bf48ba504ad868f73130326ff56899b13c0519f0a20024ac5a9d57a4361af597

Analysis

max time kernel
132s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 19:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db1c583a994a48cc758451701cb0a64b_JaffaCakes118.html
Size

19KB
MD5

db1c583a994a48cc758451701cb0a64b
SHA1

35373d924fbd2a7fe0f718ec46473df3053d5dec
SHA256

bf48ba504ad868f73130326ff56899b13c0519f0a20024ac5a9d57a4361af597
SHA512

69042323241e618bb21df5db1f33a82cbe8d278c42f1e3f62987d20285ce7e98381fe67fb339d2ac2129dc02ffdfebebd0cedd625c4198a133524359fd54bcb9
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAI+4AzUnjBh8m82qDB8:SIMd0I5nO9H/sv8lxDB8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{64A04961-7077-11EF-9AA4-4E0B11BE40FD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432246237"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2488	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2488	iexplore.exe
2488	iexplore.exe
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2236	2488	iexplore.exe	31
PID 2488 wrote to memory of 2236	2488	iexplore.exe	31
PID 2488 wrote to memory of 2236	2488	iexplore.exe	31
PID 2488 wrote to memory of 2236	2488	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\db1c583a994a48cc758451701cb0a64b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab0126cb359868479f7cf21eb41f82ad

SHA1
c3a5c6c321b0dd077001cbdb8cebc607514d2889

SHA256
2accae73034a2051b8ab4d3255953c710003b5f0feae591b482f0257a7f05e64

SHA512
fc0fcec95d976ef2d3aa8a53f68423eac96be0d4488fd80bd24d4f123cad3b175533b94e999c6aa6c82f0294f46925e687cd67c12d313a1b7c5dbf1bd4bea2ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da3f8b481e8c518c96357cc456a45930

SHA1
cf2f230d0a6e163770cbc0dfeb69f53ef24cb5d4

SHA256
39f174941a9c79236a6c484f4673980ad416780de0addbfb8111f5a3f131df47

SHA512
95d00838cd3a59563bb661ca2dae0e1d86227457fed78f00b3d71fb84b6d3d6d3a41fbd5ab92488eb793b325ed0bba43a82870719b8ab29296de2cdd5ddc23d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11f9a257f5bc56c267d98c74b1fb2c6a

SHA1
643f34ae44c34b1a646cc8b93e9f50ffdafca2e1

SHA256
3e465284350c8842f77ab68dd59ea70699d839a98fbffc617c45653dff24d5f3

SHA512
77f1ea9bb8fd5d620213df568e757d7dcdcc8c4bf5bf049419ea2aa156e8e4b1a442f9db58862980bd6c7ebc350cf0215b4befcfe56329459bd25c217ccef222

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c23ff2bed53e516bb19797f0daee2f77

SHA1
5ff17734dc5e7f5f1bff1c3dc72387526f7631de

SHA256
3642221dbcb4473617ac8b753284746aa2109756486ef4dc3321397d42fa710d

SHA512
fd5340351400bbff0a92acc9f4482fca4e54f4afe52c88945f7b42eb7eb411cca254bd530488fe59daf26edc1a511397285661c740df79a837889f5c983b7def

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fdfe048f9e36249e4109b77205d45fe4

SHA1
1de41d7f0ef6c3d27661aeb9b1e32cf45af69063

SHA256
6754a7ce5660921d73e7df1c850bf874dc1ac2869fd28135c41a8e4bc307097d

SHA512
1f9cb5e2dea5ffad23d67cca95736b43e9beb48032b3f770a715936d0c35ed70fefbcded78c2082ac8e153671b75cc7087bc19a630f7be6e94f2fbb4ad623c7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3834601c5dc3f43fbd1ede2ed4783550

SHA1
968ea520c682b64c5b94e876d2f5c25bd8864e4e

SHA256
20c7dca25017e0c6edb5eb267bab0e87ac83344e35e11924348c5f1498ac2bc4

SHA512
a9aff7a335c436b3794974ca1cd5fcac1a6847522d208d071c3a0b00ea1a15a9a021b4cdbdae7475371f9020ad854ef8a8c4553bd8c05834788cd757b7db6df8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2560978ffbbfd7a357835d64eefd87f9

SHA1
298df0356cd4b495153a3d39276d2a2029bdd1fa

SHA256
ff54e07b614280961d5e34f1c6c47e0e68124018536861cb34fc933ed3dcc418

SHA512
78f848000517b8ca32dee186f9dbbdbd2512b8a452ff42ea12be5e007611b73df2ae21fb27a70405f057e5de95f9c2bce39cb2d46e3fd8fc512fea8fad5a11a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58f583726cec9891d22eae0fb1daf5ac

SHA1
9222bdeba9a5860725f69a45babae5f7b3578837

SHA256
274279950a58cdf4fc7d6a4c7899d69ad8117c5219644bf1a410ef42e0a48c2a

SHA512
9a74e8d3497604c0104a206deddac709781c792139ec03572550ae7dca015c10c1b6417d40f4c9132fb94fb9f154e5e2fdb84a05a7db65c98ee9a7f5bbee9167

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab16A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1E9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit