4ea71dbf48921ae3d796db0e7f3cf11cba2d8aadeb0eaa9c58b9af6b44288433

Analysis

max time kernel
149s
max time network
138s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-09-2024 20:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db2c9ee350f0fb1987a88e195db8a8ac_JaffaCakes118.html
Size

218KB
MD5

db2c9ee350f0fb1987a88e195db8a8ac
SHA1

12ad0cd06dbbbc7710a7c5dfbe0689890dbe4d91
SHA256

4ea71dbf48921ae3d796db0e7f3cf11cba2d8aadeb0eaa9c58b9af6b44288433
SHA512

d5dd0a2051758db27398ddde590be2119c1a008ceac26a268ea6406694068728f0617541d2cfce9402586a20e9c70041b41c275483cdf504d7da85076f4dbf89
SSDEEP

3072:SUHAIqQ7wQKyfkMY+BES09JXAnyrZalI+YQ:SIA/QLvsMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A6322DC1-707D-11EF-889C-C6DA928D33CD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432248911"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1708	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1708	iexplore.exe
1708	iexplore.exe
1444	IEXPLORE.EXE
1444	IEXPLORE.EXE
1444	IEXPLORE.EXE
1444	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 1444	1708	iexplore.exe	31
PID 1708 wrote to memory of 1444	1708	iexplore.exe	31
PID 1708 wrote to memory of 1444	1708	iexplore.exe	31
PID 1708 wrote to memory of 1444	1708	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\db2c9ee350f0fb1987a88e195db8a8ac_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1708 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3829164a6f6dd9bcf42d27c73595d3a

SHA1
1c94d3df2bb5720f41d380b66a60c3eeaa7a9a1b

SHA256
9faa1b27b524e50cfbee0d181012d22d74960ea8fa1bea11375e2f10a74cdf6f

SHA512
ecb3693c4f205e7865475759ff4f13bc8071631aad89757832becfe551ab2496bbaccab68713cacc040367e8baa113b7b6f650d236aff02b86771649a0875112

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b64b3de54376dad11a37f25ba7c0269

SHA1
60cfcbcba3a429d57a00bd0b3fa906ba249254d8

SHA256
a4e0659af04e78b6e1ed203eac397f6fe8e142233b441eb8a2a741b5b163c0ef

SHA512
a675566b27e0bd583205cc052575ed2e2eef2f26d70c65ab52afd19ae0932261dda876cc6d0bae20a6f88a8a0ea45716109beafe57a17b0c7fae2f0531499518

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42723cc89d5e76a593630e9769fb8539

SHA1
2dd6b3f9e0461c6812b1f69f6b6fec7308f34950

SHA256
99db0eae76fe205f4d8f542b8511145ad12d6c8f06739a29c461bcd17c4c3a77

SHA512
24b2f3182101a167f6e8bab9145c005a740d6629a357b9b6463412c2361b48e0be974ff328f29b3eedbb2987a2fad0b4705089fbfe20198b18c39f22fbbd5bdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49b05ead67b2153c25923febf8a6f964

SHA1
6988c0892b90e0520f29b21a2f17bbdbf3ac3ac6

SHA256
46194d3c7ba7772515f130d38847c8aacdf4f758e1c171b718bbb681c216d471

SHA512
329da9f71182f3bfca0b7bb9bdc4cc5bd5872ed724fe5dfc0cd0a42d5522c120d8ee815875f9afe93060bd69fbe08fe9541b9bb23ec5d6d1d532ec52184cabc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fdf5ad7622909958e9d7bb54254ec60c

SHA1
a2316facfa996de68e0b9a6967bda26463c15ee8

SHA256
11c62cf20be3fd4603118c28b3a705a7e121d4e0ffacf9b1cb3e050426a0c4ba

SHA512
8ca2c201f43bb5ddb9f1595383bea852b77717354c2836a4573f9b6b07dfffe1bb2677777e1452e02654ba7940689be525eeab8dcbf7df1d69dc93c190dda203

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2376826a2aacb265fc61a618625b70b4

SHA1
2c7c59d8e2fe1a7534c0129346324b630ea3fee9

SHA256
379381a01689a54522c379a03e71590a000e347327731597bff6a1b54fe65e54

SHA512
e410cecec120455f8b26b3f4f36558502646d0d8b2c54781337f80a7552c9701a55c939b8a158c8175d4dfb1533ed92add6be44f7043afe60f66730a0eae5dea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b820c948ac747fd6e1e1674c4e5ac84c

SHA1
e0a3fe9cc3b7d8939492a47acac3f9167aa12b2f

SHA256
c3e799cfd53cbd6610466de85e2fb1814b2f41d03666a3b09f8b07b91c7cb885

SHA512
68f78acdc16f4920da414e396d706580eb324269ae02e71a1f7c600765d8e0ba78dfac4485dd9cd2d0356adfed26220da83f88f8f18ff9ab8bb9785cf4e3eaef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
096e0069c2b6757ebf1dc944ac3bb0ab

SHA1
b43cddc636cee516dbd426d1408738868dcea3fa

SHA256
05ca0528749db159b60b17b1cc02ad6977af967721f6701eec24c837c5e30176

SHA512
a12948fa87692b78c831305149e76cbf1d4a3132768b3fe32a0dc312d69df780297d785598777a6fbdef0a3703155b592c5338b0bd610fc35768c0e9ad83e33e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c0a8fb0d85d4fdc5ce65bac36e03f8c

SHA1
19f9621b902c2055f90d0e12ae5151a162b92a9b

SHA256
bd112cabfb4135c26c39d16d548a0c23d4ab3581fe2d76a339baaa5b21672b0b

SHA512
f79c7bcdd7dad796369f58386058cc7599ad063d87fb398ebf47784eeeaa80c416d61081a856c29c56227d50e77d50e1985781fc47ea0af1bf95fac75e3d9365

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDC4D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDCBD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit