1e140fb9c7c8de8b036d1f0caf7e8330ad0758cd124da7153c085231f7b6967d

Analysis

max time kernel
117s
max time network
149s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17-08-2024 04:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a142e41a784fb86c58762ed93bbcbd2c_JaffaCakes118.html
Size

11KB
MD5

a142e41a784fb86c58762ed93bbcbd2c
SHA1

def2c4712f140f64a8ed126600fdab12510e9e73
SHA256

1e140fb9c7c8de8b036d1f0caf7e8330ad0758cd124da7153c085231f7b6967d
SHA512

fecdf7ff56cb98b94327df88df9ced44adc7c5a0ee2234ac45f00984df91cf7aeab3e05df832f8f34be5fea4c68ab926c5cd10952fc0252adf74b6b74b808926
SSDEEP

192:2ValIsr0r57M1x2T8//w1wvqa15LOXuBuLbdU8d:salIcIQ1xf/gg5LOXguLZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6037F171-5C54-11EF-A0B9-DECC44E0FF92} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430032161"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1264	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1264	iexplore.exe
1264	iexplore.exe
1016	IEXPLORE.EXE
1016	IEXPLORE.EXE
1016	IEXPLORE.EXE
1016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 1016	1264	iexplore.exe	30
PID 1264 wrote to memory of 1016	1264	iexplore.exe	30
PID 1264 wrote to memory of 1016	1264	iexplore.exe	30
PID 1264 wrote to memory of 1016	1264	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a142e41a784fb86c58762ed93bbcbd2c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1264 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fedaf25f503dcebd4240d95aff71726f

SHA1
ca2d039589b7a2c7d105b6cc500a7fde2fe502bc

SHA256
0c34d778b3f34296d614cf9f41fae5f3349002f5edbe993f5341a20f29261320

SHA512
d5718abfee7811268f133bcceac05e7ec7b16784d6ea22317168ec1eeb2cfddff26d4442237c913e71c3f9370109ac81defbbbc79d7d1f3abcf8d2eaccb1bc82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0bc7cc5107aa1c6ce219103c9c68f3b

SHA1
e9a8ff4ef3149cb50c04a45b692b1b9e48275a82

SHA256
c6b7450eb6fe88b3be50d8590b05e05ae6d003422485672f39df4ae4d31c83cc

SHA512
6503b487fcd588ab15eea2db62854b0e6f5df69f26f15ffdb1f112025602ba6b5030987932c6b79bf69c6ca681e3e36d142fcc4bcb388a6ddfc3f724d2e680ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fd045b0660932cf952f928403d07916

SHA1
61389072cde26d67021600d148ec47bf17f32989

SHA256
384f5ecdd87857a9609129a70898f0c8539bad09936cce785a620133fab8a8d3

SHA512
a428793f7fcc8ec938b2c5fa1d6837ab6c56c0add31e1ac09e340498f7b2ba4abf0a105f675a76647b52a11b6c07068051d5d0cb759680834a258ce6b5cf6525

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c4064b5748554a84e6f58a2aaaef466

SHA1
1dc76d2659aa25d3943314c0141c809be96577ca

SHA256
039d7c2ad06797bbbf741eda462e5045df62db5b127fdc6ef229792de7cf18a0

SHA512
a26d25d741a96d1c43f4a387d1c7f9b05bd5ae22d38582ed9d8890d9772df75deb6abcde90a98245559fa4456e8d4f591d53d1d76550093355ebdf798493edf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b9184a72d51b32ceb381969f01599f9

SHA1
0af81a5354239e6295880397cb3e3cdca50eb02d

SHA256
b891c0eab31ee0aa00e3c764fa0ba3112bd709447955413778a82aed13a00a97

SHA512
5a405d1fa7a7ffaec745f513474c5db058f3015d176ead0a90cb862e4b5371be28631c54ac82c5d5854da9c01a436c9f0020d131163b373fc322d58a8b42d344

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cadfbfe8585f969d90cd754b085cffe

SHA1
02f341d453f40e2d6598fe68816e7fce7be47b44

SHA256
06216d1a824e0ae9ec91af538446d3ffdc6ae8799839eb36a8bfbc81e8bb9edb

SHA512
d5148405a37ab31027b2e601e9978529ddd4d8e61e60f2ceec8a685e68e3c2437d1349f6f088b3ed5354d85267f0cff904b06793cda059b9ec08426eecf4da5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b834b981b7e1dd8bba930824b177fb40

SHA1
57ce95cc6b42cc78f55b11307e54c1d6bb564e96

SHA256
06ba599144f2fec6ffe81690e07eb927cca139bbdefd2b87c574ec50bf3821fc

SHA512
260465d4ec54acebf3f14f2c1905c8701fce57e0cb94c2ebec019ea9c087e5d6798315baec89300da1b7f6ebca357ac08f3c50c13a00b1d4cca5412384b4ecee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac1a10c47b691699c7b1c2eec22115ec

SHA1
f728b5afe486bebfba3fa802fb27024e5547209d

SHA256
69e256648a2b566f0535d632988db3a273d3a64f2c1e87c7441d3c7a70a0fbd6

SHA512
4a4fdc5b7951ec10c7df768b9438e5ccf2cf9556af26087d907a35463f56aac1a4a24fa5971bf53dcf0753d4d72502aec5cd0ca081a56e37bbd3ddcbf27ec52b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7353fdbed71fef9746343766f9015c2

SHA1
e1116c4673940d8bbc44ccc96b86567bedef9dc8

SHA256
9a0554c4fbc2ec5a9a2789c4342563ea3130693a2d30651a157f4b9a8a02e52f

SHA512
a9a79beda8d86641723601c9337555ac7fa9b6bee942b33c5f1b95f92b0eed6704fe245bb3044e3d722bfbfc06b37d45d3ef515161e9463e9a8384fd95078c57

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab97EE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar984E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit