c5590e444561443f8dfe50a7e856715c6a0c393a437dd14790c6019ea6cd1e2c

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 22:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7363ec15b71b00198d507fa3b6889e7_JaffaCakes118.html
Size

42KB
MD5

d7363ec15b71b00198d507fa3b6889e7
SHA1

7de706e2c50b553a7120babb221c4293bf0bf6e3
SHA256

c5590e444561443f8dfe50a7e856715c6a0c393a437dd14790c6019ea6cd1e2c
SHA512

269c5816f4a16bd220c9a33ef60dd49c07649c32aae040ff63f1503bcd85ebaa162a590f9bd49eba68659a3fa72774d9cd4dee5597f99624dfdfbb0cd94a6ae6
SSDEEP

768:3l9DPyQnNVdr4MyxABpiBLwtgokOXem7uKeN4oADEgx+4yN:3XDPyQnNVdrfyeBpi9wmokOOAuKeN41u

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D98D70D1-6EFC-11EF-9917-D686196AC2C0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432083640"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2400	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2400	iexplore.exe
2400	iexplore.exe
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2940	2400	iexplore.exe	30
PID 2400 wrote to memory of 2940	2400	iexplore.exe	30
PID 2400 wrote to memory of 2940	2400	iexplore.exe	30
PID 2400 wrote to memory of 2940	2400	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d7363ec15b71b00198d507fa3b6889e7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2400 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
234948fedc1166e7f81c83208af1f9cd

SHA1
16e2235531ece6b281ed3ec272fd703da51872af

SHA256
ae529094981be12cbda1320220913150a1192b481bea0011c395559b1c828e57

SHA512
5e3535d59e3e5874b0ceda1b63cf8495276ee9b47077a064c0c214ec211bc99505f9e996b2fd6f7cc25ec3312ba1dee147b9ee8046eb7db65b144044aa1f593d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f28938081c88703e3e53302e1e0c8a01

SHA1
df053efd984d15f461ad84089d10159780e6af43

SHA256
2a7287d5ec97ab46dec53a060f319d5a98e7b11aa3f88cccc3a5ca6c17de67fe

SHA512
3d51d727fe274fd1ef98512b02bd7106d2f85b9e03aefd3d003ec0021735292cd0b7e1e09784a7d10e62f1fd5d28ca807f6b2e4651fb52ebfb313dad0c81cba2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ceb975f8aec338207458533f08ca723

SHA1
3e559a11c0135af9037961c375ee1825bd1a93e2

SHA256
832b61aec6840de0d9346676cc19de9082cbc72106f3728d063705665b029fe9

SHA512
1e56c82fd33d7ff626ea2ab44e0e67cce6b771aaf7aafa1c3a07ea4f92398639c3e77c83d030b0402e65fa147c65132a78465fecd08ca76e46b8873ced33cde0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86e2e25c60d36c4a25c8873f24ee0bbb

SHA1
b2cf0c9f62036b2930ecceb1a3ea1c092c909e28

SHA256
e4fb419aed41b020c4d8728d87a9af93d52f5618e4cc7e7c8b3b2ddb64751ac9

SHA512
a30d48a5d6e257a590cb0e50088cfd7ffbdaa6f24e8b8165e23d982547825a9de66f851ecd7e708ab7126bf149665b7c4d9e8bc34e6b50566714ebd0f77c4cd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef4b3a582d2f6e416e9be2f322f69629

SHA1
f44273688d1a75775ecbf933fe4a9bb9f27f4dd1

SHA256
e7503eb6f8d95239d8d54d12c25ddb1b74f041a50baad23036e0ed7acf44eb7f

SHA512
ee2ee5319862f78e987eda1a07d1005ed65ff0b474acbcc2bf3336f90f6ce2673aa63630db517eb29100569eac446d553829e62e9f89989d2456879522759ede

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ca7e6d3f9900c4071514f2d593dc2e9

SHA1
c203a4569a373cbf813abf3ae91d72c7f77d393c

SHA256
9b1964d755c88590a61792e8744a29c365934474ce0cb99af75885c0b3f40c92

SHA512
7abc0155e505fd8b6efa8e62cf97964375c90163874fd2076ef02e3e7f8caaceaee16184c2685c9ff47172469f7b2f7d0bea143237101f2ae76d4d4dd3e66a3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4057a24d714eeea7467ee648c355881b

SHA1
2e44201daff91642da40cc2569f12d7cf8801d43

SHA256
de75a438f403aa2ab9b3a524b67c66304f5c1a49bd97186fe76af46bfa99a65d

SHA512
4d9ae9b02261b656542150422c0b018e97b330968e1d6ed44d688c65de6eeeb5cc49c845fedfb56b16b0427ba18a76060b5527160eab27286f8ced6ec0a822a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9478c153003545fd540d80c78d973909

SHA1
db4c7fb962a1d21d44c2d1d9625ffe2ac8c9a573

SHA256
6eb34b49f20b906c5329beccdd37e1617ca57aa8101ef0305057251a901ce669

SHA512
b4814d158aef65605bad5c5a0d44b785f27d54dd15e05a3404b43123aeaa6e9b7aaa50f1631c5e0cf47d50a67cf1ef97cd8dd3da28ecfd89445c0a4762d515e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a6f2331d16503407d46526f6cb074e4

SHA1
228acd0287b12fe4266ac945fd72299f7577d7c5

SHA256
2ed205808468e31a0adde0d19dfd2a463513ea8f77547d154500247f781bfeb2

SHA512
f4649866f0c2b930873cc6f24dbbb54b9ad3e98e6484f1ce1c4afa347437beccb863b99ef9b7d55d805509c08b7b587e86c9ee1994a0d998259ae367562e3a0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2fc78038d5819754a371c05c444b06ae

SHA1
9c41c90c17720f9a0b7d13cfe6247a94f14fc966

SHA256
266ac2deb2bf00cd87bd7d5178f7e6a44d16ec7d3ee7fbfec088af8c615ebe7a

SHA512
9282581ca5b4f4752ee76d89e24c48242d74f06964ac6c89f8e7e02025b813b0f624a10534fb8c430c421a56135801cd6a089e505efabacf1c9f7bb1564b749d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab731D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7320.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit