a3b85909b8bfa642a040fb69ffe5ae5202bea77fd19c0f419f087e35b7466ad8

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 06:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b25aeb746b83fb51580a8b95ba6a2c6c_JaffaCakes118.html
Size

27KB
MD5

b25aeb746b83fb51580a8b95ba6a2c6c
SHA1

7688a9ff49217978d11411746d5aeb0fbe091e28
SHA256

a3b85909b8bfa642a040fb69ffe5ae5202bea77fd19c0f419f087e35b7466ad8
SHA512

c3f2061d2c824a8434eb5b41dfe4c6410717deba5407ddfb3ca8f876ac97305b9f3c3c5ed13c226da28588e092e4604efc7fa15d9f4ff5e99a8302eb46fc4f09
SSDEEP

384:Q6Xq/TM/sJoQrGaUdl8m7/QgLRr4ZoWQ0p9x3F3dix3NrwAsou2kv9jsArRlPhhg:QRbSQrBZRQ0p9tZktW/vuWo2DyvFMA

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4DD66F21-5F83-11EF-A850-F62146527E3B} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430382170"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1820	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1820	iexplore.exe
1820	iexplore.exe
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 2264	1820	iexplore.exe	29
PID 1820 wrote to memory of 2264	1820	iexplore.exe	29
PID 1820 wrote to memory of 2264	1820	iexplore.exe	29
PID 1820 wrote to memory of 2264	1820	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b25aeb746b83fb51580a8b95ba6a2c6c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1820 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54987d926dc3d873b8ead93a859e61e6

SHA1
23275cef8445edd4bbdf84a08f1db35a8dd1c5e8

SHA256
8268df7ba84283492a03e996371e39420aa1d419d760ac86f197140f6a293319

SHA512
275bc40be75ce6db91bfe18e4a269f36985c3a1466f888dbde5557eb65d443cf22a2a2c2f6f73d5970e7da0830e59158b1c3f77babb0204a5c1eb81ec95203bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd341958d2791f0943a70907fa8f5c46

SHA1
b5bf3c391479de24fea3ec32f2028b25919e8b66

SHA256
106317d9717d4bbb1b85a9f0cbd25f52088b12ab7a5c2bbad21c6689d3ee28cd

SHA512
f1919ec2519ef074177db4482683f30d0b2fb0b65528707297a9a2876365a142da2e66a8787aacf9c7becfbc04eea208283e8f96ee2865f1461bc04916306cfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
166fcca1b72d60148faa32dc382fab22

SHA1
d02c02c5e87546a264e5bd96f17020b4b8c44760

SHA256
a0eb5154a11b29115de4a22a9494d0b8cc50cf89d43dab0fe098db8ca5a76870

SHA512
e60443302f872fc7ddd575ed162d68b237380fb2e36e24e42498db360140bfa30f096dd27aa715f4ae081ef5e975dc2f3340381acee8e49c96ae443ba810a26d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d25c13dc16662627692a93e4d2f1bde5

SHA1
40898b93385c4fbbfbe831b3eb8c6d10fc58a569

SHA256
040b37d6e2aba1ade735e76d890d05b40901bce64b264ca2b8c6e60f390d63de

SHA512
a05ee283fc295be00933cb17ee4bac062a5a8f6498ccdc5809c4ca807f44860de304a9497c8aba2f80f8fc4e1e0e55f46ec59e2fc597a447ad13fe1d1f5d7f88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41797cee85141a66ece7134a3819a96e

SHA1
3e7a2cd305bc0c1ed476183e36222aea6d59a0cd

SHA256
3a62e524c2b83033c74fb0b743518eb1025d44ed16ed0df97e469424beee11e6

SHA512
a96b312b9af3b8b06bb42b8ef772ecbf3ca5d6175ec76a9056e64145be2566883283572e061712fe3aebcf0d38da292fd264ba619245005c190f6f5f4275a7a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64ea394f026538c2157129fccb0df69a

SHA1
2256b78f30e006f0787830ff8de63603f1be8263

SHA256
259740bf0a61acbc7ca2aa800fa6419a7fec716cb99a0df8eca0776ec5b53053

SHA512
0dab0b16a36fe4cd4042b24ea4153d04f7a69df7da6fc7d6cbeac59f160dcf46126c47edfa1a19821229171647337d7d0d074b6dbd1fd2d431a8bdf739c766c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c6d3a8adb4d6fdc7ffc64cb26912556

SHA1
3858e7004d018412aec86d42ab9e923ea9447e2f

SHA256
e687abec7b326547a709368f67fa4fbdaacd9141b7bf548d656d6087c18ef701

SHA512
62b58c834b576a1f5b6b9aa55866cb03780a60ffd8eaeb37eb093c90b2537e061573b82011367284227de5b77ad3af34bdbaa52177ddc1b8a8392fab1721046c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b417cfd03b32add192cfca95c01e4d75

SHA1
6615af8f80efa3a233b66439890e0d10bebd4a4e

SHA256
7f97c56e7171b713e128791c8de317eb6762e2171df90bb81b2890bb9a3d7d20

SHA512
91881250756ab7ab12f26440794a600d2af725a6149e8bbe3ef126ce2fffff38f382de678aa9e7f307b073c4d417bafdf15d71bede0fb00da5d6fb72fed8916b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed97b2fb8ac6948516ab63c5a6925e6e

SHA1
b61ff563288749dad3acddfb9e5a888f8ef3f32d

SHA256
4128224009df0ad61223a1014e747bb9b0a5751ea487b0f8ddc49723dbf59d75

SHA512
6e4d0fcb0b3166c4c9fdf6ec2a969f967dbda1ff7ba0e9dd72849e5c176905e0ae33596f12a93f0958b4431b1e94e4eb556d883cbd50a032570d23ada56a5e84

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab11DD.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar127D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit