ce93ebdcb22065dca74f0800d0d337dcf177dbeea17dd5f052eed906c528c4a2

Analysis

max time kernel
131s
max time network
140s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 21:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd0b578053dfbafc71e6cdcc6ff42cce_JaffaCakes118.html
Size

20KB
MD5

dd0b578053dfbafc71e6cdcc6ff42cce
SHA1

f356e63c66ed586f79828fc6234055d19e71d272
SHA256

ce93ebdcb22065dca74f0800d0d337dcf177dbeea17dd5f052eed906c528c4a2
SHA512

f1404f87282cb77c30ebd9835675692efece26f0adfae648301c5b7d63238dd3f8531502b2196ff8ad83ec2efafea001881c29c4d469222d100ee6b448b3bd9f
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIp4fzUnjBhJz82qDB8:SIMd0I5nvHRsvJoxDB8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432336788"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{40F81731-714A-11EF-BA16-7E918DD97D05} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1712	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1712	iexplore.exe
1712	iexplore.exe
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2388	1712	iexplore.exe	30
PID 1712 wrote to memory of 2388	1712	iexplore.exe	30
PID 1712 wrote to memory of 2388	1712	iexplore.exe	30
PID 1712 wrote to memory of 2388	1712	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dd0b578053dfbafc71e6cdcc6ff42cce_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a573631349d18ab217e5a1095b65527c

SHA1
1a69dc38fb47d28dad04a1d134adf4cece723d06

SHA256
da36f9ccd619f147ab1bf4fd61152904f5987f48b2278580c2f3a99026b08cac

SHA512
bbbb9e7a66cdeae5d70ab6039244e2c7aa2535a056461aa2151d598ffdf1d35a97256d0d513c53e6d1be3017aca6b447990aebbe357db3217d8cbe5523720f96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ae65d7a10afbbd05ba6fa4e7f51dcfb

SHA1
a767a4b1ad69e95ba1e854db18c0e66fb880ae00

SHA256
4149fc9d0206beb7db1781da1eed4e9f7f08f10902c2672e17a37ecff9d7bf52

SHA512
c05b290321ff622e6d8502ec209b31e3c6c41693ffc7658cf5b657676d9ef776a1f11495c56f76975790a360ebfefb6edcd937637e066f27e9a4b4492cc86320

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4cb87413e7ceae00e046de55ddc0ab0

SHA1
d8c94a45d9b83f3f33b7284170c84eabd22a6521

SHA256
9a010e9bbc0c5e1a45280c2bb833f5c720d4c0332bb5f79ef8b89f00790f86fd

SHA512
ec20d5b720c012f519e9ac87ba6beb199382ca54f8d57c9c3f81bbad06bb54bf9633143876034ad661efee7b1df7352f6a152f67489c5af574f86b31d3392424

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7bca30cfc3820ef661c2c1c6909d6473

SHA1
7fde5ed2068212f2761e18688803eebd7e5e17f6

SHA256
f0baf8ee2e414399f5b2eb9d635902d4335abba87cc251e92780dff75ac6497c

SHA512
1342b161cdecc0dd3f5690ee6e6f669ed402ba43010789037a8cfb49fe07b54e069527e6bf8bcde151812d2bd58dd6661765d929254e913dea98516fab386f65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a344f5a1a287860e6a79b8ae873b1cb4

SHA1
c5c4d73b12f416e5a7991a974d5230e810a76729

SHA256
8a4b67412aa1a41946ccf9ae534d53ab60a024b29409399e669a2734fc1c8798

SHA512
85c690550682652143d9b11b272a176a14c1ba54b81b11fca8316ffe354148c6c48499ba0c2e9f986722cf15b0d00b3034009b9ddc44484ed6db919ef19b2fef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af858821c34949defcac3436c7e556ff

SHA1
358935d3acf8bf6060f8e0db7daeb152f5aaa7dc

SHA256
8a9d1e9fa9ce76129ab3cd628f183f8a3a166c7872b3422bdfe8dc856da74321

SHA512
f5ddfe4d05c05c9fdf723f21b6ad9589a1119604f2e9552a9ea494871756e0ff7e8093b6493e2b041d4373e45ede7e40e21c3367ac3ab4c73b41cdd06d420ca7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce1f24c2ce3d9332018fc3ba350de6ae

SHA1
b0e84fbb1aa2411baa6c1854b4abbde54ad0393f

SHA256
20fb9f177e7bafb0569a69d9675974849908710edf8d79b70cb1b106ee5ac3b4

SHA512
2ccf67f7c04ec2494f030c9f9477fa84a43192b04d34c381568e7a5bb01abfa83c690bbec9652681c9c193d8659674f57cd7891c4c5567c7fb59be6510765388

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c03cfd2ca41d9f60608dd15683b664f3

SHA1
91d147e287c25b8c98296b54a1f51b377681b035

SHA256
b1ad9e6252d75fe1780005034095e4d7af783a08afd3d7d0dcc955bb50393896

SHA512
651ff23be78a16c9b78e5b82b2bdf239a50f98afa94da2eae462613c5f42a277704eedfdd13de868bcf1f4b5da37e9ef905c8e25eee8f7f3bf8731dabfa3119c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ce2c0cfcd1b79d841d733275675f131

SHA1
4ae9bba6f732de3dbd4c2e7b6d2b4808b10bf136

SHA256
105aa3c160d3dc017f68f3e72b87f3b971ec90fc423498daa2b1f8f7b64f05db

SHA512
c71dd16f5b1b15abfc7d635cc3e63251222c1b0a631749812cd045e4035aa0706b38cf01303d1a6dd7acae633f8473692bce7446ec1808423bfd3712aec21b0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA640.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA6EE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit