42cb5c7315aebcd009cdb30383cee06da97b4cf88a9de251590087a2b26cff61

Analysis

max time kernel
137s
max time network
138s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 17:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a78832bdbfa90a080fb263cc44d81174_JaffaCakes118.html
Size

20KB
MD5

a78832bdbfa90a080fb263cc44d81174
SHA1

6f10d8ff040e069ff4aaafff38045474dcde63bb
SHA256

42cb5c7315aebcd009cdb30383cee06da97b4cf88a9de251590087a2b26cff61
SHA512

dcaa29ab0e128d83d19acc296c5659ad0ad22ce0e2eb4baf65b062bdc7e10326b79e2dc756a449583665ad23853ef5a425e9b10a75ec9212a8c8e71f1d94ee6e
SSDEEP

384:4MlIcAtM4kfGTHe3UGOXnqn6Z8d/gbbAguLZ:hs81gnAxLZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BFE3ED91-5D85-11EF-8ED3-72D3501DAA0F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430163318"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1904	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1904	iexplore.exe
1904	iexplore.exe
1860	IEXPLORE.EXE
1860	IEXPLORE.EXE
1860	IEXPLORE.EXE
1860	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 1860	1904	iexplore.exe	31
PID 1904 wrote to memory of 1860	1904	iexplore.exe	31
PID 1904 wrote to memory of 1860	1904	iexplore.exe	31
PID 1904 wrote to memory of 1860	1904	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a78832bdbfa90a080fb263cc44d81174_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1904 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf49d75d2a8541c27753d1cd50dfcc93

SHA1
ade64eeb6e7a8e91fa626a81c1d19f6744e6216c

SHA256
6a339d8382df30447aa95333904de10f41ea0d7152abc5e11eae5cd96d1570e3

SHA512
c29641b9af1fc875feb4859abd54fe6129b70aa57a1a8b350ea03042e39def65b8240ddc0c58ef21fefca362db40900218df6b1163e56aa35ac1b6bf361a253d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8fbd40d1a4670d666ab6760392c3d898

SHA1
b84e15244a01d3c5c417063bc8b7ee2cb698e053

SHA256
c8bb38be1d3c2fa41904adf6c67d3914c36f9211d206629fa3afcac58e3c5d07

SHA512
ec7a40db786d36dfbb1e1a57b4f367cbf58bcf4ac7a5421b7be76d235f1922f10764e6fb4f6bf925c84977ac72cc80dbd554df8875f552196f8ec846e24ee00f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b61f1e9b5c7e55e59a1717700fe3541d

SHA1
f3a091640baf42700c3895e7374984a0ab4b17cc

SHA256
f4ab08c6a891853eaa97b47335823671dc064ca030f97a6f27cb292849ae8c67

SHA512
a6aa982669b6b52bbfca6f53e5e82aac6572783c7cc9ac56e4883923d318e01fc535ad6a8e9a60a264ae45ca30c13a9ffbfe52c20133e7f19b0f95d4d682970e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30421ede824090394405b473638b100e

SHA1
d03168a923e231f8d077d1b84eda11c424720389

SHA256
0a173eda6f5121d1e871b997b70c18190cd9d35cbc4222e8cf855963da6e33ba

SHA512
fd765be2b4f2605107edb1ff6f0cd71bea5ef92bc0db25cbc58dcfd67d98a5dcbb44bdf00256966a3b2fdefee8f8bcd933acf1024e59bfa11ab2a8cd45d0494a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc7bed6a5b4f591962f097a5bf1bada7

SHA1
2a38938fafff6ebafd32556796186992c5ec0362

SHA256
0e5cdadcd7b775dc3eeb8feeb9918874da0b37aa2d38978febb333618c0d8c6e

SHA512
d8ea0a1c1f2dc2339113bee98b8dbda69b8ec568915fb76083af6b458c9731098a00619f4c5bfb63fe5122204a7f320f8a88f5919f5d3bd488735012b5fcc0b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbe26797ecbf161b677e462c4e30e5a3

SHA1
8caace12ee4b6a1ca7bf836c0e15ebe612241395

SHA256
75a2ee8c9f59d032fb903156279f3f8c2b57fe398e26c8477fbbafedaad4c1da

SHA512
265e213fe7cc8bea401ed6ae5803a91f4b3d9fcb484edc76db7e2a930047e2ce26e2a1c1dd573d66c064f83ea3d0f81be495085178944fdf6d3b22a0024ddef7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
abfbd197baafc29d9a4ee8b50e2776bb

SHA1
dc001209f82bf59c93976d54bd2e881eeb0c207e

SHA256
fcc6b038a151f5b8de03127e223b690fd6c239c0992daf012958ebdc40e2c5f3

SHA512
397fb0cf5982d3d2d0b2e6890e49af65fe4214a9bca863dcde4cbac40724262049cf3436cbe839eaf4d819729bd1c60ec769d2710d85eb665b1d23d4ba149dc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f021011217e0acc55387518d77202cc

SHA1
22158e584de7740c520562e15f3e30f28f9c101f

SHA256
3b8c8ab3262032be974b4afc840ac470209ad91d73be95ab637a39f772df77f5

SHA512
049f5a8d0f349215bf7d3856530c39884cb0236683a09e2b7d79d14a1dbc075dce3bd0e876039a3558cb91bd0143555e9b1b903656148c90117b17b5d2aa5787

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e53d906110d61317fe149c1f68e0e28

SHA1
c0aa43cef740a43a58da49db3d31c2ccac601dfc

SHA256
e5d01787a3d4cd3b65eec7c558027e05716fd4e80c2ef0cd448f9f9ca4a0b626

SHA512
baf27eeb268902d544abc16983572e5d3517f14c69881965929bcec769f1dfc57c5a922cc6bd86178e103c3894e3624a33ff0e102242a0be86d62bffb0c4659b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFA95.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFB74.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit