7b9e7befbf0094326213dc71657d1a7482996cab1cfdc4854291b362b588360f

Analysis

max time kernel
132s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-09-2024 11:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d44d51c8d4a585509381feddc72a2526_JaffaCakes118.html
Size

18KB
MD5

d44d51c8d4a585509381feddc72a2526
SHA1

d977d36ebf0ed087b9df343f3819341700d02375
SHA256

7b9e7befbf0094326213dc71657d1a7482996cab1cfdc4854291b362b588360f
SHA512

8aa6f0fbc506b12aba722e2271ad6e1de4b3dc1d8011661a6b8013504c1b90e2239658fa719e4b6710399158ebcfeec32adf3876fccb1f3509f628fd769ad92f
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIP4nzUnjBhNH82qDB8:SIMd0I5nvHJsvNcxDB8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2DA2CEB1-6DD9-11EF-B909-C60424AAF5E1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431958371"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2096	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2096	iexplore.exe
2096	iexplore.exe
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2172	2096	iexplore.exe	30
PID 2096 wrote to memory of 2172	2096	iexplore.exe	30
PID 2096 wrote to memory of 2172	2096	iexplore.exe	30
PID 2096 wrote to memory of 2172	2096	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d44d51c8d4a585509381feddc72a2526_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2096 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b8dff782f6a63240bbd1c19f753755c

SHA1
ab667244ff5c027f2199bd54fd5125a65df63a0a

SHA256
c8ee44b48d1089eccdf86bf8aa1491199328290ce403b608b6637b1919a5a878

SHA512
b48751e5609958d800dc8af0ce380ebf91a784beca7727fc7bab3ddabd10ad9c700fadc8576fb3b59d7681901f5c37b325af11a732679e7f2bcdac765ecfec50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de1b26be467356ddecb6abe8753bdfa8

SHA1
0628a99f28fdfb21e52ffca2e73ec9f4f7d02bd0

SHA256
44d302a2bf9187eb2c11a25496825ee79b06b0b1ddc23bae33b6edd08ede20de

SHA512
b1e15547e36773c965fe8ffa1191c672da246214d2a2b9ad5897efedf036f0e6efd157efb9757bd4fb1b687f1836449d143cbd27dafcd145c4b1ff4cfcfb7a28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05cf2e4478a31c19a597b710d08f7715

SHA1
0416f008b48fbfcbe744382a3bcf31b602285bad

SHA256
0b3d61ec2def5c18f64aec03cb43de73749733347fdf90e4d76805fb14d7c39b

SHA512
9e61f3eea2047db57fa1776e0f57837d3a25514e9372a179eada59dc917d0c0cc0c44a1505918096ea5b1e9d0cffb19c3332381d68b98dbb343b6d851acdda51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11552770e61a32cda7b474b59aeed588

SHA1
a07213033139cb234a5c7e91078df16a8639265a

SHA256
a57d14f3c450da4a7f52a537bd82cd663cd9338e54e27d1cbb45cac0130d3eab

SHA512
5599692d85ed87e91ba053bf3ac12b42d2e4a3d308807f58f038861a7ae5ffb25e0a27ca2a2ea0d84673e7acf9395b97898da80ffde5dd8b75ae842050742fdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
454fb4ad662c1f084ee8586b24463f03

SHA1
524ce5e334648eb60401f9f9b1ff599e8ab2f17a

SHA256
bf21326752f4cda0b31a4419a001af4e7ed2c2a742e5c5c412a3c8fea2d4b290

SHA512
97c6146a8d9454d1e5b3501ecfd90af33e0a52cf3d8f707cd5fd8cbd75280c57368cb1050129bdff771187c0ac3a85d20d36f39e47237ed8506bbd5135e9052b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15439038ef23e0c82a1e0f673285df94

SHA1
ee2be103ef613286d29db1e5c39cdd9102601c22

SHA256
135e0eaec0e93096b7ccac7bf2234d3588f30372a3b8de486ea349725810124f

SHA512
77a6e44aa682fbf401795d4bdbbe93de74032d3a7fa66431e20eb647c83c1f05ff72f896b6d4139505826a80f01352bee3087a7168cfd033b8c67fc476ce3115

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb925c121163c3ad4282f4fc5d918a1e

SHA1
dca524aef7a2acdf1f41bf19427edc3bff17e552

SHA256
c4cdb20ff69f36559f2c10933c148451681d09d075e10d74240ff338406e519b

SHA512
8db8ebad4141dbea35d94e8a1e906b68ddd72c3fd58558378be897e629483e9d5bdb074fcde9bfea4886063e653e007afaba87e1a4d8f11cd6e57890f2fb8c4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79c18e2d84c832fa8d4c99fb8f9d49fc

SHA1
e9b8b060e51a260abb455653b52a18d2d6d9e7fc

SHA256
8fe03f595a35d63750fff87dc6135401af92b147838a0eea9adf84bb0fe79a07

SHA512
15fdad97ceb691e731705e9f5dba276eefe976bcfafe956d1b6b4f87d618ad40fbc34f34fae944a82740c7032dee631148e8025ac46a8dd3b9bc9689c6134f77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a43b6fb6725cc03a009ec76fc1a6a56

SHA1
7ed3690b09c51a937add96e28b0fdd45d0b2f07a

SHA256
c22de854f5081821771703ca08f97c629e736eeb6b8322ae3bc762c2f7f29b20

SHA512
5a58853e95a148e8b319f87807ec50c987fcf81d3beedf0fcc78753c161a5c48da2836501b6f9bbe824dfa1a5cd3b3fd882747f6085ec0ce5b0f2b7c8298bd08

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC64D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC6CD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit