8c719a499086897ce2bd96b3fab1d8bb63615f2ea62cd9a3bcb65d6e1656790b

Analysis

max time kernel
131s
max time network
140s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18/09/2024, 19:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e9cf27922fa891918cb70436a2742b04_JaffaCakes118.html
Size

18KB
MD5

e9cf27922fa891918cb70436a2742b04
SHA1

e4ad1ed291b75a0bac7b4d16565a66d08f532c9f
SHA256

8c719a499086897ce2bd96b3fab1d8bb63615f2ea62cd9a3bcb65d6e1656790b
SHA512

ff4c5d9b62542eb25c71187d23519c98a9e431fb96a06c499c96d073ddfe360ef72c17b25c681f36f43eac08bb033a9e422409457eabb33daea301984d9dcaf0
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIh4XzUnjBh5j82qDB8:SIMd0I5nvH1sv5YxDB8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BCDFDD91-75F2-11EF-82CE-E62D5E492327} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432848956"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2980	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2980	iexplore.exe
2980	iexplore.exe
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE
2492	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2492	2980	iexplore.exe	30
PID 2980 wrote to memory of 2492	2980	iexplore.exe	30
PID 2980 wrote to memory of 2492	2980	iexplore.exe	30
PID 2980 wrote to memory of 2492	2980	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e9cf27922fa891918cb70436a2742b04_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2980 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58f14c97b66f3b3fd8ed7fc40023567f

SHA1
f657ff0459db39d7877eadb99ffe1488d7d0b2bc

SHA256
af7b0165020aeb9080847435c6efb344057b082d361e28e009d385127592ae92

SHA512
997063e9f7a59b9f1bd7a99c73a112dc5af0f5216963a942200659fd3aa6b7216679e2785cdfe1a26649a3a515688d0bf3a9272a78cf17074a70c012cbe01cb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d636ced75a30e95e0a7d101264c0c696

SHA1
dc7387834d996b7a91bd648621359bdad488dac5

SHA256
fe19b27894fcaa23a1e50ca0d835f6722dcf1dd28294a22bbcbd7157b4c81375

SHA512
a96d091fb1e928f72ee6675b2da02ee80b3c0e903193fd28991380fc3c67812d8b0577549953e5f87bc72a07503d12baaa4e02b3550a1b1804bd1ab58be4448d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44725674d151b8b2166e2ef9005889ac

SHA1
4b31f9c39054a8e253e03824f89337aae3d1cf4d

SHA256
99b6f8418117b5c71533469f7b4a0e0415c17142b0b1fe671ae121b810b75ef3

SHA512
a75497837659ef6f978540676e58d6e8f0c4dbac1cff39ac5f609fcbcdd85197532a38254a3449d38a0328587af7aa824200a36ec755b398356e32aef051ddee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac88e7729dd8b2a918355560e28c0262

SHA1
15706b993f65b7a3bc8e99ff617fe2ea55507e39

SHA256
2fed67155274170de4cf8a0bb34dc005cb5e8fca1fd5bceb8f998d06e3b9437c

SHA512
ef08232815a9fe6624edccd591a056f50cffa43424808cadb5709d3dfc3c9edf26042f18c0363d8334dc529dafe463c53fbd98cf1b418a9b22af0efde4791676

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a389b34c8712ec35632f9af8c6690b58

SHA1
b22d36248a7a349a0c70debe40ed465bdc71e1be

SHA256
b0c868a169ee9a932d4a1b4ccec9e30ab0a01b7f2960925ea81b92b9a3fd5776

SHA512
9f9a285652a024a1a331f6cf28d499e4319e71c4ae3615cf4594ec50bbeca3310ae03123b929ebeca8184ee80cf93e9aaa393c73a315be2a2ff4d561ef99a6ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02b049bc526b07fc981357ffb8a7e0b9

SHA1
f748188a09f599d1232e965da5d4bd4acd7dc8af

SHA256
ee609efd09371e597d748150684847093fa281efbf080c1d70919bdb844acf27

SHA512
096987cd82a4fe9446c99bf33939a15b9466010eb18062b4483389e0ecac3e14553665853545c97589b633600b5570d92c30895a768f05bfd897596d0671225f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
adf8bc8baea14a21d4fc77785228ff55

SHA1
b1579904213928fb1bc9b2dde4c109530a302718

SHA256
271cf61dd9ab516b36938b77d4e55e51f26b5895810ad3163a598c2e3b408f0d

SHA512
f9a629ccac15d3368bb29b56258cfb23c595fad983c2a2c2c437a825438dfe5cc768574abba03802cb4b1e1b0eeb34657b417a0efb87c904ab0a87e53d743cb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
179a3ebdd6388045b35e3614cd675747

SHA1
f71f373e0ef0f4442fb9821ab359c5fbc4e3878c

SHA256
6bf322100855704b13c830c88249038d9cd8af6dba3e19b6445ec8806b1bc8e8

SHA512
35a8752f1960746485924795cbd61e5fc6eb9f308e64f6f0af11412f28d07b2bd1062cb6d1e844516b0cb9c7e2141910b48362a058d9465727ecaf42a80a78ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49933fc213eb8a342b949b0ab6bea1c8

SHA1
e4c3c656145eb91dc538f6d411c697e4a39db29f

SHA256
0f240e98bf71482b7103cc65d2a0e50776515ab0beb3691752f514af3c965f85

SHA512
b37cdd2943f6423f0337c4c8e6f112d92720f1467dbf9e69e356cecc43b80f72e832f395c4f74e4d6ff95a3a3d8c5c4d9b46eddca44bc93cbfc066bd696e9c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAFEF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB09F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit