5ffaffc7e6e3da5dc3c1f3f2946b109ca569540aeacf3846a301cc0f2a939a8d

Analysis

max time kernel
148s
max time network
137s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 07:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d5e5491aba7350be501eadaf716c34b9_JaffaCakes118.html
Size

20KB
MD5

d5e5491aba7350be501eadaf716c34b9
SHA1

2e64666e9da751e58e76efe019d443705953e4bc
SHA256

5ffaffc7e6e3da5dc3c1f3f2946b109ca569540aeacf3846a301cc0f2a939a8d
SHA512

88a330e17325d894d3f0789279070b4e3e2e345192d929e3e632abe48bf7c4e0abcb745a77c764db86549b0cd7cbdaafa2660c491d18dd897d71a0e9e1936fa4
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIt4fzUnjBhR782qDB8:SIMd0I5nO9HpsvRgxDB8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{92BC4281-6E7F-11EF-AC25-4298DBAE743E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432029835"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2604	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2604	iexplore.exe
2604	iexplore.exe
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2204	2604	iexplore.exe	29
PID 2604 wrote to memory of 2204	2604	iexplore.exe	29
PID 2604 wrote to memory of 2204	2604	iexplore.exe	29
PID 2604 wrote to memory of 2204	2604	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d5e5491aba7350be501eadaf716c34b9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2604 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f31de664dbfe63f7888da42375c42ca

SHA1
961fd62d63ecd7424ef9b02289171b309e166bb2

SHA256
05f701e2b42eaaca5f39092c89018c611cb225a6d85df1dd6cee91c4ae74d6c9

SHA512
26787ca664095c30baa21940e9cf7f68e7a853697031d5290aa815f61bdf21beec05bd9171db5bee7b8429d88d8b720c2b3f47c8d5ef6335eaa4ed178db1ba54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ddf73a314cc22ccedefc7a9ba1a92da

SHA1
d46c6969c7fcc81a1b36e442e7971a160d95508d

SHA256
227be52b30ad6b3e64acd01a723ab15777f272271a69dde60c8f306cb3c50631

SHA512
feb9813df8970ea9fdb95bcf7dd212d48733ba335d7d15a2578f2a4db02329174a96dde7e7fd54ef936353c0cae3589024a620b2c9c8b9b1611a7c9c420286ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f5ba18b7308e2a44db1316882cfa66f

SHA1
fde875f2c13d92bb09a873959c571b4f9b5fc9ab

SHA256
4c1716b272ec16a207ffd965ff2e23f006d8af42ab5e6d3e51465058359fbb18

SHA512
236e8df646401bfee3adb39292c93f5462d690b62d6d973c0722ce2e9666aae80af2e458ea72257e5bceb37500bbd6ef319bf529983bbce372f0ef2e31a4dcec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9a84ce8b97e0afcff1b9fa0133ab580

SHA1
01fd90e8ad85ab61003c3a15b0e0a96129d5efa3

SHA256
64c8fb482e2e8f9d1dc85f10311144e2fdc29f35e57a6fbdde685cf27a1148c1

SHA512
89a93f104b61f6410c85a5465e09ccb1c02bb58f71d9e518b1b1e3ad06022a5dc90db7f06219387132b1133d225edc9f3003b5d66538f09ea97a5155fabe3b9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98a69a17bc47848969998816d566097d

SHA1
ab9e7b9e8359b343c725ae62527d19a2f907109d

SHA256
95e4b5b69edce7b4cf5be069a949be8a188de07622086dc2b90b7969013c8cdd

SHA512
1f8ace6bc5be1b9eb2d22ba9729d7644beb0a9e9a0bb7eeea69096360a3a61e168abdf784745f18ea7f550689e6dcf33527e46d47aee4636ee1cde1c754bb091

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0776ab28edd4a610ffda61c5ddcd6670

SHA1
25902d2d0b0f3e082067b2761e951ba572a82fe4

SHA256
a01a5e140ba853ebd6abff7ae03a950128ff1417a9392ceb3bb4329812243fdb

SHA512
280eba8d8bb2a488d474c1e4792f9988542c0c99ffee0823f84c91a4a4f8fecad9dbabeb89aed92fa992df7c4c428a71ad2224ace11ddd96f1fb63541ff258de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73da478652eef15cc12939bea864eddd

SHA1
49a42d590ad9ee2c5d39feb4e2bde5fc29b17c3d

SHA256
0f585fe68007d1130388356ca93cc22a8ec2a37c47d413894166a64e3a4ea0b9

SHA512
9078aa41bcbbb9cba87a18d57b9b409f87bbd2f8b441edc0a6a5da9a3484204d3a06a04d78b7853d18d4d68bd9d2dfd61ed4985635777fff1097d004bc682835

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22ae4318d626eb232aeac205105e3537

SHA1
8f9a46c4df407ba750bdf5371fc208f162a8702c

SHA256
33ee1a7672f83d62bf04a2a9624ff9dab4452071b014121591ee11c9acbbbddc

SHA512
149639db347e19c354af32e26050e9612095798a4cfbfc63e355804401202f59e2259a2c97b055c36106a82fc2a764068e62e75cd37ffbbadae3939a8302c884

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
389d6654437cea5105e23c20826b6f51

SHA1
3d53d88211f339064a7a75b1b51c93e8fd7ebb9a

SHA256
7e7834cd5bb37b6fc0ed37ba7f8a130f0a8192b825f559b152b8703bfcc86a6e

SHA512
dbe95cfc55b5b5849e5c531eb08146c35af9771668ab6c09d04d5a3e19352e70043448222bd2bbb858a928c55026f7d5de7a10c735b26ace504a0510debf159c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFCC8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFD29.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit