4d39e53636626470b8291710b0200a438d9763754558868c755ad8456ea49343

Analysis

max time kernel
66s
max time network
154s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 23:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d3029a72609c8fa6dc91aac344d0a265_JaffaCakes118.html
Size

19KB
MD5

d3029a72609c8fa6dc91aac344d0a265
SHA1

24f3336705b5cfdb4e9ac2dfeb67e618211d9e2f
SHA256

4d39e53636626470b8291710b0200a438d9763754558868c755ad8456ea49343
SHA512

566be546533650806c226e328b1a36e21ec6a8990e0f153b9fa6f757b0ede21640b7af50efc09a7191baccf4bdb8d016ac66306fd4790bd8b9de7dc55c9176da
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIE4gzUnjBhs282qDB8:SIMd0I5nO9H9svs1xDB8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2D51DFD1-6D6D-11EF-A0D9-6E295C7D81A3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
664	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
664	iexplore.exe
664	iexplore.exe
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 664 wrote to memory of 2776	664	iexplore.exe	29
PID 664 wrote to memory of 2776	664	iexplore.exe	29
PID 664 wrote to memory of 2776	664	iexplore.exe	29
PID 664 wrote to memory of 2776	664	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d3029a72609c8fa6dc91aac344d0a265_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:664
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:664 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
688e58b657bdf821e421ca15f0da970f

SHA1
199155e72c74be730361261903144132f007fb34

SHA256
c2f77be9ae6ae017fabc6b9585430a9505b0d1bb9bcdac140185e363e997b40f

SHA512
b3bf6c5fc890ee0e6d86e2333e4a18e3bea17e7a51ba90e82032d91706ed259b6de243cac649083101b38858f755689d9207ebf0b9d6e139c801b0cca2f0e665

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fdc2aa74af2f61ac495d353f29cbebf8

SHA1
08bbeacf24166d0a3a26f63d456af67000d86b5b

SHA256
3f9447aa40b911a347512b1b8294eec7ced75a2f9f9b8dd9a7137a5796043c0f

SHA512
7458a0ec131599414e3c6e69e22d8a97aba4c356f962552f55637ca14b2b4a01bda0cfeee8b940eb704cd5fad7b58d07eb74e06cbd4ec8e5004c782d65090266

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32dff9926ccbd8b97fe175298ad1805a

SHA1
717c974ee3dcb2ad04121270420ae721fdd94e66

SHA256
1c967d0e4a626f0bd410e6872f16b23cb6a45db156627bbcc3e2bddbeda01c9e

SHA512
fa4db003fa5b852c7384d723ea9b261baf99e2fdcfecf92d33b094d46f3f6fb8f90f96bd802e1759edc64c4cd1bcdf940c3203e932298a2527417ff083a58b45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0538f12c6883d9187573d2d58a871be

SHA1
4944230c2eb8062245937fb74a5a2bcbbf1a94ad

SHA256
4ed6ccd1dc9fef5e0cef3c50413d49fbb5345e391bf7a9bbeb888f2eb058ee32

SHA512
13444a8077b06418fead1d12dab36aa8912aa7e9ce8eb57360b178b61c46737c4e3ff29c1cc273a93ef0b86853b303f7a6043ade3156e52de2ceb84d4c426726

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
691af6b92a81794d97db9cf1256dc588

SHA1
3acc6b47f693380c2999bf77d04905e392f3644f

SHA256
4b8e12160abb9b2f61eafc6c68ddd8c2d9234d3faf638fe88fd2be317b5808eb

SHA512
fb36df5a394aa19892cfccc073486207220a582c5a6a17c886b29cdfe4153daf88e823e5c0dde5039eef5ae87c01685997cbaf19eda251fd9d04eb3d1cd801c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad1d986e4a6ca7a27620081a80b1f68b

SHA1
8f9288e48a39215f64aae91009ef133a3cb43d24

SHA256
d41b29a063ecb964c03e066c1e142f03d325c2fcc4cd9d67d9c38ffdbba75964

SHA512
e011658c4e783cc2ecf391109b6abfc069bba735729849bc028c714fea96da69e75a2f394064581464e6c7994a15985e6a311d0add2e7b495253ae7a0406e779

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9ac5016e0490b8c126513018dcecb3d

SHA1
bc7f70be091da45d5ec4259dcb02df9dcce81d07

SHA256
b68aab3431011d9b636f83af37fcd4fbfe82bfab8910abc9968f3776ce2fedbd

SHA512
cde1fd21a2c2186962e4cc8b40a0b220c85c4d74152797187eca6435fc449cdfa5ab41dbd3410b8faeb46f16653c455f9eb2fab0c8db3adbae2b9c57f9e4f0ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e4ad90ea5bb82c40982b1b88a223cef

SHA1
d9bc8a243256c0798be7bb42540c98f79f3badce

SHA256
a89dfb05c3bb82ff894b8c3c26c41690b198ed17af29b50fa133483c78a7c4ec

SHA512
4ad84b3fa99b757b48d023c74def4cca28eddadbc144043d13828d77e096e592ff1cc73d486745c100fe15434184c17c19b27a76ed5a7a6707efbfda89819542

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
052d6cf9d33ac1b138bb49367aa9bd33

SHA1
4f219b23f1f1daea8cb027e7c11790e46f34df59

SHA256
4991037ec5f5c9f847f228fa68ff6ca78139a339c703cb83ffabb65f0114cb7c

SHA512
dfcd6fa4d8cc0a1d98242e2df6eaf353f38ba0015b7a025609c35868a10502fa1c4e0fb413cfbc2d51aa2124ba1e8c1867a7b2df52544340aad0d662f51e0224

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF25B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF30B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit