2b6a68fc87151fddc6ce24ad77ab04a31e101d594d2d38c62cf651d5cafa7aed

Analysis

max time kernel
130s
max time network
140s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-09-2024 08:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d1792d55ca7e71e5f1e71fb0541d185f_JaffaCakes118.html
Size

19KB
MD5

d1792d55ca7e71e5f1e71fb0541d185f
SHA1

def184e2906788e7bd3bc1ffa4ba72684f15cb51
SHA256

2b6a68fc87151fddc6ce24ad77ab04a31e101d594d2d38c62cf651d5cafa7aed
SHA512

0e20a853b22e20544903443ba299b12bb33755948c0cbbfed769713c5afe623b690498a8c8d455df9898a95ffad9c1608b9871d1f0816eae9f87ed940a468554
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIL4JzUnjBhr982qDB8:SIMd0I5nvHlsvrmxDB8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2C07D661-6CF1-11EF-9E32-4A174794FC88} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431858723"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1796	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1796	iexplore.exe
1796	iexplore.exe
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1796 wrote to memory of 2340	1796	iexplore.exe	31
PID 1796 wrote to memory of 2340	1796	iexplore.exe	31
PID 1796 wrote to memory of 2340	1796	iexplore.exe	31
PID 1796 wrote to memory of 2340	1796	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d1792d55ca7e71e5f1e71fb0541d185f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1796
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1796 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
abd92ef1fb62d6d6cb6b9b6a895642d6

SHA1
a892c39a120f2cdf4935100259f13f00e3db9a49

SHA256
7ca25e1fc207a4791c4e1dd639c97f283d1383099c3449a2b67e7b4453d3334e

SHA512
c2c4ed8be94d79a6951f2a80c36c2cbebce6debb7cd01521eb97c63a8d47fa2a024ea1793912538e99d390044042db31b4dd7a4705fe23659d49d5ac335abcee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a315bece53248a84b43e7ee223d15cae

SHA1
b822c765c2de3bdb6609e748fa6b566540e7a978

SHA256
0da1a9cddc9be715a04f8d5c086d74ef57cc3dda3c718ef22568b7f9e0a233a9

SHA512
75cdab1a6e1240d60524ec6a7d9e44c18126bf9fe090f33c5c48fa9b7a0c3e0b28fcfdbb2c4e59964c67cd4f78caf03e36b59a33671ad503dd2a2882a7ef1d01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
634588b38923e10d8fa879b46a70461e

SHA1
7617550cbedec8c67985168acaa3f906aa75b20a

SHA256
744154177f7b051cc2d2cc0738812667ca901d62a369bb25d8aabb6a29c56c2f

SHA512
b4d18424bdef7bd62de5b8b55571c2ecec23bf07b8bd9aa30b69590b4958c149f477df58e7469637848460c9edf2f2c9b1d086d2872099cafc64a022b446eba5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66e85a162f7814d12e503f4ba3101f1a

SHA1
94676a0f8b8bac1252be2d4a5eff9c0c8eb02705

SHA256
012901800ef5285d17363a39142cbb0366948b30cc9f107613ecdaff9cace411

SHA512
01e877fc8d7ecaa334291e8fd2f889a3c93ae85369f3d0a83f177c5a04f6b8419e579d09fa27ec6e0f0d2ba89d8e96ee9979cd410244226a9c69b7a4aaa7be5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5da7d553c9b797291086becaf89dfcef

SHA1
6c8ac98661fe666a679badfaef2a27bbe5d6322b

SHA256
69deafb4068f897aaedc61b5e0ff99c4714b5f181c520d77f58f25a998f6ba39

SHA512
8e791b39347739e0edc2a56630c9706f00dc016b51c0abfc0625d762df39131f0a8702ffa5f163ee87ccb72f7b3a3cdb0e0d41fbea07e4ba20568f53b4df71d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
646716a0510d7078e098a42c6948c1c1

SHA1
5278583e28a0c7049d9a83251e5fb68bfbcd0be1

SHA256
746bc8c0f4b3c5a15b6d0d98dfbb38d7b044f1a67e9f36e4bde13860dafdab55

SHA512
f65d17f2f9d8541f5045efb89663e0e4688bac6743a706f8c231f470d151bc466c78feb065c82041db7929de110eafd79764dce65a25a0c900d10f18c38483fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42074787e8a99b284f3f5ed4e6d07e0b

SHA1
9be596ca22a41d3e040bbc48e85a7dca4bc76950

SHA256
2cf2615fc159e9aded50b68c44d5591f3afbf9c8af541a778eb4a77f42c54ae1

SHA512
b6cd3105e6f5da07d25d89df01ed04d48131a60db73dc2dc89f91472bc78d642a892d0902feafe199b0f876d6d328e3e06d77f9ad92334921f9f190f62d02299

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f364c1691f07b8d07cae53e6a2d4c9c1

SHA1
55b93b5faabd7f36a7f9615ec955ba4f855ce2ba

SHA256
7e2210eda5b39d074cf51afbab07b048e0c26754c4813226f4951da594de1fa2

SHA512
c1540878b4411e46a0f659c3bf1c4999b1fb8ed0f0a1f891c71b48f267750389829b5b11d0926a3c14517503b888f33a10736b73f76a9ca500aabe2557dcae3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a182503927363ed931ef1e1af4727c10

SHA1
46490e347ccc2367cf0b4963d8b695fe379b5dd8

SHA256
2bc9753a630d721c4aa807d27eb31658a3f79a021cfc2ebb693ca50800973036

SHA512
7898b31975b6d54d080ce495febd6901cb4eea4401267cc66393e0f4a05eff1dd9b81634bcc87efb4688da0252bd671ad5e489e89eb5634f2030bf7f76292d7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDA79.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDAF9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit