1ff8f20802852f6f2336224bec77e943b792755123d4de7e8d9d60b22ee7c013

Analysis

max time kernel
149s
max time network
147s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
07-09-2024 23:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d314a4efe648333b64d15e9754587447_JaffaCakes118.html
Size

19KB
MD5

d314a4efe648333b64d15e9754587447
SHA1

f956804175f122565c6ef4f2034ead22b36811fd
SHA256

1ff8f20802852f6f2336224bec77e943b792755123d4de7e8d9d60b22ee7c013
SHA512

ef18d01b25cc2d5af3b15698ae044cd01ae73db9b8fa5d9681a2619b8bff0e4891644b7459490d497b559f6cd0dcfa3f20d2c486b46ee80e21281769f0fc3a6b
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIt4PzUnjBhR782qDB8:SIMd0I5nvHtsvRgxDB8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B264ECC1-6D73-11EF-A567-DA9ECB958399} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431914783"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2344	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2344	iexplore.exe
2344	iexplore.exe
2756	IEXPLORE.EXE
2756	IEXPLORE.EXE
2756	IEXPLORE.EXE
2756	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2756	2344	iexplore.exe	30
PID 2344 wrote to memory of 2756	2344	iexplore.exe	30
PID 2344 wrote to memory of 2756	2344	iexplore.exe	30
PID 2344 wrote to memory of 2756	2344	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d314a4efe648333b64d15e9754587447_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2344 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb6725cd0c4fe37fa6850a9bbb7ec5e6

SHA1
512e9c102a6e3db7e2b9515659111819c5ac3f5d

SHA256
14d8d5a67d5c3b3dbe8aa67cacc82b8bc896c9e893ada485f43a97fb8b91e0d5

SHA512
4e166f67a5ebe4cd57d7f1a3cefcfa681efd25abf2ef4aa525c2bbd8be63f8ee1806cb3772a02387405ea5701d0cd83d4eb2fe3c3f4e6496ea95d912a3dd215f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9edf09654465d14fc09b4b04dd673670

SHA1
72165684e5c68f00265107a1862101f63340e411

SHA256
aeb0d16d3f56b84876c38923431e528056fddde0ecfab58d4d8bd7d88e719bc5

SHA512
4155daa14b741814c3b9b2ec6ece9bb1387bc2a81919584630b7d5a23b8a255f01685c65f1c038ef62798888d1f9c1dbd800566b2fb055a0dfe309b165afb175

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cbad9f1bbf0ad34d762d0e40ed72f070

SHA1
d1153ddae1fac9a4cf65321259bed942f31fb54d

SHA256
70978490fac03175293d6f584877348865e566eeacdacfb345b20b627a9987ba

SHA512
dc801cf83210978fe108024915017e27642d514ef536c0e5b5ebfed5911781731bb6e010c03bf63c52a314ab3a83efbd491a7972e2dd4046f87fc872f1271722

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d95d60fda16b1b02085bee4a2931193

SHA1
6faf08d2eb029ed28d0fe71fc3970e0f81319b14

SHA256
156b953bf853a399685e66f480cc97c4b41b354045d9d5cb2bec103de8cce119

SHA512
e3037e0cd66fcb29c3edcb4506a0a5edc168ba0dfa07c5d2752c9daa325f16f8fa89aad319f114092f937719b12aa5dbcdd75340968ad86ca86f03f2afd5e089

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81e5884c1001cda869780c77920cc3a0

SHA1
4516490a0151af7eaf5cc7efec984f5fdedd8b95

SHA256
2a47ebd5031735e4bc737c6d98b937f9764270ca865f5544ebfa50f52e0c569f

SHA512
f20549acaa78412623eaf5390c51fb2585ea866b2a69a8d11a8b46bd65c30bf20da5817da34866ec99bd7a774a1df005fd4af58b1454b9b0e12f004b0aa8c067

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64e24814afb4bae834b26596ca951203

SHA1
15f6455443eb2b09561776caa91a567e564963b8

SHA256
8f1d3ff4b723eff9917abd5f102f7d76c8d6e166eba9d4c9e5728434c39d4652

SHA512
e234980d5c6bc1b90577f40d0cf85ef493c36441504bcb958a9ad74555328466e681c296256631609203513070a7e322f60f47ea947daa079bfae19651fe1693

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e6e167f553e0cc083dc878be1b33971

SHA1
2a64406e479d3ec62a1f923e143fecb8aa495085

SHA256
bb06e416502f6d7fccf1dfd4bb19694d3a5d0fd328fa20bcdab31522a04cd028

SHA512
ff5f3930747af2f4a92a9c3cc2be1c6fd1454902b27b8dcaab9a2bf90cfb01c1291d82c8450c5904e9e285bb17639cdf690a010d8b1febf7e3b72c49977d89d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16cdba3412903657d20438ab56eb1fb5

SHA1
736ff100665fdc3a25c2af9c0b1c5890e6b0d8f1

SHA256
bc6b429d1c0889fa4abb282f5a927b6393589ece250494fe14e484620db1b2fb

SHA512
bf1965b8f91ff51e1f0359eba0c192c1109dde84d2faf77ad05d9b298d16f1260a07b933276e420afaae40d3f59ebd6a0facb2ef175571403649409237ea225d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5aeb01f00371524fa7c139249a92b52f

SHA1
b2147646ec5caa5d2b0d8566e9d6b8085234503d

SHA256
dcbf6741c4b76195797d92dfa5110417e42bf9056d43f21d2116ad91b3b63f42

SHA512
9b3c745242d20ce9c11269a6827deba923d27a167f651c1e162a4a93b40548db11b748fa81a5803ce31f8f4ade717de07f939b8634cc3e32bd0bd3ff9bbe5a01

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab82B8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8368.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit