2d7a170a0cc4c348890aee00cd9aa6e40c5a361962b2bc00fd93348de39534f0

Analysis

max time kernel
128s
max time network
144s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d22bcbf38b989e5bca6a509b2690cfe0_JaffaCakes118.html
Size

11KB
MD5

d22bcbf38b989e5bca6a509b2690cfe0
SHA1

b7aeb940f81f33a959fa24bdb4a9ccb112641250
SHA256

2d7a170a0cc4c348890aee00cd9aa6e40c5a361962b2bc00fd93348de39534f0
SHA512

8e690b79431c8517efefaeec4ec22722930c0f81a17122ebe30971489ae41e0524b0b62e45d9d59ee11adc55a09a0f944d5f04c9f913f4b1069084e7ece38472
SSDEEP

192:2ValIsr0r57Me2x4fT8Oe/w1wvqLkt1/6uBuLbdU8d:salIcIQbxH/gq/6guLZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4CEAA931-6D27-11EF-85B7-D6CBE06212A9} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431881971"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2568	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2568	iexplore.exe
2568	iexplore.exe
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 2172	2568	iexplore.exe	30
PID 2568 wrote to memory of 2172	2568	iexplore.exe	30
PID 2568 wrote to memory of 2172	2568	iexplore.exe	30
PID 2568 wrote to memory of 2172	2568	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d22bcbf38b989e5bca6a509b2690cfe0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2568 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f7a53776145adc26531c50835821723

SHA1
09b6084938419d2600e8be4106ad3b3222ae4972

SHA256
2a3564bdccd694c436f6f95b5a1224818e4ac657d3c80eb4142fab7ab9025e51

SHA512
f7511f04585e92d639c10c96e77c4b351be56192e930444906c55fc244f2997d4d42315aeda05694524b999f1f4926709ccf47df503ff11be22385c9c4a5e1bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4186f837f9e254704192085837ed0ceb

SHA1
a326ee46091418d5d6fe4c50a62541a8bf44fa47

SHA256
3eff3ff3ba8710450f94c519411583c269d84a830c8e21948e5abf6cecbad3d2

SHA512
e1633d8eba0aa2bd70aa24b3cc787326981dc71ffe6ec59f2cff52373d5a08ef0381ac79e4b0959464789c78a58fc2f00498383f639b958fc3909a6044faa752

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
501b3b921dbb90de43b56b7c67036c18

SHA1
34b99fca4843fe7954c4241761914e74d4c86a12

SHA256
8724104867d57bb889ae0210e5963a4e5cafc94bfd9377286f6eea84956a3c9f

SHA512
ccd1e80e55e95d2c912674e0918869f9b18f92d89c734fa4f6176e33b4d43d726decee82eca97ba561863a332fd8c8760c86b26538c3163ee476294542b4148c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd07c05bc5bfb26e274b2c237d7119bc

SHA1
ecac2ad0318005526e621471b6064c56a9511ea7

SHA256
4db826a86e6f51f7383d8e9b80e28a48fb2c82de8daf873e9905fcc03d1307c0

SHA512
10c8d4e2cb558d40d080d8648bf412a4f1f8c9f142fd8e9f52b1c21fe3ff7c7da238e25fbb3741b1668f164f5ab71cd7c5a32268297583f06c5ecdea80dd1f71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a3255b0082bb2c2e04c0fc53f973de2

SHA1
64837d9f11bd736ce0aff7a61ac3de423d806c1a

SHA256
abec4cd4430e3061aa02f28f16e6cf8f941aad0679935f2c5deaea6e1e406a9d

SHA512
8ea6dbc7e46ccf50fe0a7388524e7e70b214738698f93d837a767383de8819d6063c824314bb5309dead25d49fb8607656aedff0c6e4a13468dc98179a8c4abf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7cc5ef89166abdf2220b8e0601bdf94b

SHA1
15d504fbc2110645dcabd60d9c18300d50dc3e21

SHA256
cf87d7d576562f6ced65c2297fb6e1ff183cea3e0ddbedecdf4018e04b8dc9a6

SHA512
5c5405bde1a77d6853e8c6f95459f324a7c6fd05b502629f75bd73554c477fca05c9df226611ead95f97728323c79a1030b5c037ef7c82597d77f0632d48af4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb851d372f47c763250d5ee7fb910424

SHA1
69236f4804f1f794e563daf5669769ea7295e090

SHA256
43db59711bb50b3a815ac25f546ec0295ac8c88c26992a0d03d2b985bc2b54d0

SHA512
5472a0172ef7f9cbfdd09d1fd8060c78695c0c78853fd78f92b57b8fd6e3696c66942f7c6a91aaa326cb61ef3df85ecdab397de6a91208baaa4ca97d7dccc167

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dffdc80d3f54c6551b44babb89eaf78a

SHA1
5337e234308df86b16e0df2399ff58fa04ec3cda

SHA256
75c1d5c4637561544ec9e8094f30a64717446c0e0d250e3350d91a36e4d85785

SHA512
7a8bd4a68575f07d5a767d28bf8470bd1a9dc1f8c7b078c5838ad70393d96c03b585b5466e9a5dafc367e5253cb4b65a18b5387bd8f8bd7b3bb3584220a8b905

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c20c459963ed7c0493d6a34df4c4332b

SHA1
b90211026849decd6891ae5a9d1901b5c4e063a9

SHA256
f5fcaf96eb3b32006d677df04dd0726d1f0d4edb2f3e426ed21c23b184ab03fd

SHA512
986b56d504efa0536257396bc29be7d6362f3a31d6727082288eaaab6951610613efeaba7492394ec2b82f445f096455aef33109060c73c7114776b0a80c0285

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAC67.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAD16.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit