35d8629977ce4061ba009a71a1683d809206a1a41d8446563b84b49fc0bd0ae1

Analysis

max time kernel
131s
max time network
140s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 23:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b15a622f2f4ad9b4b76f048526739919_JaffaCakes118.html
Size

18KB
MD5

b15a622f2f4ad9b4b76f048526739919
SHA1

6d8680346400e1572772a843de8067de6f6f7075
SHA256

35d8629977ce4061ba009a71a1683d809206a1a41d8446563b84b49fc0bd0ae1
SHA512

f5af636d026e42a5930d95aebfc3cf6e97cb57c045ccb6cbe279fc3514d0bd8e0acce081a4e7a6565ca9076a9300e7f7b9ec97d68e57e2efef604a44fdea92e2
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAI24QzUnjBhM282qDB8:SIMd0I5nvH/svM1xDB8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{56B709D1-5F4F-11EF-8FFC-DA9ECB958399} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430359851"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2536	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2536	iexplore.exe
2536	iexplore.exe
1052	IEXPLORE.EXE
1052	IEXPLORE.EXE
1052	IEXPLORE.EXE
1052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 1052	2536	iexplore.exe	30
PID 2536 wrote to memory of 1052	2536	iexplore.exe	30
PID 2536 wrote to memory of 1052	2536	iexplore.exe	30
PID 2536 wrote to memory of 1052	2536	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b15a622f2f4ad9b4b76f048526739919_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2536 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc387c7202a5cda7d7efdfd0d523665a

SHA1
7704c099d5de0fb95f322b675ba36deec7321219

SHA256
ce46eab0293798268130b816736b69f7dec9bf4a8cfa9b074cd8816aefbe29a0

SHA512
cd4728317f131dc2a437f0e3f44b794bbf24877eed535940e706563b312a344d5d6ab0221811c493e267df5039632fe717fa895594787519d7f103f43bc833aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28c89628a0a6201fff48b0c2617273b4

SHA1
650daa36029524d505b8a215806c581978ac0460

SHA256
9bd92d0775973e30cdc2c7519d509835a6a8818a9659bc859eb73634a0972cb1

SHA512
0be91b115f7392dced817e7f80397699287fd9e51ff3903bff9a9f1fb3a8d9a4ff2997869ddbd4675d9d103d9e1549d66ddf5184a3f3c0d5a0aa04d470a7fc3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be1bf02f40b8ffce97c048d1096bf307

SHA1
156ddb178475e5e9c9ebef39c2cfcca9f6ca06fd

SHA256
cbf05fdfe06ca9f4d84ac1764711f9e25392cabcb26d115fee192327ea89c671

SHA512
783f0fcc07072bcdaa50bae00a5331831823789c8f32df97ed72aa3e75ee7d1fdffce9453c2c6348e8b389290002c5c00806471a81733bde5ed7134063b7722d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e93b0a2871656cb86dfce6212d341c8

SHA1
1172489d5cea1047d5779f30e065a69c22a7d216

SHA256
5935a1586744d590d4c645f6febd0582c2ee27b430100c34f7ed174122ad297d

SHA512
2a4a85c649930fbaed0f6ba106c8c39cbd07de7ab79740e910f38f8a6b0588acc86faafd683dd528c62c8fee50ed62b80ea4057122684a5350c258a1d881ae5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ba81073d536ed27971e97a7899038fc

SHA1
68590af72ffa3d2c2223cbc20d44808c04912ed9

SHA256
622dcab6f93c401059ef5ee1217ba00c1f92cac05997df2ef1cf5110d9228e64

SHA512
dbcff0187705916363fd75692711152ed71401133989e98ec15fd842ac067a4b02c44e58aff52f49f3494b75c4bbdfe5ef3f2e5bda3989e2683a68042c54dd37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54b9158b4ca783985493af1c7e1cffe6

SHA1
18d31f45b19d9ef6ee6ba6cf9b476b9d641a07b8

SHA256
1fa02e82b5e27ed65af5e041875b6a87073f725f29fd61349c35ca13f9f84276

SHA512
96cd7eaaeda2ffea69f2c2194e37fb98060892caafe9ec6afb92f6745feaf28d84e37547f4ed3f4bffad876e55182f72e3fe712b0a4975b7db4652269dad6715

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
383845fcf7396e6900b433d33045448a

SHA1
7250652bb0d4a9915a46e1469b5b9fcfaa5a236a

SHA256
f8b1b598fcaaff133e8db2691f8bc21c3e11fcad70453c6beb3827d7a3807842

SHA512
9342bed9a33663e3fe7d7795470021280bdfc7fe939c05192ca768f084b5b56fe1208f220339c391f4d9686f9c632abb3eface206dc7a06765c884daadcc1433

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8898236be78b5e7888b8498591dd5ab1

SHA1
340f141eb7a8c7f5ffbfe41270ff1a8efb491516

SHA256
fe972780f9bf169912bcfb5361855794e406017a92b35d4513cfd174428dea64

SHA512
623dcb93ff4c60fdcf133cf02b1383770de3a74f0009aa46ac6d8c2f7b41587250f54309e14e4e48854d9b6c46cbd420191a224723f93ecf1b13a15938d7ec81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff873d3cf7395212875cd7e75b7137fa

SHA1
19aed2e39bfb755700d1c1954f00571484e18dcb

SHA256
3b633e0e3b6af412e34b12b02c4abb6b7740b0c2ab3594a76e0b776d408577ff

SHA512
d2dd836cb9cf60f707052fe0d840045013e1007a0f8ee6c78e8837d7e71f113d09c005d45673ee9edf1e987e230046d4b3f279567f0a07c83f13a89fbe28d9eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAF73.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAFE4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit