14ec1d4c323f1ea7bf89c00d34207eef6e96268646d42e24a9ae8202c049096c

Analysis

max time kernel
146s
max time network
151s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 18:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3b299bb877afb59a62e59d642fe61f3_JaffaCakes118.html
Size

18KB
MD5

a3b299bb877afb59a62e59d642fe61f3
SHA1

6c2a4e1d93bd10232a208894cadba0cc603c9744
SHA256

14ec1d4c323f1ea7bf89c00d34207eef6e96268646d42e24a9ae8202c049096c
SHA512

74311637663bb3b58f213031a8fbf1b917ce16e77c45c798fde82e4b7757bab00c8543e18e648a5cc914add13179f80674366e8775b9ff710532d43f5ffe4b85
SSDEEP

384:cwLbz/QHun8h5tC3LfEhihfoaBxfJ8xGJ8xPhdXJ8xZJ8xxhd:jgl

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430082128"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B6E60061-5CC8-11EF-B9F0-E28DDE128E91} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2324	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2324	iexplore.exe
2324	iexplore.exe
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2848	2324	iexplore.exe	28
PID 2324 wrote to memory of 2848	2324	iexplore.exe	28
PID 2324 wrote to memory of 2848	2324	iexplore.exe	28
PID 2324 wrote to memory of 2848	2324	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a3b299bb877afb59a62e59d642fe61f3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2324 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a858939bf3c239c597ab992a0ca6605

SHA1
672af754a425f6b0efdd049e1fdff2cac9c8379a

SHA256
15175991d7194b2bf660584c4d06c5ce53505ae0e02d542de1c39cd1458e4282

SHA512
0af54bb55659b883c8ba55aec0bbb458fa9de45e4c80cd12d518a0af28c6ce83089159a711615d403f26231a440ff32e171ed2b22bc3fa39f0477a8c3fb1b41a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0aba0c93a62abb03cb0eaa8ec6c4935a

SHA1
2228a3f53df22e34683000445216a596f03a8a76

SHA256
35d4e2132aa756e1de2eb6ec5a699aacf39e72397579038f9644c2ad4fcd7963

SHA512
d94b9e92398000eb440043246f7167ceb227ee87987defb8e1fa98152691ebc9c3940b171144b788efba2ad842fe85d7d7ff4cf9a8915413f708012bab32b852

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6876827625600cadd2b6042fb0323dd

SHA1
83436fb1a68d73a168ac829adc736fc5a73158aa

SHA256
2e113ea2a2332f2081705861d6add209e8d4aa080d3874cd3a9c31c7569b441b

SHA512
a7e11e3eff60f568024542b2b3843567523c3a348fd47787771b6b6eea179c777ca57436f9ffec0f2d3fec1ea59cdc7eafacde5f15b4a7c0448570cd4d27a01e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6316f29966f7ea6ac2ada8189eed48d9

SHA1
13c919e16625f3cf9e9d1831ef4a49ab7440c5a1

SHA256
2a7257b6e2adbd2374893c2680c6a9db474bfd8b433cf92fc09f572ce31707b6

SHA512
0a80f6caa2b8210429994d86735a5b25d390922ceb4fb3b5b683faf053cb836e0e9e33aa83a9ee3f03b789a6d84bc3750e6d9cdadfd7df276dc030b337c2b5ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
caa6f251bab44314341ec2f40914d393

SHA1
74fbd2b77a0fdc7df3eb09185b0232bdb72caea0

SHA256
b2a33006cae3891bcb0ca50fe315a19cc34af0513e8beffa7fbd268719b27978

SHA512
822be969b45db70409cec54b2e6ea94e3c945b5a94db7e0c661d6803a5b3942f89a70130b34292574f3f2714501b5a0017992b9b34909fb8866a1e465de94123

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24ebc3510b14ba4f349635c143890ac9

SHA1
209632a787d88a504af08f8abd694fff5a404baa

SHA256
e30fce6edda370f5f2dfd5a24bb28572ba22ffe7fe02825cdb1c01da06a8d09c

SHA512
8204337661b32112c35e99bae5553fc74c0940b44332badecb5cc11dfe8fdec5136bf769c7d6202f1bfa59ccbb7c0cdb81777ffe1768bdb26c1e2bc7f0fa5d53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21bc6964fd1fe164edca6c816d714eb2

SHA1
ce0583e34f68aae90964331804b4238da93a677b

SHA256
7bd41b6ef7521dcd49fccc7fd35cf19e52af9b3c153aaadbe15ed01aef4b4966

SHA512
4d85415ca8a321d32611420062b87d7cb6dc521742a9ddf3ffa10f7ac1c975de5f8e62311881a998b04a75019e4f6b692fd45d550734a8ac62557b0148acec83

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB0F7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB2A2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit