37499185b1327c304f5214a8691ec3b08a3a11bf469b37088638bcff01e1b8d9

Analysis

max time kernel
134s
max time network
144s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20-08-2024 17:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b0153e41675cb0b16f5530e0048c1f24_JaffaCakes118.html
Size

69KB
MD5

b0153e41675cb0b16f5530e0048c1f24
SHA1

8de46fea2329987ac5017b6099bf4eea42f9ef70
SHA256

37499185b1327c304f5214a8691ec3b08a3a11bf469b37088638bcff01e1b8d9
SHA512

19c9f29c4151fa05585257e0af1bd45c614d94d804e8838ec46bf650b20f2fa8eed598d81492efe4d175b73d29d932f2ce7f20069e76407d203e116132b3f6d3
SSDEEP

1536:YR54gn2/CKI7n1IvpNnD9Uutlsq94vjlPrOzAta1ddKMp23E77Y:FuxIvpNnD9UelZ9EW7Y

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430335367"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4DEDB531-5F16-11EF-BBDF-EA452A02DA21} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2672	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2672	iexplore.exe
2672	iexplore.exe
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE
2992	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2992	2672	iexplore.exe	30
PID 2672 wrote to memory of 2992	2672	iexplore.exe	30
PID 2672 wrote to memory of 2992	2672	iexplore.exe	30
PID 2672 wrote to memory of 2992	2672	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b0153e41675cb0b16f5530e0048c1f24_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2672 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17f832436c4dce159584699d6344704e

SHA1
6b2fe95a9718fde45bda8e2d6587c5cc0d3cb7d5

SHA256
c8a371a45276c4171b8117fcbda271b806360b8c2bf9264bc6ae172243714e74

SHA512
022ef983cb4892f591e69bcf3906eb96093de9f5685d544a171da8bfe9f550e57f459dca1f14dd400c5ea7479d42f9b7530d5994be7fd27962084ae9faf3e10e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65015d6fda775092379e854a5d87eeab

SHA1
deabe1c7cd8771e16ed8123c152c677c93e62fc3

SHA256
44ee293e7ce540ec83b421231f5279463f1483592d281112abec58eb225f47fe

SHA512
7f2e7dd412b577b1d9b398385a958b23434460776e7dc8d495ff6b0ff19a5fb50a96184a6165a785dcdf79bf4b13d342376f665c24a642f8d07172316facca18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd9b7ccecc0ff8a312faea013652f97c

SHA1
3e17b813248e5ba92e47ffa30c5f090379710e18

SHA256
fce57bb85a3d333a0b0c411a2f337f19d0fb04cf10d5086c1b0bc697023545ec

SHA512
e51cf1dd102ec767753f12e4a9ffeee4a1ecaa82421e3fc8a08efd3b8f43110366883ea9223d5c8286df613f3a22e8767cd6df84b6403ad703871e365c03c26a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05371e4e5c2cc6bbad88053e6f54f198

SHA1
d8343b129b7a271e457607afea714235625a38d8

SHA256
f8e59e616c3de103d0b8368e34d1a326f4433f74e34e7580130579a64a570d04

SHA512
81a72d2d56ef34bd43037a0a27c826224dc414142a84a7e91a6483b3c72d9abb5fd697d3e8da2eb30a8702dcce8257c42092401e9a601be8cadd99b657f5f1ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d9f4d34fe570537ae3a13ba2678294f

SHA1
8d97f7d36db53edbf368f8e8aa6c5e6147e075d2

SHA256
3460473f2dfdc3e4a572268145de7082031d48a1a0f47a3aa33e658de1036fb6

SHA512
62f683ace6cd2b4574f391c24a43553cd925a27bfb5ae567144019b01cd7e5b7f16fe57758a2a12913f6333001cd0851b32e12d99d1ce25ddbe0885d89d54743

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1287c637fba37ed35a7af9b89f01b06

SHA1
2558e683df2c45c30dc6789ca588c01635975978

SHA256
a9725e891d3642940432312566a87023c5133bab61ea3187d01ea69339e4dd5f

SHA512
5c34460eaa57a03cf4b24ee8e69b1cc52dfa157a166e8a35e61227bbc539662ee0c889e9fa7e75d595205c3210f4fc6f2353432da8f1a5cd0a165632d4b6d685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z2D3H3V6\f[1].txt

Filesize
39KB

MD5
dcb821fda716d84011d3904363df37f9

SHA1
1ccf023d678ca27fe80a56a49ff45a716c703101

SHA256
bb76eff912d285b11f01b012864be2af0408fed7993b109aebc29a1e8e23614d

SHA512
279fbabc0e532182b076fac601fb0a403e04f409a71ce027c9e06c95037c7029639f8d7d9512f59cabe0d7bf483ca517156c38afb9fd36b19b53546061b23f5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6AB7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6ABA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit