9bcfdddc306b0a3f3b52dea806b6711d126b9541feec3c26adb0e9b002dbb226

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 10:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de2fb16e111fd3d75eaca862e823d3cf_JaffaCakes118.html
Size

91KB
MD5

de2fb16e111fd3d75eaca862e823d3cf
SHA1

7f02d87134d9adb185e38ab018ccb26b19623d70
SHA256

9bcfdddc306b0a3f3b52dea806b6711d126b9541feec3c26adb0e9b002dbb226
SHA512

4c5b6b85705020f98a531ad2930e5ac1c1f2104710ccda47a2b0831b0e3fd4364ead72ce79374cd0991f0455741207488484b38b5283ec03230aa6165a833452
SSDEEP

1536:umbxWw6qfLhr76Wa5o1GSCJsF2UFBGSCJTfFUQwJxOiXokSflem/VgIsaaFFRl+r:lbxWw6g1iiF2UziMQwJxOWokSfle6VgC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432384133"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7CD1BCC1-71B8-11EF-8320-E61828AB23DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2400	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2400	iexplore.exe
2400	iexplore.exe
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2080	2400	iexplore.exe	30
PID 2400 wrote to memory of 2080	2400	iexplore.exe	30
PID 2400 wrote to memory of 2080	2400	iexplore.exe	30
PID 2400 wrote to memory of 2080	2400	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\de2fb16e111fd3d75eaca862e823d3cf_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2400 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9655434f72d3ce899cea978759806f19

SHA1
596b77b0d29e9d75848b055901962e56b5b2eab2

SHA256
f170de6ddbaa71b60e468bb0b3f4e26b5dd5288f8c18eb74f3c3e4d8a4974b98

SHA512
41cc0d79a51601184c4466e7130ab42d483fbdb8b325d3a238a586603910d04f248a5f2578db05dcfeb0831504b817ad23a19d09a959ac058c97f229c81c03b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0fb0c81cb46e465d35b3c72923026621

SHA1
8f2d86da664a1c1eb358747cc3df886ea351eb25

SHA256
879b40f50d6ce9b599e309aacecb7d0b25e033735ab8f0669d6013a45f1a3efb

SHA512
77d9cfedec93a375e9de096db266810c09b7a90e937979b28e1df49b6588d42a78194687c0fe0fdc15c84897cb755106afe4ae99baf8b9c6697d4f7cc267c854

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a1e7800be44a6abc0b14870f4d45501

SHA1
9dffea2e2f7bd15ce966ded660acb072681f7acc

SHA256
94dca216d371c961c4ed23aa7e68cdee9729e412be9526b23f43bc1197f38e37

SHA512
e11a9ad224629578a534922e6bea3900ab362aa4afd58b018c615cb05629cfd7ca1a1c6599976c190b2a5b65fb92769e8ec58b6886e1deb9e09e61558a15f611

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0228c7e2ef6349ce8c9b177abb32ca32

SHA1
c924d0a70215e65a7022d38d6fa097cc2f8399d6

SHA256
e9c015672a4c1b062802ba86feff84efc4e51397f3e08500faec19eca1c2e8f0

SHA512
277a331060de1c79d04cd2c60658bdea7c5d6c7b463a406214d0b89a5889057074056222660a0fbf97917d0deb6c7ed2fe6e966778a56b0a17c8d393dbfdbc78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59b36573a41df6a595d18b8f0dd96aa1

SHA1
a775e46759e31d36ca6b26ce35db4094f131496e

SHA256
64a8899ec5f74f36ab495c376ee5ad3c67338a464796281d4e278edf2662914c

SHA512
59e703114ab356eea3722e5b38ad76764131cda792f1ae765880e47f021e1ab5905a75a7236bc3178dbd506b07b401b41110aa4f62409e7e6eaf14b463ec66ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96f7f4f0bcfb5b0ed159df1ca4670288

SHA1
a02f23ee03dbfea02760a1fd93fb132b5f1c8034

SHA256
34f993e1a38be652b560e4c1c74323bdf3a8bcc932a3f2ecb4dc093ad10bccfb

SHA512
9023799ff2c2bacdde01d956048ef5dbfc09338d4fa54b4479d07dfc380b9098e287a842628ab5224315af1a81beae07233cf48d199b85c25cfd80ac9380d218

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
246c68dd799562d987be09d2a6e2d49d

SHA1
831eb2d921c4c61ae0d4dd99c6998d7b3e27fbd9

SHA256
c56d94c24c72b64ac30834cdda000e4e82ce27556648efbe200852c2ff3a6646

SHA512
2b606d6db739ea3dd5336cce28dffe7253d417e649307592ff5bc8599b2aa299c4a152d8dfcfcc1f64b0c6b5539aba948066da76e29118f0c9a6112009c1cb4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16bad3d820c8d79722a288fdbfa2110c

SHA1
0e76d082990a1f5d7cdf8ae825201f1e70a913cc

SHA256
4c58dec6d21f554f093e7c0ca7d113af625f82ff842f988d5bef5f6f73724f63

SHA512
061bfa4e1c1fa260cc54289508971db5057d4d78f1cdfd3aa3f26285643de8d4640d08f180b684af52ad0a7fcd3de499160bdfe4b785d897020d625808713094

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc04f67007ba7fa51fd6ef16e94bf9d0

SHA1
2f80b52507e36af94305b6cccb66dc05e8f145c8

SHA256
057beac1497553898e30aa0f8fb009579bab47e5a0c0dd0821053a8c8068a00e

SHA512
e02d9ec29113f7cefe36f7a0526a0e5f5a0dd82961d86cf897466f236a497d99c8544da7e74ef18ec74b397ccec9cc929340507af703584b5c156b22d72b298d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB202.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB2C1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit