e59fba782529851c6e4c4acffd3383dad1b3c946aee70ba63ce47212806def1e

Analysis

max time kernel
130s
max time network
143s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 04:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea939449d9c75c93d0b61f9cadd124be_JaffaCakes118.html
Size

22KB
MD5

ea939449d9c75c93d0b61f9cadd124be
SHA1

15fb6fe0bfa03fbb4b9175b38ba69c9502e267dc
SHA256

e59fba782529851c6e4c4acffd3383dad1b3c946aee70ba63ce47212806def1e
SHA512

630941296e43b911b78ce0c8bdc780d641ec23acb977419482b3678898ef30235f7735edcf9147aac241388b257b8acd025d44d2a09366cd7c78f346b035a530
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIb4HzUnjBhlf82qDB8:SIMd0I5nO9HRsvlkxDB8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DB423D41-763E-11EF-8FDB-C28ADB222BBA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432881650"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
984	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
984	iexplore.exe
984	iexplore.exe
1028	IEXPLORE.EXE
1028	IEXPLORE.EXE
1028	IEXPLORE.EXE
1028	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 1028	984	iexplore.exe	29
PID 984 wrote to memory of 1028	984	iexplore.exe	29
PID 984 wrote to memory of 1028	984	iexplore.exe	29
PID 984 wrote to memory of 1028	984	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ea939449d9c75c93d0b61f9cadd124be_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:984 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a005dd3af23cc319f25ad060474bce78

SHA1
32a7d1b758db9ed53c270de3b095ac1b39f9fd2c

SHA256
771ec9735346ff6f998433c9b73df56ca7eea7a446fc20d7d4115d4b78ec15f2

SHA512
be628ebf7ee2a8f05c872603db624086d215d78327eb64e552917daaab7f9110319dc64e22f8181471e60410cc1c5ef01e32cf895cbf16a71536e40c111b3ad7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
307ee269f0954de89e4493364fd4646e

SHA1
2b1c5a6a903f1f8f79b49074f57ed47d6172d9e1

SHA256
90341c625f124b5a50e77f048e3e4c4b9cdc24d4fbc97d1dca52562888b5cd1a

SHA512
3d097c2beb52338923446354e84b71cfd9c5d350f790b6c7cbc56e40451df9a75e3e37933f3150adb762f8c16f6a1261820fd3f2cc7df5fdc2452931953b29ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae17d929c16eb02119dd4e43175edc1a

SHA1
09e9d237689262beadda03fe9febf44f3973444b

SHA256
e2b094f7632c843bb87a0a84f008005dd90c48dd47216de9a807b360aa53ce93

SHA512
4e496b09edf8bb4b2639bfbec2a22401863819e14c01d203d2a7ba2842e7160c4846d76ec51f7b716d409d3ba10854220a1302ddca4fcd44e728726ed002d2e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8c46173ce87151107cfa76326ed24dc

SHA1
8d6ea93f9c06639f794a3b712f20f5c34905f361

SHA256
562d2f8913148a5bfc4637c3cbf85286d6aa88a5e4c3a5ba999b4e26267d1550

SHA512
8ec68e64229399265a11cfab4333f98ce717af9dd7a61438c786a15da0f2fb63ade84bbeab51f2134f1f04ce8b087985dd3e7ce7085f045d051116d39edd4672

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f38bf123368f3f4587c0f4574496b99

SHA1
2a4cdde4e68e41578089bc679cd8a6944026a937

SHA256
7d8a656b34184cfd72e98d8f4cab72f1ad5e29603466688eb6e49fc29435b859

SHA512
a0d472115b1a0bd450e964bf9dd5f4a75cba3632ffe371c2e0b28357245843bf4b4f6f8e8d95f42a92a5b78e20fa0cfdf954a0751e1642b2bafd0767b142de5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88dc97f4fb71e17a5befb59d9b4b331b

SHA1
658afda092518a01c1439c10eac2559ee49c8afd

SHA256
8e812e067e2de0ea2570ed98acc96913f55a5661917829d8c80710119f0d928f

SHA512
07e8d71d054460da7dd83ac093928ba17f284feb1f29ae9f4f9807ff3781ddf4d22db9b68cbccbc3f3b0664aecdc4e6db01d24ff7045db83ba4d09dd1c3c006a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9661a11e58d5ea2aeb2c2f26a4d82f3e

SHA1
05a9d5277bc11f419b41ad0f1c95c3c382f9e922

SHA256
10dd4bbd5a0a6512ea04224b124ae10b43834ef0c70dbe4f7d7c1c37f54a501f

SHA512
6cd1210cca94e0814ef187b042f84f1d442aa38fbf444af7f936edbed470bef842fc652a2e8de292f07debf4283079c1a4f4dc20aed04206d70f017fc1106c62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a16ecb7c3c187da118fba0a6cd230e7a

SHA1
f2ef167072ad59c87df6b97250ba9710239c3836

SHA256
1eb83d653d3664e63930c5140af8d9ab3f9ab556a6abed58a564f05082f21b6e

SHA512
b50a70a80309f8a349529c62b882ac5050e200628d9736409037083792e8f2e0f46e0880e08d121cefe87188c30bed7322d4c9e5de044cbddf9b65ace328164d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
454ea1f01598b95f96ec6f73792dbf38

SHA1
28e4192d0fa2e607c4b9e4b6efed7e9e646f43d1

SHA256
6922b046de06a0ccf156ee1c05cfe0494846c538f27a3f9d523e368cd3960875

SHA512
11c686fcf325351a53fee30eb726f983998f2a2fb54f83d0dd8a0bae546791978ce14b5e912995e12577c2307a6356a8dc0bcc8e0aec568d9ebdfb26eae13559

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1009.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar10E7.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit