e740d4939d9165c877b355d44dc1802f5c8c4131e5ab9786f73135f0a877087a

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 12:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dc4e0dda67976c0153890636198d2fb3_JaffaCakes118.html
Size

60KB
MD5

dc4e0dda67976c0153890636198d2fb3
SHA1

df5254ca91bc99bb3a3b725df5c242ca9848cf59
SHA256

e740d4939d9165c877b355d44dc1802f5c8c4131e5ab9786f73135f0a877087a
SHA512

696f6d3253839698dc1829e4a59e007e67690bd849ed30359b6def01df6c2fec8260d8347105532aa8cef7759dfd8ce6e13f6075763996d4ab133a19e0754c3d
SSDEEP

1536:8i4g+Rft3UfY2eUPHWqSHKo7RSbUbFXRTnSTRv4EhE88PhkGNpSp/F0dFLubMBMM:3a/46

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432306718"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3DD07431-7104-11EF-BBB7-C6DA928D33CD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2448	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2448	iexplore.exe
2448	iexplore.exe
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2080	2448	iexplore.exe	31
PID 2448 wrote to memory of 2080	2448	iexplore.exe	31
PID 2448 wrote to memory of 2080	2448	iexplore.exe	31
PID 2448 wrote to memory of 2080	2448	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dc4e0dda67976c0153890636198d2fb3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2448 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a912a9a1a2d8bc5cd4e79a4196dbe10

SHA1
1535df6288275641b162fc2602296ae505eb5090

SHA256
649a2e7b0f7c833d6b2aea85d8cb5c7fd3551a3788a493617af9b5012fcc62e7

SHA512
dbc898361c57867980321e5027da1679485b1315647df962da4e0d603a151bd8a07bbccd946bf31037ad99ea71d89933126a6fc73a3dc90c5086e17b8e311c97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e1f8826ea4359b372d8f39bc74854be

SHA1
7185537c6da8f3f38c1ffb5ea30b431062612f27

SHA256
ba2a881b4e42f18818ab63ac50d17e8f8c09e12ff7ecddf2488656d4dcaa8334

SHA512
6bea89dcc30aa6f07043a8492182868dab37e84ba724e101c6c7e8bfba31e7bf77327c6fd31968e9ff14c20f7e3f7d93d2fed7bc67e611f7080d5d26c10fc52d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea1b792fc79eb8d640a55b226c65f095

SHA1
39cd973e01ebe5ca20e6c9702fdc0130185715ff

SHA256
9d6b4b89f1a08ad00be9b0c29e25bf3c2518414c3d66660836bbcc6739a701ba

SHA512
517eda5c28fbdc23bae3444abb3155a5b76f7eafef34d38c5118001f7669845ba871420649cd2c1511d50192473a907205c332b31696dcda9cb1d10eab0b40fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eedcfde87c3a2271369fc35c79d83cde

SHA1
e307d4c9e8d15f383115601bbbec961594fce6c0

SHA256
15495d79c061c8ccc3150df4aa6f6e0989fc9eb1e1d188ee5fd4018bad3efe21

SHA512
9e0dfe2f53152d89abd90ce361028b4cf60327ac7c1503952be8c67db2850ab2d8f3543f8ae8cfd4b006170521502663ee8c7d960bc5fe45d96e6031659ec607

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
801d7570feb33e0123a8bf1754a37c05

SHA1
ae7149e441866726364b89ca44d56111c97f1775

SHA256
cebcb9b0a2aeac18a990094c0a5cc1e404f1287f12c9238502f6efb0c67d27bd

SHA512
0af2a063eb1bfc446c41a6f563193c1c46ead1b06c4340ab5b42e7c194c92d3e72f8b69681b161153a348ff1048f626fac3b6cd813004350e0b3a16fda984c41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22135d0bfe49884c806232aae545478e

SHA1
56fd0d0490d05358815ce07323f8cc2a28df517f

SHA256
28504467ff23ad0688c0e8744d9ab9d613fee4fc049d93cb3e8219fc3e6c30bf

SHA512
5d7256a2385f11dfa9d87ba0aa91c1ff7489f9a0c4c5c2476d5062c1662c2bde956c14411773289d07e3a0bbdd4b08901a41c226f795b785c7dc1481783dd711

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4a93a276dca0cbd01a404c6afa26003

SHA1
bc2fad63e56b6c4c1c7f82e215d1795a7e978ed5

SHA256
d98abe6e0cb08095ca467883f24314aa9323aa476c2526164845aaeec5472ccd

SHA512
8b9d251e41c93ce389b3c0c9f8605a37b9176eb0cbee3e7e5d206e5f2162939568ed8f60699be8f91b365fb6ff33bca45f0c76e388e26c3202d2707c8416a00a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b21151b4af2b89cfb1f4c3c2a3f01fb

SHA1
73a7ee6fa9d6d5ac290bf7ffd1375e680cb86910

SHA256
f64c528cf6f9ad0a856a804d8c1205de18030111b6bdce73e4128ed827a8486b

SHA512
974989f23d86b8c0a12644341ec783bb38308ecdd96d8cdc5c501fa99ae405839604d22d025700124eee25209d6e05500bf7916506b08566a74f08c3f945decd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ff5001d255ae3e4f3141f0b0779d0e2

SHA1
f240dfb8ac086865cf1394bf0bec99c72e12d685

SHA256
b6b1d8d81376e8fbb955d8a9f1a5192ede95dbbebcc522c0a7a7f02d3f0e5dc1

SHA512
d55c5537fa0f0c6a9eca9b2cef79404fceff77f86c5bfbcd53ab73d2824293da1534ad0189e0a1333eae30ebb35291ef1ef7004469f0c97e929270ef3b67b1d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE292.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE295.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit