9e704e96b8f39b90fa1c7f378c2b665b46e564557d159cb02db158256da36895

Analysis

max time kernel
133s
max time network
143s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-09-2024 11:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d1cc40e8977994e5822e8833eb3aa4a3_JaffaCakes118.html
Size

90KB
MD5

d1cc40e8977994e5822e8833eb3aa4a3
SHA1

9799e33b05fa8c7cedf732decdb092eb8f35e9f3
SHA256

9e704e96b8f39b90fa1c7f378c2b665b46e564557d159cb02db158256da36895
SHA512

0a53761cc568f5ab887d3a8998ec40602a5256d71f96431b0235e3e7dd907a25d31c25faf42bb2c77e39ce91d45be79163ac5f4a4a101fb295620e88ba6e0410
SSDEEP

1536:87HhlQJMDgP+Dbdh4yrJEy8Mjf1Qe+SJPl7f4hahANXbxOjh5dsdJkGqOs1Uchx+:IhlQJMDgWDbdh4yrJEy8Mjf1Qe+SJPOB

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431869367"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F456E761-6D09-11EF-8287-5EE01BAFE073} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2376	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2376	iexplore.exe
2376	iexplore.exe
2068	IEXPLORE.EXE
2068	IEXPLORE.EXE
2068	IEXPLORE.EXE
2068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2068	2376	iexplore.exe	31
PID 2376 wrote to memory of 2068	2376	iexplore.exe	31
PID 2376 wrote to memory of 2068	2376	iexplore.exe	31
PID 2376 wrote to memory of 2068	2376	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d1cc40e8977994e5822e8833eb3aa4a3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23c6f0acc720ae7a1f13d016ae72a00f

SHA1
e4c43c44aaa0d03377c9b1463e104efd82a7bc0d

SHA256
3913d512ec7dc299d388d69ccd9efe1aff9b3f7497bd72e8c4cae6a8435d5739

SHA512
0bbb54a6be154a508c024f080f8f5bb6a3c40275cf46d70a4a1df94643509cd767f57407c7b90096737da57eaad174169ce51207a8f468c590d890b7e0b70a73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
703298dbcb4e471d3d9e75eb1ed93563

SHA1
70025e425da29f6bcc73a7880e8d9064a942b309

SHA256
3b11d4fa81012baf83150a5dc5f016d6c10de09bf0b594185706ca4d2683f3fc

SHA512
480f90ec55378bab185fdc0ca5d7502662d36e8369c90d61af8d5ebeabf0ddfe61f07d5e89901bd47120e7fd83bdd60269c1b9e949f7ffdb542e6b8202a735f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6ea3f53e8a4054710206190673f79c2

SHA1
89a25051a213efe37082f87aa30cf4538562bf90

SHA256
5b7d06f9ff60c3cd08ef9824b078c816be87a772a53fbc076141728cd5fcc464

SHA512
c40133979739b9f32b9ef7ccef253cbb5fa80d3c3a9e0288fabe1222421f8944a26daac0974d30c656e5ffa24c92c6e573ff1799031fb2d0d9b652aae5260cbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17c2cde208164775dc3329b866dcf51a

SHA1
46785cb40c4562d4a9f1991d981e9d743bf35714

SHA256
5140c7f1d45c783d36bab5b9d53bca503750b8aa23c75c3915e3e9a0aadb800b

SHA512
64eb8f4dac8b37a6354c6cf5ed3f921c1dfc7198ccbd7d20214516774363ca4cdf6acb76f50cc51893a4ac0e957faeccfb1158ef926997cd4a55e5faf5784062

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97ea6728302f765256f0a856bd5a7d89

SHA1
55de88fffd58de41104ab01fde282af6ec003a79

SHA256
aa1a1f172449363ef0dd8db11545be486c39fbbe7f481f0097c1c7804411b3a8

SHA512
7d100cfd682d592c65803836042c33e6905c29bce239702c134d28f559d47d049a67f2d39b8a97faf8cf3bff91453a7ffab13ceb12e56e09e63b99f60f6464ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d7f0f74623fbed1cb4878caaae1f967

SHA1
86402f0da753d869332543c41f509b63bc1d17a7

SHA256
76b240f1d2066af594b61984a771745f03258975a8c32dc1b35bd520ec276419

SHA512
cdce8c2df638c08c71a16d33824309c0feb501a136ae9b77a3b11d920b706f36ea8e8a89447819c81b0af469f4849b7d4ea79f8bb8023c11f73e9ff75df4030a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64109e0bdb4ba9c0fb7f6d98ed4ebb7d

SHA1
df8eaf1ea3ae7764d362b57214bf69eb38e69eaa

SHA256
184a9bf9fda820790f469a81d0eb5d541dee62e07e27e4f5470e354275a38057

SHA512
ec2a60fd90ac40eea855441494bcc6ea69c647539ee98985a3d4e556cf9912de8a73c8c1cac787af65b4cf57cedff05084baf22b85baf52981682ff30d30eeb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e1da76b6067160d0556b1dcf79e068a

SHA1
28c62d18f5df15f41ae011d82b6578887bdec754

SHA256
e4298ab9da720a69ac59a49b31a8ce6571b10633da3921d102d1ef0866b28cb0

SHA512
66b1351301edd69becf517ad42e2cb0004faacc2a93958343c77015cbff5e3398b20d7df9278cabeecf4de42072ef4bb2f3a4068167d410732f9bf71480c83b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b5e66de1f4dfea19730bbd9e87fbf4b

SHA1
f989e931951a8762689454179fbccd12f76d0065

SHA256
d21c8c55476de0de54c83008fd8c92b0f2e7a5637121d3b8d027cc3041c1814f

SHA512
7f60f2d1099bb55f8c7d7faefacbe799f103b1eac82df2198dcb1d9842d41c66c88aa42fb82cb2ca04d63df006b3df70a1e405a9868fde987d7d5fe69665e1e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
089e55dfe41ec3c0d31caca240b88e6c

SHA1
9064446a20be8d2f0dcf915602f5c130f4e9d38a

SHA256
58c52963707b70035fc5858f458b0f1b9f0337f41066b255602e3f256a0b1196

SHA512
04c4fcaf357fd64e80f9f195b13cca82e341f1ec4950f30b6fca575fab53d1d9342bf1e9890d926c0bbe853195252c4e29954b4d68118e4342e2f43edb5376d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE1F8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE21A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit