f2bc6487e7bc8718adcddcedf73e661005aab8c908936a256470247ec4bd1874

Analysis

max time kernel
144s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 20:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db2745fa0869354a118b13253c2a5137_JaffaCakes118.html
Size

2KB
MD5

db2745fa0869354a118b13253c2a5137
SHA1

ad55348693ff10a9a039c204770bbd28d629716b
SHA256

f2bc6487e7bc8718adcddcedf73e661005aab8c908936a256470247ec4bd1874
SHA512

12c01395dee24d17e132519970f6fe9797480ef6dfafab98fb64f746233d5e946ca588170837c9f02cfb99908d53aa10e2256353746dc27f74e4a763e5a0b886

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BFCFAED1-707B-11EF-B9BB-7694D31B45CA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432248110"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1720	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1720	iexplore.exe
1720	iexplore.exe
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 3068	1720	iexplore.exe	30
PID 1720 wrote to memory of 3068	1720	iexplore.exe	30
PID 1720 wrote to memory of 3068	1720	iexplore.exe	30
PID 1720 wrote to memory of 3068	1720	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\db2745fa0869354a118b13253c2a5137_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1720 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c7024688596b5ee0672207adcb544ab

SHA1
a727b99b4852cc400ff7199b32ff2425e3048038

SHA256
4834c640d956fd0bffce4b11a727f8275872e4200ee868fbc4bb1ed2d1ccc6e1

SHA512
d6c818d884a9c356d26ab72d4f020692efe9b44bfb11325c4108e7f12103951f1ddec2e4d2bc1559fc0d4c2617eb06012fbd01b80ef56bb7ca8339e1ee96002a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8abb824d0509143c3598e32f2b1058a5

SHA1
3603ff6996f7f9d9f9b97446f49fe06731513a56

SHA256
13ffb6dab4252f92bcbfed309f7916b5300917f39ffde232a1b9a066e69fe679

SHA512
982050da5b8a8dfd50fc98970be85887bb666e2ce45ac05b0a062792e9e2f8ee2ffadff7638995d85f732f834bf69c6841083e5c1f12f6347d63178bb00a6668

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
736299b0c1c3ec406e73dcf93a72253c

SHA1
c732dd380cc8fb8138219294dc88c758e1dc4f63

SHA256
266132fb1ecd5bab07bcf930a2475d9b9c071080fe31ef34258a32f02627c151

SHA512
966ff8684ffe63334f482eb3a6b184f0c6810a0df32a44fa49ac4f816c6c35272014c5d9b2b1a6734533b353976c6a58a46111956404a219ced64b0f26b374e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5305c436f2c7ac72a1a307767d03b9de

SHA1
c1e4b74a094528f9bf105e709a79ac533abf95fe

SHA256
1455917a66d72bb6469a6ee6292e9425c1e9092f322277c56046c031de2f4f12

SHA512
1b556fd315842ae07fb5bc90cb857a300a6bc076c755233bce753bec00a58ade2780bf9a7dbea89bcfc9019f49d60ff9ac82e7f4f8dd9f35f40f543251439382

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c27bcb84cf8889f6a08b6873bf5efacd

SHA1
660837899ff306c6ef25d091bea7b24fbcac75c7

SHA256
f07ffdb04b9ed659991ef93f3fdae1c7719dc8181698350b491e243a7e885489

SHA512
0742604187f861e5d406fa432d5b1bcb3decba4e377929c5491099c43a3a280cd1498f75bd998bbd1f946c8fab7a14c653d2c0c37909430e85d722cbe737ad9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bfd37051b3ca9c7c16eb792daf5df703

SHA1
d6a256a1faa878d8a6edf1354a0c3c2178156a9e

SHA256
a827d4204d6ca1d3b768ca1a31c487381a3df7b6a2721b406747138b7c347316

SHA512
c1adddd1964a083fa4799ab9e98e6750ce9443ada451578aedad547fc1e4dab43e1853f3667cb188b0073f6dec51b0b0c95b5e51561c2dfca1c6069211c439dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b67db39f9c398c851f706957561b4d3

SHA1
7f098213401d6ca7b413554d6d5eb0e3f70f1aac

SHA256
a581cc204b8347ef39ce32b97d5e294a5d8876bc73433c7cfec0c27b43e7e7a0

SHA512
6ca8fd2db80ec987eb383a2ee738e591ee8fdf402fb3639534b6a054be361ccd157317b8ed2df40a4d761abb6a72a1597b3637f7bd8ae927fdbf899a2ff67023

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f239fb73f719b8f60b3bc022e30c4a6

SHA1
46a3c46187f49d10d88c130a62c8999e3891ace8

SHA256
7a5a9085326335af46fd326d97fa0f42f6fe0686b2af7afea6ea53ad38f0ee83

SHA512
214045488f8f5ca9f56035b903482a9ebd6666c074d0237f59fe7e76aacab1e7bb120091b3864f9412e4801d3657ad0d205002484f11f98202bd3e30d7de2def

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5c32a07990cfee6d322e4b4a86d1130

SHA1
7ea8c9961490735d04c504b3996a198be7239018

SHA256
dc4f1daf035ef89934f31d9479c7c7c732f531cbbe6f1b911b1f67f74e483250

SHA512
99ff28d046305dc54d9c6501e033cd1c2c0c0ee3a4570555be92b022aa98b81ed862c1bfdd5f8cd323d5e0aa5c417a6f7b4379e5465650ef88cd27c49c025f5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9BC5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBDD8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit