a8ee3598f9d08150899379e80f5e22e36ee16d7a97eeca71dc8fe8e17031fa55

Analysis

max time kernel
131s
max time network
141s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-09-2024 10:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d427ac5716db8faedee2dbbf41cd7921_JaffaCakes118.html
Size

18KB
MD5

d427ac5716db8faedee2dbbf41cd7921
SHA1

45c812e19d16d3fcb0547c30606073e4dfe8ede9
SHA256

a8ee3598f9d08150899379e80f5e22e36ee16d7a97eeca71dc8fe8e17031fa55
SHA512

ff4013878547bcd4bd5d3666776d3f49f17c814cb2244120669d3503df75510086773cc9de3584ef79ac516a8c800379ad2f706efd5a4a99e2eb45b9282d13a6
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIP4nzUnjBhFv82qDB8:SIMd0I5nvH5svF0xDB8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431953356"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8114FBB1-6DCD-11EF-BB31-7694D31B45CA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2488	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2488	iexplore.exe
2488	iexplore.exe
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2616	2488	iexplore.exe	31
PID 2488 wrote to memory of 2616	2488	iexplore.exe	31
PID 2488 wrote to memory of 2616	2488	iexplore.exe	31
PID 2488 wrote to memory of 2616	2488	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d427ac5716db8faedee2dbbf41cd7921_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87e28ecefae38854318fe44657ed9130

SHA1
10a4a14320dc80e08b5d8c731d625141de646018

SHA256
f264aa4e0d84a4e54c8aa79e3463277768e06cbc51d0f7a04b3dafde87c5f2e4

SHA512
e625630e653a5146f8d7205f21a7a56168f9833ed75afdc31a6e0e0037b69dcb52f53fee4402db4212688f145086ed6e050105ef91d5f1bdfe64f83d84d2dd4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e35abe58a560b6318449c27c85afb047

SHA1
96b241765438ccd0f7804e3fc7a451d232f7187e

SHA256
754b8cdbf452152f70b65606541b1f9ab24106054419c1a120ca2ac9c319f19d

SHA512
c9c631ec53ba6409ed3fa6ab61fa3d1faf3c5adb0e533b7837f279fae2e464a7a5817ceff7e58c585d9ee6372b7e7bd14872cfb3356d508a191c52b786f71ab6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e620f19279b869be7d8e8c57d47ad55

SHA1
2b876ab5f46b11cb12675948fc9c55b8703be750

SHA256
99c962979f5583f8ea4e23a02fb1b88f3b6012cba8e50e989362c9587b35663b

SHA512
f0576ba10ac9aad5ea68ad0b8a16a85b2c6a945b08925a0cacd2c609c94baa35f1e201c5da22e22d84060a36f8a92eeadcdb30a86c0b1bdbc596731e767ce88f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76cf4f97429fe6f85bbecfe270992362

SHA1
daed52684f884eee8675cd1171e1fbb36f081a87

SHA256
af8bd2eea334dcca5b38fab09f9010b92113d46c13802a22157c7742323104cf

SHA512
9c937da0e0a6b1e030255c7c3cdc5bc4bf7627c6c06e22dfd7f2d5d631a8d1c08ef504e7d2e5f5881171a3f2a13c7807cdd438ed3d7b91499af5906ab19201d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2fc90f832bacc002c78edfe6eb5608fc

SHA1
91d40a3f446a031b0da73d7baae211152cf01581

SHA256
d9b841c8fcb427a15dbc9098928768b1e7c0948b6b5be8ccb4837d43aec91142

SHA512
26b3253424d4c9cb53dbed22074525805a38fadd8389bfdb6a19ec5e5fa57f0df856638710c1554990623a6b94fc67e65d431fa0eff1bafe8c62bbdceb794960

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
434e969bed5d7959fefc9aa825cc4afe

SHA1
9183e2ed35466f251f1d484769d2f427d52501b1

SHA256
818d447e546dac878ff67a2475e2246976e85fb3bced43abbe694cc5b14409f3

SHA512
30f46252260423ce43791fdb3950ef86f789c8f5f3e6ff284f6c6c98925ee948610bf6def76f6dceebd4d119ddd3e982d88757fa98c6b2d3753fa3ab7120687e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5be283b566380581e0bd9a32257198a

SHA1
b4c96313518b2cb067855dabca114ce9f3df4f66

SHA256
f49a1959acd9b4422482ac43e4383fd1200d7d1646fe8943e1b5d5263ad07fd7

SHA512
be499dd030689af87c46de3e7600d4fb6c0b2b9f04e88a62627f6da8001a836e0f96e42c2f718dca6697c0f395a7efd3f5cd6db1d2ddb25065306f4bf2fa4fc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f4925e07f68eb38a40f59e9507e5ede

SHA1
ca570446ac3d5990a73c93146aeceaafbc76532e

SHA256
a0418913d6cd55a8d63e84d1bbaabf6cd923d7103cd32e77009e70d15eeb9cdc

SHA512
c36f696053762ad004695f9b3c4a4462cd830aed1fd0dc146b04092d7ebb7de9de6bfe86135df190c8cc237e0bfae39eaf5ba386f41868535c0b3c7633c9aabc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
930734c13db4f0b0be0a46adbafb3388

SHA1
6474b80b69696f9317c4f6c2992bb381bf335202

SHA256
d153578f4fe7e8a8bba38bcf804c33c5e3d2706ad73e8b3ade1ca19a4a5da6ca

SHA512
5347a74fb7e5701565c8c6a204fbf1ef0c82baadd081ef283daeab607961827ec7d3dc2efa1cabc1378fda4905ca4bc6fca5e2ee69e4f4610926809c99c94a6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDB63.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDBC4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit