37817e9551abdd821feac0f5bfdb2f4bcd0a04ec9038fc6b8f455d9c4c1617ec

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18/09/2024, 18:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e9c6ac9360bcf725447571821fc82e5f_JaffaCakes118.html
Size

143KB
MD5

e9c6ac9360bcf725447571821fc82e5f
SHA1

3a75f93d80d91801170ac8801590d5d6026c93ad
SHA256

37817e9551abdd821feac0f5bfdb2f4bcd0a04ec9038fc6b8f455d9c4c1617ec
SHA512

f97b3df3cae55b989dab0ac11b13e759e40223d1f1f3498101c56345a66710f6fca9c823c2498edc4ab3e9c0397d8d8ebd5cec13caabd8da8b2b7734b3b958b4
SSDEEP

3072:Sn4EAAyx7dyfkMY+BES09JXAnyrZalI+YQ:Sn4EAZx7osMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D0D3FCD1-75EF-11EF-AF60-7ED3796B1EC0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432847701"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2344	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2344	iexplore.exe
2344	iexplore.exe
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE
2704	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2704	2344	iexplore.exe	30
PID 2344 wrote to memory of 2704	2344	iexplore.exe	30
PID 2344 wrote to memory of 2704	2344	iexplore.exe	30
PID 2344 wrote to memory of 2704	2344	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e9c6ac9360bcf725447571821fc82e5f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2344 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b462ed0e6dfb5ae7a195da704da92d23

SHA1
8b4aeec9854ad80e04ce021193b248f2b56156c5

SHA256
ebf44366856eb84de569b273041e7aa18effa03031468d59ed31ad5c42524e48

SHA512
61fc7f2a8cadddbcd9504415e2952568cf8140846f3df5d814afc119af805b2d7a8479a142db3b39715639801069e156ee8c20587b1c0dfc6668b0dd321cc205

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
292039d43fe2d984eb93bb12f4e833ab

SHA1
986028e403ef34211a0aea4194cb11263a78dbf0

SHA256
26cca13f862034eddcc5c652f0fcb6d867f83cb532230bb125211e374b11385c

SHA512
36215b532903d88df176fbeadd669a685e2c991795ad2df132a7c9639b51c696a67a25e2e6d4f1d0049a1ff94248e8e546086962019242f78731d3584eac5d08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb6f450a6cf80b68bfb71e2528716a96

SHA1
587e72d73fe254ba393226f34b6f26f049b72ee8

SHA256
9ec21a0a5b9606e7585e2667ddb21fb753b3443d958544b2520c615db3c75a1e

SHA512
3d5559ecf0fbc7784f26864387465aa16a0cf8a0f93f7369db38b31da16b90ca17374b3e4fdabc3872a47af5fa0544caab185317947f10f97a4180c9b0f284cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d93c45820a455aa4ebe88b06fbcc7bd2

SHA1
49030a0ebf35b94becc5c31684118fbb1a9173ac

SHA256
2c699e1bd658a09b00f0cad540a33dbf6be31bd4522de78700bed8e878b2c765

SHA512
410371d09ff3043b6007d2731e4f53a9b34cbd75bca22db03a7c232f087e4cfd2f09919375e8b9229bb32b9ada5779d689aa535c4163e30be8bb715afa503883

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf7f966cccea1deb85df5314736146cc

SHA1
4b7f33547180246dab495afb15ff89108887bd4d

SHA256
2e39aa0bc3afdc128747adc3090f2257b96243ec6e8c610a2a162edbb9d58ba1

SHA512
2343a60f9aa00ce04aa7432f8d20c46f380aa95717ebcb10b3be1c48e446ec3b7ca3f65100ad71c8a8c67b9d62dc8a75989ee9935e1122d7a3ecf190c047cd5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2429c42d716e2ac5de39713728b96e7

SHA1
3b555aec5cbb30454befb79fe558135c6d61e7ed

SHA256
b58b72b8989592c559945e2e0e706f4a1deb957af22103357741a947b983cfbb

SHA512
070b13df71635fd864b416b1a2dfc70777729be90f73f29d99a3a5f2e8541321e142c7a8c33b17d53ef693d146a705c05d83cd40b08a52d90479a5534c75aa7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20e4524030ea57b02144c88710e7abb6

SHA1
3730d56566381cfd72fd99fa174a48f139b240ad

SHA256
9f26cbd7bea0cc5a7d47bbf123c1b0fbfa647201e2979f88d7b73400b4f0581d

SHA512
a4a2bfa03986bdb798103dd7ecafb7791c34d0ebe214814b91763d9761ad6a87ef695d5701abbb13e111ca68cfff8d2c110111347c9fec1813bed106396f9cbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2f58f4ddbe22c49e9f3c732eed374fb

SHA1
60d144dad085383aa0af7f93b654457b868190a8

SHA256
557733201a8425a034ecdd105139df13cb1a4dcbf136f33317aa6ff4b39b1f63

SHA512
4a4ff72bdfe33923167d8cc3950b3e281934cff14c7beb711dee47083450eda95f5def845537b8c7da860b84b88a41ee77bf7a9a64170d92c82115da2022332b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21f49eabe572ac4c63c03ee97a257fa3

SHA1
f41a134f1f0f2a4bf5034039e09bd94a69dfaf2c

SHA256
872401c99f7f95a2b57342750d12ccb0bdd10c7533bcad244906846a917c07dd

SHA512
278b8c643e5516cf68a45b8b1b2b788eb05ba696c233b46e3a9027fefd908719109c224fe0742fd82e7d2e791e9374823d825c8c0ad1333db155d6170b82122a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab30.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit