29e00e4f7d44caec03f47ace207a5d09cb5f9b02757678dc57074ca54a4ba36e

Analysis

max time kernel
135s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 02:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d34df9b908c11d824d010c2b8fd3a221_JaffaCakes118.html
Size

142KB
MD5

d34df9b908c11d824d010c2b8fd3a221
SHA1

f26fc6c2001d2c31412fe03bfbf98f5e6b09edff
SHA256

29e00e4f7d44caec03f47ace207a5d09cb5f9b02757678dc57074ca54a4ba36e
SHA512

959658042d0ec4792af3270d9b96806c1ae712f957660dc7072a376128f5eec363f3370502674683b18edce65cbf68b906654531d4175e9abb10788c2caa597b
SSDEEP

3072:SSuq3/nRx7dyfkMY+BES09JXAnyrZalI+YQ:SSlJx7osMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C68ED261-6D87-11EF-AA6F-523A95B0E536} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431923408"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1980	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1980	iexplore.exe
1980	iexplore.exe
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE
2184	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 2184	1980	iexplore.exe	31
PID 1980 wrote to memory of 2184	1980	iexplore.exe	31
PID 1980 wrote to memory of 2184	1980	iexplore.exe	31
PID 1980 wrote to memory of 2184	1980	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d34df9b908c11d824d010c2b8fd3a221_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1980 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ab9dd40e8887f510d5e2b80f2a1f6cf

SHA1
95fed0afe069625c91cb8f6ce5547a433c41e57b

SHA256
47d41da6686e869c25b3b18322c0418eff060a8fac114d9f58c1665a1e7fbb8a

SHA512
a3ebda330995864465a7e3ac195dd0a6ae773d0e9bb710703c632922a4c4301345c28c27b93db2574f923c2917b76e1584d5d2d770b652b101d308539b081a53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
138d3e0fd9defbb1bf76ff3aa863c11e

SHA1
2cd31c24d718eeb71dba83c71c11beb149c057fd

SHA256
a28d3b28e4ca6142a23e6ada0c8c3344df19d0cc30226fe9a3dbfe5249ddf68a

SHA512
4ec3e0beed2f443a31bc2c73a2b55e8d3784fb751157ba46d9238fc452d8225221f49d41a068d97b6d1296a87d5e5246599c4e072dd4577051d3e6bd7da39c40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf3e2382c86b3a03f0e4b4b9797a1925

SHA1
29185b44800b6f12649dff1a8ca087df0feff9bd

SHA256
cb4185d34419614ad42b81005e715bebf26255dfa6d52887ae6135f45a7db203

SHA512
f98b7c35b336b95d966f02ba42a979da7fa182d45530ccb034669e94a70f4140e39c0868b562b04a7f70e23aade86c15e273d4e24c0a3f3c1447ab043e956a16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c146a21b8a9dc49ab9ac52a668f0b205

SHA1
a36070d0741b95147c38f0df8f2c0f511817800b

SHA256
94e5157f73ac9938bdeb24cc7ded318a8b8d2e321085922f190c681986975cda

SHA512
9030b6a5534afa7c37f913a0d383cfd11877b1e6443e21f58781e3f20db77b3a4afa966cb96b4b713ca0a35da93b843fa7f18b9fd351316b9e8874d094538967

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be4f3902e2ba0190aadb1c66dc6c15d2

SHA1
d2e806850879a81a72e5a79aae3e1f6207a10252

SHA256
ea1bd225e24ea55d6ccabb70b2cd8ef7743ab0de495bc0857e1013684ddc606a

SHA512
0eb88297bd0f9270c9fd51b9456e02a706e3db19a14e52320ce1a07bb87846c773c107210f3e534bf1ce4a7925cc9b1e48dbca637d70201f7c9793b993dcfeb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1e252cfae67ff71c547b2a8d6c7bd76

SHA1
d76c9cbaf920b892754e20a480555886ba369bb0

SHA256
f5bb96811accb84a78f363a509543ede2fdaada09f0c5d2f6b4f18260749cab6

SHA512
0d34368d7a80acf58708e377d5aed5b5dfc554e87fe8c73b1bb644a86f75760bc6d7964798734a44f720fc180b81da8552185e9d91a3f866b2015ee0641f56a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c4ce2202f564bc3eae736d7bf13aff5

SHA1
0b3f7235822c1b42ec66917ba20e6b2ee218a6d7

SHA256
876f85f5b6f8ade839524e839adaab2060c50177901b0677877f24c6d93b219a

SHA512
1bdb337fb4b139be6e92476da7228b44263bd2575c5dc8f6a23158fd1ffbc58cec3e8fe24d0ba6fc987d04da968b9e64a66b1aeca54f44c232938dcdff01b12d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56ff86297a7f00b74951dc53a6d6f2d1

SHA1
1ca2e4195b8812ee6bde5b43c3f582033e86dd36

SHA256
da580ba8a089afb8753390d03c059c252e0cce53422d2afa9defd34b6f78b4a2

SHA512
7e945418e7c92891fc5d4665901d568065d4c2b1e44044dfc22bc350f47da3358b3800f231bbab7c38ddf49c126a01ec3429b83c578732bbdd7b314d846cbb2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69535cef7f6b9589390f8a8ff93795cb

SHA1
d273b7d1d1661e7853c4a1530a52cce6303e5890

SHA256
1abee8baad033553c88134447212e4bf878bc31e7defbdd92635e1722b82172d

SHA512
7afb25253291cbf8ca233431fbfa11c7f8449a9025dd9c4a9523a3f7b223527a2bf3bca9ba8ffddbee1c9723006cbe8918f663f21283cd494439399c48380594

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE504.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE5D2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit