4f850c29709e287c29bb35a9f926e8b079bcf761b5e9626ec663d959aceddbb4

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 15:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bedaa813eb63c139ab1cf8208341584d_JaffaCakes118.html
Size

34KB
MD5

bedaa813eb63c139ab1cf8208341584d
SHA1

7e0ffa4260625f14edf6becb9ff49b2cb04b0ae3
SHA256

4f850c29709e287c29bb35a9f926e8b079bcf761b5e9626ec663d959aceddbb4
SHA512

e753ffb984ae14ec65bdcb2466e5950c909d9a09a855cb1ad1267fa617247a2180dc72184d670838c262599d6d1037a0fe46cca1b301dfdc504f7b79b8dcd317
SSDEEP

192:uWDOb5n7Y1HnQjxn5Q/fnQiemNn8nQOkEntFBnQTbnJnQdlXCyRAqK5Ake+kfaN4:oQ/+lRpzLMr5p3+HzhEFqIQPOS

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430673943"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A4182141-622A-11EF-A817-DAEE53C76889} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2972	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2972	iexplore.exe
2972	iexplore.exe
836	IEXPLORE.EXE
836	IEXPLORE.EXE
836	IEXPLORE.EXE
836	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 836	2972	iexplore.exe	29
PID 2972 wrote to memory of 836	2972	iexplore.exe	29
PID 2972 wrote to memory of 836	2972	iexplore.exe	29
PID 2972 wrote to memory of 836	2972	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bedaa813eb63c139ab1cf8208341584d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e05018169109d34e23b7b43c58176f1

SHA1
5c3a3b938f16e44821e923efced3aceaa1234816

SHA256
2ca8c24e223ed54163d9a5165856954648ed4dd15581b8351feb6b80125d848a

SHA512
42abd39479d33593229309bd26fcfcd5ac0cb36fc16041aef04fbc137ee7aa13bdc91961e466ab27f27eb10ad63071f30d25d2c2492583863d20b23cd32adbba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66cb43663ef8c0ba290c969978735b3d

SHA1
ea62b02ff6efdbd12a3156f2237892a9a5e8717f

SHA256
78751e0943bcac4bfe67ead9903b7fff7b3b4c955b88187277ab1639dab04443

SHA512
694b52118de90c2aebae5b0031b54cd819909ce63bc87f67ce93632c68e7f499659c342475228096c55751139f6a83501ce0b468f860cc7a7aa475f025868328

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54ae68544587732a1a1f016f368cfab6

SHA1
b7f973f36006a0650e29638b8ec8f02beec8fced

SHA256
458e25fd146448e767f32e22f4a33f62760318ffe86d8afcc4d171af4b9263db

SHA512
5801f23037941e36be85c2a965d5f00fa90155b8c5ba999a4e0a4abc2d28cb17154fe0804dbc0671bc88840afe68da1c99e05e97d402ac8f4290270226b0b629

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b25484139d64f709ddc2b871f02c74a7

SHA1
3a8ebc61ed34d3e25e8b5a969c3ea7df95f1090f

SHA256
32aaf3a0206eefc5409d2458478aa23065e35f55a20f5d46e1bde4e2182b9fea

SHA512
b2263c3c84f206f01b390ef30a0b5fc5ea766d0bf1b8aea9f509a157e30afe6f8e98230a98ff2de35e9c0816b3724050225847f5aec5ac23049f32239b2aae4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4742cd70429bb4ce344bf6b95230d6e

SHA1
49688c291b16f709d6916f91f6625afe1dbd983a

SHA256
8e6d7a7a9bcab56c33febe4272cbdacb4d00ced07ff39a0267163ca4f613c53f

SHA512
03d99dd0a3b3d009ee5888335455ae186809f6fc1f1548f90944a3f879a2b6628f879a126805ac5672da5818c6eca5e67123148a6265de21d90b6262cc282da3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a04fb3938ec75c4458dd10620544ee5

SHA1
81809f38b11b749a466a59454b53d23a8d4df1e6

SHA256
938e2f7453dd1f9f13cbfde8ff963ed2959163af7397d4a7ac2eaf6280cb7808

SHA512
e8a64ce108ca30ac2ce87bb6c0310be2229f1cbfd3f1c1c8deb74292647c31e90bbeed63a197cb696d1191f7fc89909747cba14245d316e1778af895c0557fec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03d47965325fc954f945469931105a90

SHA1
b3b99de94ddd6f245fbd4c25c2161f63f5f23f17

SHA256
b406865a4236e9a1b780ba8c9b8fae5a88acec10c7ce8870a21f4478c3160047

SHA512
4237269a4858dee2ed3ad0f7cb37c5010bf1ad4e8703fa97ea953d6665d5bbc1482aea62b013d802874dab06a8d9a283773f1ea43a1c1058be520dedbe7845a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
987e8882c3641744fdc4c94daf60ee4e

SHA1
375ce3b99f1c32e2d3e7495071f38fae2de58ee7

SHA256
333236d53902efd6e6782f14c1d5e371f1f2f173cadcbe2b81aea5365bdaf1ce

SHA512
f18ee43dee5533f1b7407ce3706d7f46078019f98f73b049c1bf0e60f2587c37bab81b10f727bbd3ac6d373b36f9caac2231f22889e43a1d5554e6347c0f4f80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
391effc45a16ed7cba32434d0a37b077

SHA1
bbe54d27b81c4311a5c2b0a3948260dc08c75a33

SHA256
d023a62615e88eb9257fed74a9378a9b4e20555eb4658f08d847598b45e484b3

SHA512
8ba1f5a1d5650e7183edcd685269cadc6c134de0e412cd933e5be826dca4bcb530cbce7994cac98ebc4b9ab0410590f6d5708cc02e9bf3827f891be2f2f0adcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8F08.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar913D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit