62ea21f377fae887c2dda1862e39b0aaa4514b02f61ba05532a5b58194364a2d

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20-08-2024 19:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b09e4a5796e08fe3c7caa8c4abd92475_JaffaCakes118.html
Size

41KB
MD5

b09e4a5796e08fe3c7caa8c4abd92475
SHA1

bb9c2a3242dcb78ada661a027db0b881174016fc
SHA256

62ea21f377fae887c2dda1862e39b0aaa4514b02f61ba05532a5b58194364a2d
SHA512

f664a5c25c182c38a07bb0b409316ab7351f7b2980ee0d06f3df37b6901f88b0e949b35c6918f94d5ba679f61e0c5c24c09e8136f5674263cea600b9aa7b6ee3
SSDEEP

192:uW7Jpb5n+B+nQjxn5Q/QnQieLNnOnQOkEntIynQTbn1nQpXC8A+EoZQhNqoJyfWN:IQ/4PJQL4lg/m84qk60VxS4Or

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430345737"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7A121B21-5F2E-11EF-B4E2-F64010A3169C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
824	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
824	iexplore.exe
824	iexplore.exe
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 2680	824	iexplore.exe	31
PID 824 wrote to memory of 2680	824	iexplore.exe	31
PID 824 wrote to memory of 2680	824	iexplore.exe	31
PID 824 wrote to memory of 2680	824	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b09e4a5796e08fe3c7caa8c4abd92475_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:824
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:824 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0394241b3247a018dfabd35121682ee8

SHA1
fcc1c7c4043495b920f86fc755667ce98a6a571d

SHA256
5883682ca71aa33861dbb4993ec85df27b87e7e688084991640eb5196f7abd54

SHA512
6656cbbdcd485f8bb13938541af5e129280e527a945f6ac81ea188c6f5ea4d65cf4cac58705dfdada7facda76c6cff3268fad4675da8780fca51f49d4c2ddf50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1971c70441c797fe8bf55f711e7f133c

SHA1
2d8fd1dc33880664d75c1c0145614df0f39ac187

SHA256
a9af17d7192870ed9a1e9f22b4756ae8520fae264b0692620d1eab5bdfd211d5

SHA512
7434721cf236f92db064387a111aad9ecd3c608d5da0dcba143a98a66ec49756acbdcd5072171660c87fe51a102ba504a79054310278e5f2912c034a17f26a71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f51d45f531728d7ee1bfa5ad237673c2

SHA1
3548452c7eb279575abb96c19df2fa469665423a

SHA256
6be7fff40dc6ab5995e9271b35315807447c1e207e8bc6d060bf2acbef134d49

SHA512
a15abe12492b4eb2821d8f6e9e662a55a3c6fe09424200e54d5d5be9f235d2184dc577a726ad63c9926a107a1582a09eeb33ff5b471cf42db3941a132e994b0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bfb7f833d55dcb10f0a23cf405567302

SHA1
d1c6d127edbe6efe966a8167b48b6ec2e5c54d96

SHA256
424fcdf4853d642ac3bacbe0c3a1f468a6d680089cd53725eab0654451f3d411

SHA512
f68e8fe0be85fe025d201f460afe4aee04f64e61535bbf75903f0596b386dfbda889254842c0512981c75b36878e3db815922aa2ae3c2dec5ddb5edff6866998

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08b3ea0b4d7f43a96d8d93817fc77be4

SHA1
c18283d8f6cab9c08cf130c23f3e314fa40ff6d4

SHA256
ceef7aba7325aeed2b5dd1a5f2da3a98e932d20eafbb9f129dc3de234b39cd68

SHA512
1c980c998545b88367168a7206aa256fbe475b1cdc47dcdfb36ac2c7aaa7232396b8975704c1cf00bb11992ebee0735eb25e0e50dd7b419ca0d958690b865ef8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d8230869e9afe9df3280706329860b5

SHA1
743dd17ac2f92f4f9237aabf0c2fbbd218d512b2

SHA256
f82cce8cbc05a09cbf2e4807b4ff71da49b015e002686dc9c265109e0183026e

SHA512
91c41c1646d19735209245075a3d58ff57db303c5ff4e04ad9d64b911445c291b67f95bb30a97df594095656a8adb46d60311ddb3e5c7af9e7f10bc11b3d359b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e976c556102056c7de69ad60f6aa6cd0

SHA1
a22768f803b5448111fe4370c5a8d8c9b3b935dc

SHA256
274179c0c3eb6ff32b6e2a8ece959b83ef0858f310d76e6e7b1524fd3bce384e

SHA512
c3830a92e6e56e1d205e2dce6bfb019e1fdeb2849080a640a50b42299a5d7b02e19bb55baf1d586aff1daba806150eb178f33d0ccd8df581fdd01e740ca86768

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00c7b9811f1e70853aafc9416cfd8114

SHA1
328ff1001c5332596dc9102dc83596775fef8cad

SHA256
7505a116e7b8812236fe9a984e92ce15ddda0898b818b28e0d50e812f3d99fe5

SHA512
e1c5556cad41d5a97069bbf73a15a3c519117949d196be611ae41be1e849b608d157ca5137db1c4a9506a8fb78572d4e95ba1146e27b3201447f3333eee072cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6be32d573d65e22b23d1603184926da

SHA1
42b1af0c00af71edea4945aa5aaeb4c9c845001b

SHA256
5f1cbfa0027e4d7450491e8f177ebdaeada022a6131c9c38219264d90c2fc239

SHA512
7d7206abf883e04698fbbb44f04b53a5a7ae53b942f8651649193781451950eadea89343de16d53e629ab8e1162753feaa2169abe884a99ea937980c8815a0be

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE246.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE314.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit