2629b58c8c4ed8129a3bc229ee499a79a0d6122a7724195c9c8450cc1da21d96

Analysis

max time kernel
129s
max time network
139s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
29-08-2024 17:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c9531b3ec282c4e0450719d4b9f19b77_JaffaCakes118.html
Size

18KB
MD5

c9531b3ec282c4e0450719d4b9f19b77
SHA1

19fc4cb1d35c0933f1c9c9211fa70a13a8647e73
SHA256

2629b58c8c4ed8129a3bc229ee499a79a0d6122a7724195c9c8450cc1da21d96
SHA512

1101c4e82930e0bdffb94a0640617130b7051cea66a7d66cdb0c8e78f5e7f9141439f7d44b5539901782775c9890b39891e74d020ca9e2152b83e97341ee17bd
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAI048zUnjBh8282qDB8:SIMd0I5nvHdsv81xDB8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EF164971-662F-11EF-8153-46FE39DD2993} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431116021"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2412	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2412	iexplore.exe
2412	iexplore.exe
2408	IEXPLORE.EXE
2408	IEXPLORE.EXE
2408	IEXPLORE.EXE
2408	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2408	2412	iexplore.exe	30
PID 2412 wrote to memory of 2408	2412	iexplore.exe	30
PID 2412 wrote to memory of 2408	2412	iexplore.exe	30
PID 2412 wrote to memory of 2408	2412	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c9531b3ec282c4e0450719d4b9f19b77_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2412 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ede985d023bbcba9dc0ec7e3629498b

SHA1
0816b89fd76cb459989a6d9f49b518c8e914c5ca

SHA256
4522329323d89218430766149e6f49ab03cf66d300a47e1120bacaccf80a8c99

SHA512
823cfe770b6ba7312892ee3366fce34f327c4494f9656035f94606e316f0bb8ad55ac4427af69fe4b4832799ae008a43732439b9802d56313fcb782c2050a89e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c98754af7e475dfd1a7a956ccff29a06

SHA1
b2adab82ff754f874380ea663468d371a3639955

SHA256
95c21e0b2eed24ff33b56849c850a84243a281b0cb4d5766744651de7c3afae6

SHA512
defad7843088dc7599304905bb1baeac23ae4577ea0825afc13659a772aaa9f29548363b064c2a0814dad8d6f70c90f075e445d73fd078c3ffa35b6dae55420a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2392d9d72945657ab1e4c56ad45bd72

SHA1
911d02da45efc7233edeabd45e39c9528265c151

SHA256
66b2154808a7d9fd763e266d65a4c574cf0a6a2d56440090b1c9139cede0f132

SHA512
ee085c8a8429760a0b248d5bf6952e5a650858b8be8a3d7e90d007c7af7a8f4e2926d6c28fa7894fc66b1b3f7d81969cab4ccb1355af17f5b12bc84329637b54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f393be7813da755947e714616871a730

SHA1
b2b53367d22ec79cf78b2d7fb30054f8ae104e24

SHA256
1ffe213cab0fcb4b8febb5db3aa237e61ffe9467894eb13bb531370d37b5b185

SHA512
40ca8b2d00c5bdd0b327fb398f25107ad547c16c4fb6a69d082b70401240b650a7c40b617dc93cdf7e69175d190a801151d26e6ece069c9331f0853c9d253e58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de1b1deecdb00e07654c23969292fd42

SHA1
1d8df7b1e007646257c8ea477dbdd3caa2076fc2

SHA256
2b3cfefe6f4925e087cb8ecc99ae575f17696061479e2c1bf0f7dc4f93e6f4c0

SHA512
bf93672a1ee13c7081a0654294faa403c40006eed772aa6d271ec075e501d7fdc676d0712891905de4563cdbc987b8efa5d2b7f214f4326577ab260c4ad8f466

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f128884814c7743203d0d6128ab4a2e5

SHA1
4881cdcd03a20fe032f627529b5eeecfe8a07775

SHA256
89f4f682b1ce01cfe6027b06bdb21f5b2fd02ea76a10fc9686e25816392cf819

SHA512
b60e9521b6a84e9041de6a665b2fa89c29afc528bbe92da6197a145aa381b22b5dced7221f50cfc21aafcc900dac2131734e4ea8521689e96ca5dbf50779e9ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dacde13847a4dcfe70e4b75695a96631

SHA1
b3f8ea2a2f2f9badb3b4d98c0b14ef8d4d853ce6

SHA256
9865cffd5e9ae7f76e43d09ff32d9ff7f32fcb8a38ffd1603e23aa5e41150236

SHA512
2fad0338a73b7d12d6562ab0d7df9fa972a7ba37850796a5603fb1fb51c153e41bd67b3fa7c14b1ee33a0fa9cd116a30b0863bacbb038654e0023a40de42f535

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
166a2dc2eecf4222fb5218f145de9e85

SHA1
0fb96a2a035f9ad2ce537f07a2eca52c7305d93c

SHA256
5ddc318a3022279d46a57159925de56d0f7e31ba14c39420aa6be50f82dc8f80

SHA512
4d70ea98f5812f047c1ab55a7a843aa32f088a9b624fe4767255ede9a4bf5a2a2e613f215a1890113ae9b34cd4c2a3003a01a1e41a7bdfcba8d4288c5fd39f4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f80ddc19e6e0b490dee92511ba6c8236

SHA1
76c9f04c2547cdef693ed060ef43905bc7516d49

SHA256
2c8940b57748a0856e007eae64cc38e9c78bdee3499d0a002093aaea8edad482

SHA512
f7232f52e6e29636a3b8ea8f78b5f984f7fabaf85de526137efaf3e75fcaec8ee30760f15232d7ef350aa7d49e2368a09886324183a9acc3ce0d6d705e7c86a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9E13.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9EC4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit