4a20866aab4f572e1025810104143e4f0650336a162e0d61c500792a6d9b85e0

Analysis

max time kernel
119s
max time network
139s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-09-2024 17:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d0174a697a401380daffb253bba77fcc_JaffaCakes118.html
Size

36KB
MD5

d0174a697a401380daffb253bba77fcc
SHA1

4ef08e64908ed4be26b56de2d347b00d387b415a
SHA256

4a20866aab4f572e1025810104143e4f0650336a162e0d61c500792a6d9b85e0
SHA512

55914036d79e254c98267168e0424981ae2d0c2e0ba878713031eb60506ff56d9cf7e981564ebf6d51050d59947c5e3fdb6b3057815510e622dc2a29b6f2bb82
SSDEEP

768:TFZbw1bEZmb2vbLefqL/i9bZ6teTFWoGer01J94J2YAX2VUMEP:TFZmQZmSXefqLI96teTFWzN9ZGmtP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{963BF821-6C76-11EF-8CD3-5EE01BAFE073} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431806079"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2548	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2548	iexplore.exe
2548	iexplore.exe
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE
2372	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2372	2548	iexplore.exe	30
PID 2548 wrote to memory of 2372	2548	iexplore.exe	30
PID 2548 wrote to memory of 2372	2548	iexplore.exe	30
PID 2548 wrote to memory of 2372	2548	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d0174a697a401380daffb253bba77fcc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2548 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce5857eac17b49612d6172274fcf48ad

SHA1
aacdd47ab7511d29bc88381417dd8e4b1c67795d

SHA256
277a3e23f71bafa30910083550ed03c8a098703e747d41a66e1a920c20c512d5

SHA512
1052f20d9a48250a4518c427ab941053a2dfe81c0d418ccbe437b9eee88fd5b1dcc83efcd9a87d56c5c7428e88847be728ce27e637cc1237726623d63b2bad35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
322c2084318fba86530f050fcb12e505

SHA1
8bdffb147ef422da268b82c9f81916da7c7e6a85

SHA256
bbb9873109520cce333a4c5cd846455253582f29ebaf6cc5fdb9bbbbfd8abb6d

SHA512
f7041a6dc2fdcfb41a9e939c1b0fcb0482d65053a9012d7ea0d2e078d71c7fe97f1dc794eb80aeb79b8fbc542a517d98bfa680af82d7d9b90611d436ce72c327

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09c4501558b1986b0d1b68d8d920ed35

SHA1
84ac73e23985aaae5c47f70bee786d23b625c8f7

SHA256
3ce6acc670f1404915924afe50251ef244b3269fdebae4510d634a77a1ad4719

SHA512
edc15bdac9d0a95a2f3edd1b6cfc1cff28f69513f27efb34f0077c78d2f9ace38e704de53a9ec46c54541f84bb1f030f9a586b7a1060eeed5b05359a0fd40be2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2eb0cc6fabfb0a5c0092408f31c57272

SHA1
c22f30535919bc1bdaf51a801c882263b5332805

SHA256
85a076172ece9f57af138dbafc6bb7495fa4ed859a98e9a7bf4f848c34a1d429

SHA512
a739e9dc6f6abd0227500c47ee7254d3e1ff719c7f3e9860b8d01a278b965e8c40dab12e1e5d38d80e49cf6f61d9baa4d7dddd214fffdcac21ede6ab94e9278d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da2ec4bb5a1371814a411ef5c721b1bc

SHA1
3dcff73c903f8f2ea4cf18e45ce24975473d9615

SHA256
b733518d690211acc096143e10ccc94d8c7ae127dbe70172492990e30b2bf07a

SHA512
db9f624e925f58340302a4e2d32b648a357117d0e28105f76f524a111d9fd7f53fbba8fa0f44e04af5a791c470950a161c6a9b953ee7fe56d7bc2dcbb17ff4d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7591ac3daf30f8213ec2178730135e9a

SHA1
0ec458bc01d8fe79fbbf1095febfd8b4b353aeb8

SHA256
5ef838f6aeb4d529cca57c73bcc579e8a97f4217fc655a2a8d8de1a585d75b9b

SHA512
fed0cd485a8340b361302a7d6adad1bbce7b2a839acdfe3feef0437c9d48c8ce6d7b802b88a10c9684d947a9484a1c21096c03a745a718ea16f915014c54c422

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d39f844aeaacd42a564a52a4ed15106

SHA1
f49a31796eba6a7a0910421a97a5773f7334f6af

SHA256
3fa5f84475a898994bf9112a3642453c076e9d4c9e8d830ca548537dd7793844

SHA512
283fe8a6113beb35096a55fd4e02ed45dfc8522a1235654d88b03febfd9d38fdb46a4ee8933698fb24d12fb6c35312550a083b98b935fa03bef7f3b5c5b4dc00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89b77509c4f4d207bddb2100033c8b40

SHA1
f8446e7783dc534f1aac000bd33ea4fbef44179e

SHA256
82f825b822d063b65080848cdd7908459dc1c99d297b81302bcfea2ed855d356

SHA512
65695cb4bdc9971ab23103e29c614f5ed70800d3c492fb5dcad7f51f813aed4b44ab40763fbd93c4d16fce109642614fbd12a1dc25b9e50b9669b6354bda0a77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9635e5625ef6f691d880391236a45a0d

SHA1
7339768c8b6a738c5a0b4601dedf79f100a0d626

SHA256
97753fb81ed372228223fa3303b46656aceecf761a48ce969d2ef451dfb7c1d0

SHA512
d634401323a3a1ebf13a48849d7027ec0e5f4a2361c066da94856d4cdb8c69c9534cf491f6af21bb6a6483a5a6c6a0b1b19442d828e7a6dd2a0f08742b5c28d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9031.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar90A1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit