61ae66ac3d7df21836b327eaa9383b4b3223e5196fd37a4efba7447e4baa3ffc

Analysis

max time kernel
131s
max time network
141s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 22:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a86ed5404af54590a7ea86eca3199475_JaffaCakes118.html
Size

22KB
MD5

a86ed5404af54590a7ea86eca3199475
SHA1

bb935864587e4fdeb87ecf1ae26086e2c35cbdae
SHA256

61ae66ac3d7df21836b327eaa9383b4b3223e5196fd37a4efba7447e4baa3ffc
SHA512

3de29c822b7787641e961f78d476bb43aa51b8251e6fddcd63d6a0a528f4853821ee10de8719c71d9d72325851c63b751484bf1d0867e7b8a24309d8274ad382
SSDEEP

192:uwH5b5na1kJnQjxn5Q/gnQiebNn3nQOkEntMinQTbnlnQmSMxf5xHMB7qnYnQ7tR:KQ/sfx+I0m

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A0590FD1-5DAF-11EF-AD79-76B5B9884319} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430181304"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2608	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2608	iexplore.exe
2608	iexplore.exe
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 2316	2608	iexplore.exe	31
PID 2608 wrote to memory of 2316	2608	iexplore.exe	31
PID 2608 wrote to memory of 2316	2608	iexplore.exe	31
PID 2608 wrote to memory of 2316	2608	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a86ed5404af54590a7ea86eca3199475_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2608 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ce925812f65e8d343595adef8d2bc745

SHA1
571be9ea3e0187e17c84df491f516cd230d3f008

SHA256
06d62bb52de766aa320573b663821f021fb622118222169f8b544ae4059d07fa

SHA512
083aae81f7b953a8e506418b6d8cbcecd19ea4b134cdaa82c208c155801019d17e4ed4bf74521063c98f71869573130c6a8d286b649fbc90431ae928f9241a1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0152025de6f7ecd332a34fb946cd4120

SHA1
f87fea11f3f6967abe9f28903a8d14a5cbe0eff1

SHA256
13ad5ea32d776d6857ea469945f1c9bdaefe235940a02dcd59cb477624a9a14e

SHA512
bf4c85229693519e76b95ab590e6ac7132cbbd5bd126005992653bf9e6f993886b0b8979c99930b5434c769c8c750bfe0683a0e79d9591bfbba2883a80e8c02d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7795428ec3d0a4c5471734a667d3baac

SHA1
aecb061cb5f8b94f34a3a463d473b033b1f3de9a

SHA256
9dd22a5fd1641734d15e3536f751798fc5e4f64936bd0595c8e11648da0056ac

SHA512
fe7a0c7b976e65652851005f8021560312ea1bd1e70bb217db1417338d4ceae50d3b0399a9fc7426150b3abb527ca9109a8d3fca24e4501f79193e08aad2cb97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
236a98d29a9cecb7224e9d767ff4d34f

SHA1
600c6b248514a4124d7ffb56444eac691d53205d

SHA256
03385016d2732f4d02dc363c984b239371c1102e43468f66c38816abbc76dd96

SHA512
1e47d637ca21e953b12e37678d5629f6134be01817363dd817b17f70c3b57851fa0ee42037c61c7b8936488534282b638b23b55569914aa350c862cdcbfbb48c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
45d9e6c07c743d544e3b50138325d0f5

SHA1
c044ca966fa2de719bc584a3ac3421237f38e0ab

SHA256
ec8e24560f94cbf391727e8d575ac1a3beeb91b019c61337722156e78d54811d

SHA512
c26dc5769f341975b7d6322b8bc9ffdbeac81951cc5119410d4d1e48532d82235bbdb3c0a45339ff1dbf0fb23a46d3602e3bd7b4f6165b9f6beb4d5ecf61a4a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
089b9dbcf9c57fe761b72a6b4181cfe3

SHA1
a9e4608218e1c3dabe41b8e96dd36b47577ab2bb

SHA256
76ad244c04b211ce0d933a4fa1df597c45c677c3d56db9063233219bb1ff6d41

SHA512
e3052174c39c5f047a1f17ef345e82c49defccf5e658af6a700c06075e175b9345acdb45c9aa264b24d246a390c61c142acbce0315a8678b92a2df69d9b29868

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
19084e9bec7012bb8abc2579df9f90b6

SHA1
bf337eb7248c46ebcbe10d12a85ea0ac4d407193

SHA256
73b300bd3a9eee08f35ebc20c983910f02d2c7b1bb1532e8c7867a745ac2e9b0

SHA512
6193eef81933e7b7e5e2b365c037e646d47f0277049bc15648e25773d5ddd56bee3cbe0fd0bad96dc02ca4614c0dafe38b15311c2645d692621aa45b2f18a6ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a4a3173075b987b9693d0ed01384fc63

SHA1
46750f1f9fb7630da1de4c329e3097f48d20d772

SHA256
f5f64d90d9635cf06354574352542e669f09a8ad8f6ec31045aac297d7a029e5

SHA512
b0e676398bd95a57c672ce5f4f668194861a91c3883a79ae7139ac5d2a7d4f59dbe125d9d162172d83240dbdf16a0466bae9d8dabcad83a77e1f54a6f0fb5e0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b3ec20edb5d75d664b13ecb35e50b082

SHA1
1f1ab1d6fbd1daa37ace36f94a6da404797685b7

SHA256
ccc49ed0866b6d457b972503d832f40e01d805d74b989ab1d0790d1144ab6bbc

SHA512
d3b8eb1ee969f47d6dc99f46ebf40fa77df061906b6905d6fe0d85f0428262a60a3ed7d173024c4d67bdbab0352016855957cf49fab43e74c0d765c9fa3cb017

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD22F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD2DE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit