bfeb79c19578ca269ad98e4b9b87e10e851a9ad2b83d1387c3b57cce05a39085

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24-08-2024 06:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be11a773cee529e727ea35e515edc3c6_JaffaCakes118.html
Size

27KB
MD5

be11a773cee529e727ea35e515edc3c6
SHA1

54a5ddcb0195d74806c28464ce6ac1b21041b5c9
SHA256

bfeb79c19578ca269ad98e4b9b87e10e851a9ad2b83d1387c3b57cce05a39085
SHA512

6a2502deab2d0d540bdb02ba5e1abffa644e12d9a006140350d648a76fbce9b9a9157783c745c250ae3b2467e89059a69ab82969d1738254e08d39957a7f3d1b
SSDEEP

192:uwfob5nYGnQjxn5Q/XnQieeNnUnQOkEntFVnQTbn5nQ9eoim6udOMQl7MB+qnYnE:ZQ/MVKUOHSILe

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430643345"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6575D411-61E3-11EF-BEE2-725FF0DF1EEB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2508	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2508	iexplore.exe
2508	iexplore.exe
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2284	2508	iexplore.exe	29
PID 2508 wrote to memory of 2284	2508	iexplore.exe	29
PID 2508 wrote to memory of 2284	2508	iexplore.exe	29
PID 2508 wrote to memory of 2284	2508	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\be11a773cee529e727ea35e515edc3c6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2508 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b7f92785ee5e9e7a3aae3d8a8638bfb

SHA1
0662742b79f9dfda14259999b1998f17b8228d69

SHA256
e34e6493b0df6f552634644608685aa03ef397eb0bcbd8f0b7e1af8586f7ad18

SHA512
4e7dfc5cbbd45df2e2f2713605f1515a1f6441d57c34effc0b032282839964281797c871d5e3709e36afa423d2646670a8b4f203d8a0bdd7436c05641b86ec66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83a909d99fdc06650b3dfa7fa13018d5

SHA1
da438045aa11514b1d190bbf19cd736cadad9849

SHA256
bf757c4510630d441d40711b8cb81094c7a51085c16ab042d6dcb99aac211bbb

SHA512
013916c94de2d099262bde83d28d289b7c145a8ee51c37a3a16e7fddaaf9d1ba2b28c8791947fe027f8789039983043fe94980db6ed3a0eb9308bfd8e8f48492

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e9a4bea37476a0dc3b8d41f0fef446a

SHA1
d44c618cd3d2581816fa17a2778aa478c30b03d0

SHA256
54e04e9f9eb49917cd1d38c58e75d339ac6f53b6c1b838d5f89cd0950e077363

SHA512
db2bbd8fc08fe895f0fd2830ec7068b02b8f9170cfa635d7f0203e3068adc87aecd80427d890a717d9ebe5b48111ba6ea30dabe111fe4c966b3a08921d73087c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
abe281aabcaa321573314e1745e379a1

SHA1
3f9db04f9b3e189562658215f9500503bb11c8e9

SHA256
dee2f2efb87d653c3f911677b0b1f2248616b84729ae0085fcaebe83509fae0b

SHA512
3018e1c1d2545a6b84c983efc90191c4ab067b3c4fe90d296648b648ceb24b1f6e5a5adb98f7a483b931e65a2089ebdb46399a9cd19fd74e2ac17d7efb73fef2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
347dacc4893c6c0838e9a9c62e902f09

SHA1
169266ef42bbb666ac652c6245f1a401cea72959

SHA256
7ba8b9473f9fcd85fb0b0cc89a606a8efe1a8caee47a0f009414be032697997e

SHA512
94f682a176389a1325764f3cf768d10e1d18dda1200a0ba6076ea6cd7f2cd997e2ebf0b359228296ed14f88492173b45d3ed514ea9be1e38433a896a419794cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50af22a1441612d2b2bfd16cf790ceea

SHA1
56e58259d56af0fc3a36830293fea9d40a240ccc

SHA256
ac1e71ee207da717618d70db9044faa1c5a09039147ebbc3db917135d7b8f51f

SHA512
a51530eb778e4701bf7df851dd0d5cd61f42a5697eea374cdf1d4a18cbbbb2d39ac7452413951bdbb239087d8cec88829d55298fc728ed3989b106e726d909b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4dea1d5c8aef0a9610fb8087e115b8ef

SHA1
726ac0c866f72aecacd231a22e4cb759ebfa2d2b

SHA256
9e7d47d958204e7b2efaeacab502fc0dcab7fbb99477d382b1030bf10c0602b6

SHA512
6fbba7340a6651c53598bfdd758ae6b53e885f2f2710f261f22a6ed31e347bab59cc3a6891bc32cfab6c08c95c3c1315f4f49c82a1cb2252a5fa6ee305efdce8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70ebf35b456760726b7d16f62f9e980e

SHA1
6ac13efba37fab902674fcd9926ec590f5c96fff

SHA256
ebeeb365ccadf89fdeed39143b48f3aa1a1f769b7abbc271bb00e4f8e4a10801

SHA512
2e839f8126da52c32c2a0d41d16fe01627f04af8ebfe7c0b55421399d30aa860f03c4244ef2d0d4ba911ad6a5b45b8c7a797398c6ac75683904b3cc7c3235e6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b731887db0e40624e0803ec6aec6cb36

SHA1
6fb0ab8453a5e4e587be3a2d06e2e8f2b2f322a9

SHA256
b12df9e7bba7d96783aac173b69d30b3795495b9b815b538688fe6b33ee69821

SHA512
1e20aa4113868cca384d49c888f6eff5bd89c4ff6a88e51b9da50c2bf4622ab51ab4253238f28f5dc452377bac563ec2b0124619c2267d808f8031815030155f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab69EC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6ABC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit