9affc74446269213aada9d70602d8974e6c25e06582756f0d26e031c33028dbc

Analysis

max time kernel
148s
max time network
147s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
24-08-2024 06:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be0cc5f57d3e04a40cc32c793a2898d8_JaffaCakes118.html
Size

19KB
MD5

be0cc5f57d3e04a40cc32c793a2898d8
SHA1

204975ea21fd9387e14b978c10766f541fdcff1a
SHA256

9affc74446269213aada9d70602d8974e6c25e06582756f0d26e031c33028dbc
SHA512

72cba48f6c01a37821dedb1343f2a10c227c15d569ee7056ef9a01b63154246802001bc4976c2a25dc07d959491778f9d65252c90c03eeda73fe9b8629fbf3ee
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIr4NzUnjBhXZ82qDB8:SIMd0I5nO9H9svXyxDB8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5E866A91-61E1-11EF-A5E9-FE7389BE724D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430642473"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2296	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2296	iexplore.exe
2296	iexplore.exe
2188	IEXPLORE.EXE
2188	IEXPLORE.EXE
2188	IEXPLORE.EXE
2188	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2188	2296	iexplore.exe	30
PID 2296 wrote to memory of 2188	2296	iexplore.exe	30
PID 2296 wrote to memory of 2188	2296	iexplore.exe	30
PID 2296 wrote to memory of 2188	2296	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\be0cc5f57d3e04a40cc32c793a2898d8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2296 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d98522c0d1f9b978bb79a4ddc5ca2c2a

SHA1
328b07739be6a00dc4a2ae679f39e7f08e8e8c0a

SHA256
f926ea23f370f5e156cac6c87973ac264a3c86cc280b39ccd9fcfa2a0690b1a3

SHA512
485ccfdfd38a28af8dc1e1cb5b2a8f09fd7cf5477ab4b17dad39d127df57252c77bef77859aa3ab2243b2d1caf56b257e9f842107fd9b8f153cdfc6adf80bfb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb376ce9c2ffc3f3faf42f6dfc80afd8

SHA1
a1b8158a5acc64e013038868d7328cce155c0e90

SHA256
9f6b783313122d0131fcfffffc7ae377e8be2473fb09253f7c91cab4068f72a0

SHA512
e4079db4a7c5fac2c3adf63ef12949267a80c6ba7a408413e9de4b806f663d640b7033cacf21aafab62e3749cddef1c098c92436ce8601af31bd2ba324503dfb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e37addf30a0dc6888436f4bfbf914b4

SHA1
b1dba5e9302d465d48738cfe8b3ed638c125b6d0

SHA256
b192d62891bccef203100e2d0e9d4b8c0d6301c2079c296c9114c4820bee5966

SHA512
872190c829f9e8fc22dfc6504011443dd0810b441ae132c63ebfec5add09a831601d1315068e5bf2436fbe66146eb70d1841456d38dd5a41a4539f11df5c3e1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28ffb34f59aada19c3423998ee43f251

SHA1
18f9b1813a08d00104d92eba9251d71e96b1770d

SHA256
ec2080022102349c1ddefad653f551d32024ed0c481673dc1ce2d70c64ed037f

SHA512
619d57f2b7c94d7864258b6e504519bc7e80dd7cf0f8f88ab4a56b98b140141cbda4b1c4997c414bfc3eb9d4996daf72efde3c6f96f3fe2ec360126b8896ef2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea72b5cf6489dcde889a4d5d70ab355d

SHA1
8ebd4194014f7d9d6525a522050c407cef252acd

SHA256
750a09b33f877815d3f91d9dc99d061c48b1328da3837fe2eac3ac5f26ca020b

SHA512
dc7fa19356a0428f4f618e64b87132a91542c1754a858299fea68e121b55f83b9327a25d4a2c5ae926c1afbe9766916314e0ecf7148d427890d3e1541d8b7f89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11c880c85604aa301ccfe95c9536c843

SHA1
b8809c4a91eac5d8625666d37a717b106b73a082

SHA256
908d8857585522a96643cf09df9dbf730d3d58661c91f3baca06ba75c13594fa

SHA512
c0795a935e6348be47917bb7ee020de64c62a6b428c3997c25df8d86e669524ddf9786d04e979275ce1aa47f4189096af202f14bd3c48a7b060a0245c42da2c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9513d44674225b7b41a9febbeef40e7f

SHA1
47a286c0af25c2cbac0767494393142d3d3329aa

SHA256
501d110a9b41c735303f9efb142da42894c21243b15ca1332b670c364563d39c

SHA512
e43a2bd8bc19eb0b7e98e87f994074f7c04471ea17bf5c50d6fedc57de9f92bd7972b52301f4a260febcf54779d79fa78859aafb93496cf68857ae8a25bfc934

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb77b355e0fb0ac3c372870f067e75ef

SHA1
20e184fa25e98bae838f20b6a3f32fad3b798ef0

SHA256
087595f45164be85429bc4d222e365d570eec2202089416e7b26d9d2cbff21c3

SHA512
5df2d871c8f4948041c612497f821ba70eed0f3a56973ea57cecc6549afc81a7b06e2d379f9afacae68f7caf5991e3042551a47b3762bf524d2d4111495c84c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f53a8bbcc37d49287bf5997dddef9563

SHA1
5defd9de93cd14322eaa8d90f682ab9910e2350f

SHA256
1170bfc139ac9c05956050a58f3f9c45c162355a70933dd2a692db39a81d8f9a

SHA512
337cf305c0c6f8f1babaf4015e3a32e9478cf545237daa6f391627df1f6d1c582b24f517af0cdbc414eeb7fd423b01914f53d368ba529c2c2e7cd27617dde218

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA71A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA78A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit