b8f477484e036abfab373c778d32334102d84ff2e4b0f7113ec4c43019f5ba78

Analysis

max time kernel
143s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 11:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d63b6e72083f9564263223ebfbbddcb8_JaffaCakes118.html
Size

19KB
MD5

d63b6e72083f9564263223ebfbbddcb8
SHA1

24964ceb5025b897c7582be0a57c1bbd0518a84e
SHA256

b8f477484e036abfab373c778d32334102d84ff2e4b0f7113ec4c43019f5ba78
SHA512

f4e9a7c1f07dad39eef5f8af1a6b69087e0f762985ff8a9ed1dbda42a161b4a054901ff03996c1ed769408a29214e1eb019c4ee04fcf0f0310dcb04b0a29346a
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIv41zUnjBhvh82qDB8:SIMd0I5nvHlsvvqxDB8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FFDFFEE1-6E9F-11EF-B6CD-7E918DD97D05} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432043764"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2140	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2140	iexplore.exe
2140	iexplore.exe
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 2736	2140	iexplore.exe	30
PID 2140 wrote to memory of 2736	2140	iexplore.exe	30
PID 2140 wrote to memory of 2736	2140	iexplore.exe	30
PID 2140 wrote to memory of 2736	2140	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d63b6e72083f9564263223ebfbbddcb8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2140 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11cc4f9b64abceb6882a2c7614ff2bd7

SHA1
da517e7bdc8849043be9fbe733c755decbf99d28

SHA256
4c303f248459d98697745a0b28f569443846b66eb19f6965f35f47fc4a59ba69

SHA512
018f0182d4aef75574a2452e54bcd8953be40e514f8a8df601045afd766a653d588d4755a2b90b43bcf580a8e35923c53a2d2c6d1890aa9b5c61f60695781d45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f051eae744bcfe91a725b08c35fac02d

SHA1
6115d5f1fb0be6bbed3ad865de72dcd98eca89f4

SHA256
597db77052f67f87dbfe886192cf53c41d831440973f8a8a1fffd34801ffca5b

SHA512
ecfeec825726b667fbbb1aa7106358b6291725a778891a6bf57c44612b42a452cbd57568fb3393f8843266d5e800fc9239c0c2288a3c83ebc7fc236f827b9eb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
232f6ae363711a03b49ca44708aa6e76

SHA1
d0e749e3d89a9ab8904be1d93dcaa389820f16a9

SHA256
eea734dba7216ffe344d4df634ae22d774ddffd6c82d0ead38c30ee2bfe46b72

SHA512
b6e0b3de638b68e51d250d88783a4be2db81db4f6c302ba4344b3633b3ab216735d22fefcb41a81e3b409f2976b207a3b9f0ee0e02160f1a11c90e2664ebedec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e1fa5e2e107c8324e3c1efe67403e0c4

SHA1
3060c1cb5b2875f1bb9f1e917c1372afb14a4436

SHA256
9d1b3ed3881df3926e6ee73297888d0e4aa8a82028787515fdaae28679bd57dd

SHA512
5d3074a3a78c7fbfe87980a0ea753b42907fd661d91bbc9717d82a09a5dff97207d69c4a73368a3a5159b35e74ab57d523e6bdefa76f3250e1bc885e66a6cb4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
303068a7d5bee9005655e926d0404bb8

SHA1
c70f12a67269fcf1926055ae6d22842fe92c01e9

SHA256
e79a300da6253010feb73c8446c493ceb8439a29b87a0c6a4ac1738ac8c6390d

SHA512
c94aca8afd7c411ed2986669cc0bbd25ab0eeaee387b8872da0335b0fadd1316ce4e797ff9a90a7c3c177da32ea8f420abd3e882fd1676483189bd94fa4f5188

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a1362269346062885f22e6e75c8ef56

SHA1
456833deccaa56616630f97f31f91550b98dd5ed

SHA256
3e6fe1f4d7d47ba36712c9d40a1222c8bdcb9f7ff3f297dda933d3ce17c8df4e

SHA512
b97935bc1e1c6f0cc7a9464278bc16373851ad90c7e5bd2b0dacb8e2e37a2510bc1ac7bcb8ee17ee60afd996eea8881d14d944630eeb569051cd0ff96f23a5bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
424d46be1887651a49f76265438dffcc

SHA1
e85a049d8905cbccbb07d0e3a1e4a790951a737c

SHA256
56714d13ac093cdcfe33df661ba572cf8550c2995e6971825f3bc9844df9d1db

SHA512
421840f8ed662ee1040833c51c44f36eba2d91d434cc96eae1f707d5744af09a3661158cba8cb1743f78678c5f21012119dea2e0b35b39c5560740bdc66e12da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd9ab7be4224570ec2d557704d9e043e

SHA1
c9256a3e69eba84d401d8b6dd58dbf563a95f8de

SHA256
9750a0c3dd0b2f94d1527302c9f68691136e9ae0f33e315206cf8938b8f05cd1

SHA512
452e2bc926bfaf0dee09d3f883bbd62f8505759f6c9e8655729d422da5f2f79e558eddb16069c05809b971c936c831c628a18dc7cfd29dfcc424017b8e553806

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fcf3e68ca32afb930485a93da6229dad

SHA1
02c5d33fb6d6d1f40d4efc96c60b05a1a762e252

SHA256
422fa77478a6859cb8789e2a367a76fa2090f74894e9405e4c2a339ea85999d3

SHA512
a3966cb2e58b5ef75388f2f89fe6332cda33cf8c740371ef179be0797dcdfe45563c51136e190d2d3aa437a994c505cc5a2f2105ec86a5caad060d612960f851

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6F08.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6FEA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit