61b3c469bda8283d6167cbdf8f0db412416b35cd35bac9f3f65e516896de5af3

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 09:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a644a528e69a94f26788c61c5f100f82_JaffaCakes118.html
Size

12KB
MD5

a644a528e69a94f26788c61c5f100f82
SHA1

b8c7a415eb3d9900067cf1909201d664c3addfcc
SHA256

61b3c469bda8283d6167cbdf8f0db412416b35cd35bac9f3f65e516896de5af3
SHA512

6690ca79d8ad6b66367aaa6ecd1cb3da3db7e6d7ca68bd5f7301ec795e0b15a0445ce1399120f856a5acf4b5439627a8033375d5598d1cf186529c4c5ff46343
SSDEEP

384:sHgW2atw2s2Vx+i2cW/qwmdptS/Hk23FZF1IAcjJzQItAtW3t6z5F:PW2atw2s2XP2cXs7FyBj6Iawgz5F

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430135657"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5936B9A1-5D45-11EF-A4F8-F6F033B50202} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2540	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2540	iexplore.exe
2540	iexplore.exe
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 2696	2540	iexplore.exe	29
PID 2540 wrote to memory of 2696	2540	iexplore.exe	29
PID 2540 wrote to memory of 2696	2540	iexplore.exe	29
PID 2540 wrote to memory of 2696	2540	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a644a528e69a94f26788c61c5f100f82_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2540 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a55dc857ebf28f539b83dbd10924d73

SHA1
852700b849f97b513a10e6f08f1c5b7fe14486f1

SHA256
39e0e4163e447fd9863e8db6cb4b83998ea885a7ec196d4432d860bec003589e

SHA512
6bf2b2b5416417610be6022547cead4483a399644a710d37c982e2fc0835b5b0de1e294bddd5b0c17e590d33cede1a0775c48ec3b9640702ab96448523d6c6ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
911003ef57e5fde174607a768cd0309a

SHA1
c87bdbd30207047cbad183119b40db681e3b6f21

SHA256
b07552e0a4f92f213432877f494f7822750f95d018da79fd994c9197040df70b

SHA512
bcc006331d3150c4ac2983212e400c78d6e1d6678ce105e93f4bf63950a29dfc6f1438d937df7279e94a45c1ab90819f34fe94d6bf55f97a3b475f2d0670ba2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b730672e790c4277a9b525748f9776b8

SHA1
d1f3ce21552edf322e6c88a8747a0638c40fb359

SHA256
2e6e70db30b331139226fbc13e20e20cce4497f9f207f02282aba36fb13979d2

SHA512
9feb73ab1919b05e3cc03a1751404b2ccf57c906ab55615ad25968ae3f85cdc418da94c9e4db577fa910838829f063c9ddd4145d74ea6241a9975922c356ee90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43226c2da0834034356fdfb41e82f4de

SHA1
be3569ea4ebd47e1c47d8e30faceb6c17ad94100

SHA256
ecc8685fce87d010b65a43d260509a30481df942d5fa1370203721e1609eb4c0

SHA512
7909e3be105039544c7fe3e9da368d4f2c8abaa1da7669be6e61823bf0b2434c181470a97de68c85fb9b77c10899211dc1fd0a01addf116cb047d03dcd717a67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0edcd9dcf17b10bed238dc63726ed54c

SHA1
917848b2c22645959e15d9da222f4f70bd06621b

SHA256
86ca348bb6590a3bc1bd4d7791f1faf57f64e748a110884f0496c325f8b6e7a9

SHA512
bf42be296922c356d17dd7ea2145dc46cbc35bc4ff0d399eeab5d24a6ceac8ce0430e887e8aec82f6e03b185219f7af10c62920a9762cb4d2ef48b4e08270868

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
328138ddfe1d0b8d2892566e5655ce99

SHA1
9f8f7bc29ac92e6d508ec6310c2b1f1fae60cf7b

SHA256
bdb0478e1f5bf32a6daa97077f0171e971b62b63ccec37f95dcde27725f4e2ad

SHA512
949265434b1ba44c97b6da219251cc3abdcf154e2c7af2f897a7d19ba54a58754db02fa223f6102b506ac1df1535e4a350b95eab0b5c7795c8b03137494ba149

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d18a53fe97f1e8cb179d210576f96c34

SHA1
56fe37d50b9df1e9f105b0951b6c43a97ecb8ab5

SHA256
4f4586409ba87901de0822bf73cfe4d28fd60343ae330010ccf5f1ce2377b4e3

SHA512
43204eb3dc5aff1997a80cd36584d7c4c51cc018e69f700936fca5878f52d68b84294f46b377494182d38e4fe7243131ea6bd7f6d333283a1c6675dda1090761

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aff4ab97275ab2b94a1d416bb301d48b

SHA1
c28233b8b4a75bd225404945353a78635548fff5

SHA256
3e83c36a81ddc0fe319bdb22cae8b3404c33f244281d1ade7c0397e785cecf45

SHA512
c63ced394f91a01a8c07f57dfd94fc62e4de08a9cdffa59027bc5be1d8bf22c1f26d9dbd2df16e7de83bb5493d943644d3252f4b43836c8393b4b109a44463c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17a0085278d1968c29595639d762d43f

SHA1
35e3dfa18fc108c480dc34e583579159adc965a9

SHA256
07c8f701960e9450c05def4ece45a908eae34d8449889f680daee2be1edbb5c5

SHA512
693384dfa8b8b865247c4867fd256b451cd146bac6406554a715c7a29a61fdf80a3c8014825f6259678adc75d20fcf7735efc22a2c987f57e6403809ca491927

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6204e71f8bbfd5947130a7965c1b34ca

SHA1
2661210a922ea50a135ad9ded71e2c5a7a260ba3

SHA256
c47a9ebc46bae7b8cc93d25036086f92f67a706f8f15846618a5143386372912

SHA512
a6dd8bd5c7b35ef41d0431bc27880e30b587dce3c855152ebfc89895b95955f830671210d9c2cd3c6b2cb1b0c4211e5ab4ca1c4a6fb06a6851261c625f49ea12

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDF78.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDF79.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit