f8c968d8ec

SHA256
0ff83052567df17795495c4ddbe6da9434ac8ab692f5772dfba362f91be925c0

SHA512
41c438b9f44fc0dab50e03129356688cbfb90e8f3a9ac95f5fcf91f2d8378cb6f5c3bc110cdd3dd8fec11155ff328c55f713f76e8088294d609d6f19695f82c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c127849b10779653da769a7563d2916

SHA1
d8605e218fe992b11910e19021e88e0976ca6236

SHA256
dd9d577bbccce3d37ebd761b0b2f0ac6971926a7cac967a2081c5cbbea799c96

SHA512
49a63f7336724cea10ebbb68a4a232fdcd11315fc921efc378026726b622b89280fa35b2fe6241dd3e066ad55c591f95066f1cf0702bd8c482fac6a02bcad6e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94e8e37c087ca1dce7f88cafd4f7ba34

SHA1
2adc3a131602899ddff564840690e034624d3744

SHA256
238f8c3ac7d42345768913d926400a59848109d2bbf58e4873243b19f64ce441

SHA512
b5720fa88ac93376f4a03bf179b2190570ad12919a4a6fa42d8b0c60b820777f43a6f13cb20c9b13aa44c71cffe948b2b45def7244e87e9762fa514e3efca826

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7cc309c32af96e68ac599095c1854df2

SHA1
87d5e8d2cf1cef49bc6538a94479a5a81293c911

SHA256
669bf98fed659ac3ddec5899ff37ff5b5197e97ba9182d900e46c53e6ceb2f8f

SHA512
6bbe1f9b0c515da5b0dcdb10f21ee878dd7af8044b38a07bf1e4fe3853c84c3ceced75972bf9664a7f50dc4d96ff35935230937272f0b4a1ca773d95e6f55025

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA035.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA22E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit