ffc9d1a1b9b09e288990f3d6e6ab471103099655b128dc6d1c0ccf85cc4ef72f

Analysis

max time kernel
148s
max time network
147s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea857760240792653c912c4c34d6e193_JaffaCakes118.html
Size

18KB
MD5

ea857760240792653c912c4c34d6e193
SHA1

8f133d4a231b9dc354bed4b2607a3fdb0f5e818f
SHA256

ffc9d1a1b9b09e288990f3d6e6ab471103099655b128dc6d1c0ccf85cc4ef72f
SHA512

0f9133dc85fd976e077903085f98a10f61627dab60857187215525f757619f807301815f166cae7c026b1f605eaba299339b29703a656bb37afc1b852611ddbe
SSDEEP

384:SIMd0I5nO9Ha7/L7XZpJRb23wUsvg849xDB8:SEY7/L7XZpJRb23wUL19A

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432879254"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{47DF51F1-7639-11EF-A2BE-5E235017FF15} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2220	iexplore.exe
2220	iexplore.exe
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE
2592	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2592	2220	iexplore.exe	30
PID 2220 wrote to memory of 2592	2220	iexplore.exe	30
PID 2220 wrote to memory of 2592	2220	iexplore.exe	30
PID 2220 wrote to memory of 2592	2220	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ea857760240792653c912c4c34d6e193_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce64d8a3a90e6732560726e3d91c8893

SHA1
3f08417adff866ab396856a44b5d3c2613535fe9

SHA256
6725b592a4cc91b53c3306842942e418cce93fe1c98e7f369cdc346745ff5f8e

SHA512
f673342754c790ec7203e78f3d1eac98efee8b4c99efffb2ffa5093fc839e11459cb2557e191c7e41040f438fa13e13b10667bd8ea97a7dea3f52ff9e7398717

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2b92c3b14ad5f20518b99aa1acaea9a

SHA1
b5fbcd52ae71ac20fefb02d26d37c6c382bff3fd

SHA256
1a38519716a791b87718a98a1dfe1e778383c77884291effe96123171abbb6d5

SHA512
7a6ab4ee2d2cfb6c4939bf32f3b7fae9222793986d5cc8360aceecb5618dbd694a38f42592750571d63258cf0cd88aa3cf4a18c6a46678c4f9746f46c26b72df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00b19f6fea36ef85299cf70702ec48c3

SHA1
9fd758d2cc7eff053b68a7a2496df2ee86faacce

SHA256
2ac3053ecfdfc74d40a997b9db602c38c4dc6b673a40813333d36748d7f5f0bd

SHA512
97d67c77f75aa69dfb5dce2413e7b6576bec524767db6348df526f553b7531159c109ae12d6dd8c8ee6115d94385965f276c36146d5cf98c605c7080d38b5b48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b7400df20c07e6679bdc71f1b972dcf

SHA1
6cad2ed6bec10730b52b318697a2f1435bc4461b

SHA256
ec5ad2be83f088b2bdc7df173882e54debf9ebab8adb05a009780b4dd33b4ec7

SHA512
7e2111f92b7eba972d75d7042724daf0f38081a7681b11aeccb4b8056365521a0967db63aed251707d6a9948213c0eb2c924d0c79a5332614001ba76faba08c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a9c874ce250c5c54562e4de067985ac

SHA1
6caedde34539d74c1946ede0f65814ddddbd35c3

SHA256
11bdf4e1775d27a73f8a8758822fed38cd259f74258c78626c1a04af6bf529be

SHA512
cad7638dfc99ad9b46c9d466c38dd64c586061c7e08d06fc5a4a2d2ca0bf39491f4835d00823c4f6fc12d68793e24762d7613ed379ca05cbf4439e2310fc5b5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18a41bc4d60d6f8844c5e70608efb017

SHA1
eb85d385625eb1c1ba835b9534cd2501f5f35ab2

SHA256
c08b76904707ff1d11addfb508957a30f9720b8567c954401d2094a9ae67ba94

SHA512
26c7543f8e324ffd10e147ccdd2a65a11fd4ded1a7f4b7c02cb99ffb1778071e969542b3feacdefe73aff7ef8cf13e7c6ad974f4154a5fadbba5cc5beeb61d2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e4e7463cec945a06dd60f5a9f782f45

SHA1
fd94b44f4ae1ada6870e8927229f57e322b7534a

SHA256
9d5fac42d684daaa6d7f76c67ccdb180b91a40c1f8bfdc0c765b70ff34b70314

SHA512
26e5cc034ac1c5caea51f3175c7c5f711c09bcbfbe051f5ad224d15f2996952836ab2a9814bbcf45e08a3b642259d4bbf89ca3eaf54dac13ad416983a7548044

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e8342d58ab2487c751c6d0a95c610c4

SHA1
87f3aa4fdb861c87d74531df0874ebbaf55b30c9

SHA256
14930e6208d20d0d07847e8febffa8c8baac398e5979e6fc22541ff3683db0f4

SHA512
c626259a02856bc574f0ef46afec4aa0487201e6b40ae65f4e54bc187416fd1cfbfdf711ed3037c0daf7c917b98062992ac48526393b7c432bfcd5c8642eef25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b25f137a3447aaa21a4c2d69323c18b

SHA1
ef4154e053b6e02d0a4d2c800dad51a86b595ac6

SHA256
2ebbdff24829e59e99b70116a4477ad897594891698da861cdb30bad06ec1687

SHA512
4ce25ec6fd32c4f5c4901ba6bc164c0beada475bb09c8924b19eb710ce2fa92c065b776150f460a6049af28fad6754418588fe83367525e070a0de130ffb9aae

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA12F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA1E0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit