e08b3f614a7e59af69115e98fffafb5544586311b0cd6a4e40ad46c115a77c8c

Analysis

max time kernel
134s
max time network
141s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18-08-2024 13:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a6e6d243097c3c1f922957774851ec7b_JaffaCakes118.html
Size

48KB
MD5

a6e6d243097c3c1f922957774851ec7b
SHA1

1c2decd1a1d40c269e6f050db78c81127601f9b3
SHA256

e08b3f614a7e59af69115e98fffafb5544586311b0cd6a4e40ad46c115a77c8c
SHA512

f87562b69a136b029892fef9e6c87ba5fb3388ec2cc35d2817618c1ebdc76c334b6a51a8b518d792de3f96860ab403041813f2eee8216cdfd4284c988ab80cef
SSDEEP

768:OVza/PMS3xfuxBsRR1OuqKQcYqcZ4iIepLNBuBGj/fYz6:Oc/PMSBfux2RR1dIcYqg4i9pDoz6

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E2AB5561-5D68-11EF-A207-6A2ECC9B5790} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430150923"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2360	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2360	iexplore.exe
2360	iexplore.exe
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2536	2360	iexplore.exe	30
PID 2360 wrote to memory of 2536	2360	iexplore.exe	30
PID 2360 wrote to memory of 2536	2360	iexplore.exe	30
PID 2360 wrote to memory of 2536	2360	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a6e6d243097c3c1f922957774851ec7b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
592208b694265e9e15fafca80df9cab5

SHA1
046f0d20e4583302658291975a2d3da59f28a613

SHA256
f2fc0f149e5e9a830271d2e2928ec3804b088b7c2718a4ae16208c677839e0fe

SHA512
2b2ae14e5b00c2412eb6e70980a40e691ca62bf42acb563383c3d7793aaf4dcd083b16d03c26f2e212f5b28e9a9db5202241ebd3814448eed76a3870740f0fe6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73a015e4a582889d69cf29e79b274a74

SHA1
fb9c87ef20165fcaee357291e20772447dc1db5b

SHA256
1ec18871f9531419f614fbbea3f818044117787c2a665d638ebbf34e7fcc4364

SHA512
374cee0719b94ad2ba5fb736bc609712b92c4e0bc346cf8eb14db7cb5fe2fffaebe735b7a14c685b3655fe2fcba058eda63fefc392245e51e9c1d70afd4dcc86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
350d5a5a186bc5d9db066a3ca1a1a0a2

SHA1
2d787076049ac696f02e8f1eb0730b3857d34c6b

SHA256
d0fe4093e15dd9af710145fac3f55b9c05d2dde36bd9f16f30c559c4c5b83cbc

SHA512
173ddfad28db0616f13a43547abb56c98a4d9382753ef43bc0926c32f5539e10ec22173e7b36a96f41079daac94d73a2c2b96b19addcad11d124752623c75bb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e23f3b493e8b52cc89c2df9c6727488b

SHA1
f2ba60cf45aef3c822ff980fb53f4c85ddb74bc1

SHA256
05409ed655cbd4f7f9f5d25f51e8f48be0427ccdf9b28bdfa6c259426192655f

SHA512
dac747d19bafe067b19d5e12fe5dc3d73e3cad5cacc9a593c58b651454405567fc40494fe0b465c0daea970ed21674e1ad6258a38d136a66f08a13e51f30d7e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9f71fc4f189deeef980fe20b12c29bb

SHA1
f24c87321b1ee426b3ee713145657f4ec9a07d03

SHA256
c659f088a10cb7495fddb9f767ea789e3a0313dee5dbd24191af9b0b5b881e10

SHA512
4c05a403b92542808506a1f236c4a473ee3c3bec0d27353af1f7ef12f7d2c89b53c3d161a00375dfa854b734b7dd688d93bd64589a309f6f2ebd44bb3d46f578

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47c15bffa1581bfcabb7a7e24bfafcc0

SHA1
ff4461d74312a12a7fc8c7c00dedf13614d3c450

SHA256
b23de0bb06de7ea3d68dac49d545842008c42e3b15c1555362aa34bf9e6fd94a

SHA512
5c7766fc45df23cdb342fc9cbbc545ce85e9bbd066d4312cd1bc12fc1c57aea47b82fd2f70abb3b772ba0987490c6d1eabe3a650bb3f630a2d07894ba1aa5b6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd530ff7bc893a897e20dcb099d42864

SHA1
6d4b6f3ab33b0d45e6f9d424909252fd5343bacb

SHA256
c1be6e0e58a0aa2fb78a4f4b58cf9f6ae8b2984d7a0558a3a17acf8160df0179

SHA512
01c515d383132705b8e86dbb558080f88637bffb9a70816d6aaa014eb1032b979554a3bb5309447ce92779ee7feef34c378ada1ee944d38ec54f003fb73459be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
581400ef099be6f90529e37385895d2e

SHA1
cecb1ea297b24f61471284ce9b101a5b6c81bd56

SHA256
5f98b80dfc0af5390db188e4ae4ebb1ab74115c50adb9bdb310c063d90825fc0

SHA512
c8c0dd4e7f16830e4cc97dc9f3bf89cc903d04f33e2a7d28abce2dc7dcdf08831dbd168dd00d8c92b253dcdda718693bf3a8bb32fa690a90670d85aaca20e045

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c73cbfbc492a0259300ac2f94694b383

SHA1
59b3062a828d0345fb455bfd1bbc18cb9799b248

SHA256
6dcf00ff57c57a21d5cadd83b0d4cb837dcab8b3949c7f4d5c0d89b7106b0480

SHA512
99d99953b2dd3bd01276a2acc368a757f114e3d433441918c39d24cc14ea03186069cdfc6cfa778dc6465a6b183c8415ce48aa9f09562fee3f85b6f23e342b04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6222623fd264d6bc80ddaff098ef090

SHA1
c61fe7ffda0c5eeeeb6752f04b4da436b833c5ae

SHA256
f87c3dde2165b921df019c8d67563a8166393eef94d4066cd809f3e84c75b10e

SHA512
fd0a0698db60b575792c38fb74f46ea41a091fe17f3316aabfa741d556ef470e74c2b7764d8a95c22d57417faa85d438e1905479d0248f3949ba1b69f18a4bc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
6d4e22a78a6bc985aa72fc19976355e2

SHA1
4d44d78cd998ca9aab3872d7bf8483344835e413

SHA256
e1ec904ad60b4d0120ecb61bc66585539e72a5f950952efa85664f65a5be5c17

SHA512
d9f8d82eed721f01cb206bb31b289a56a7a61c33abece10f0930675d3401f9c4fac5b6a13367b9b15b1c95b7e76cdeb7ce9ce1474afc0c3b0a85a0598c122332

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBB55.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBB54.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit