98378047399fefc8821eab865eb124d2c7c4498cd0c9f4baa18b92e8cc943eb4

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 05:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eaaa7f51806a196deaf581591148c17b_JaffaCakes118.html
Size

9KB
MD5

eaaa7f51806a196deaf581591148c17b
SHA1

c6d6b7924207e87e38a7874c0f2ee77472c77675
SHA256

98378047399fefc8821eab865eb124d2c7c4498cd0c9f4baa18b92e8cc943eb4
SHA512

d2c0b945af1865c571ccef3b14fa559b627dc17b9137c28cef4c672795abf4cbef6a5352306284dce5fb41a5c9d756fdec48bf87129cf92167f659ea528538a5
SSDEEP

192:SIjAB+PJ0fvGGQduHCRMnIhOkKhvhKoj4NuBUpyQ+1mFN59Ej2twqPVaLUC:SIjAB+PJ0fvGGQoHCRMnIhO/hhKoj4Nc

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432885381"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8C6EC541-7647-11EF-B856-666B6675A85F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2380	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2380	iexplore.exe
2380	iexplore.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 3012	2380	iexplore.exe	29
PID 2380 wrote to memory of 3012	2380	iexplore.exe	29
PID 2380 wrote to memory of 3012	2380	iexplore.exe	29
PID 2380 wrote to memory of 3012	2380	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eaaa7f51806a196deaf581591148c17b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2380 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5bdaff1526dc32dcfd3ed67c436d8fd

SHA1
af53bb9c06f47b747604dad51a48b741fd00cc64

SHA256
665e9e6f47af5e24de0bab415b47a25c231bcbff14be7527a9042026006dc113

SHA512
50cc7eef68032a5ccc4b0be5853ca24775d3983172823fff34898d71b4909158c84824fe271e58d9650370021680141a39b8f6cddc84ca43fccd3614b49df96f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34b112c8824626476ba6ab19c35874b9

SHA1
be9791d5e39318a654b8569474a3cec27a6f7b70

SHA256
3c2cf68a0bfafc5827a0da63162827a6adab772145cc592cb0e2ef542c0fab6d

SHA512
44e64d5b3cfec035c16cbdc672c962ab3e35ce26d3a024cf9d9cb3b3e204e5510e1050fd6d275897a86a37a80384edd5bedf50a87001563c6af6da70db50e859

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
983c8987728690fd06951683413f62ba

SHA1
e7c62c21b0829b4e529a95d1fb441f58e9c80a35

SHA256
f7c1e11b067ffa185c576fea0cc5c811ccc2f6d8210156fb45c5af6e9b00c477

SHA512
9e061d608a564c96093d6c6ddae372284b44f7668b53915bc841222b6b5fad47bb9281d2341dfd908e17e997cf843f03cef26e38bca2f253c968d1d13d2e2c80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5eedb2024d1ffdf3464524578fcb98e5

SHA1
e9cc5fd59b546a745135cab2d1393c44a61f9d16

SHA256
b5e4cdd7cb43e2e51a5cd6c927feb74d372086565ed7c800b80f354e17955fbf

SHA512
8376d849fe6be17d3ebae41b094ca2a19892bef163fe9477f719777d8941f56017e3c68842d205eb78a6817aa22aec67ffee9fe807899a946ca7fa5ab962125d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa3d897e1a9ffcac315bcca640512850

SHA1
f588cf1c4259551f45472f7eca38c45b30504170

SHA256
c144ad0455f9c874ddbd7621f3180038365e89b54a049455ce7ab9ed9b5f7ad7

SHA512
eb9863ff21000672e1c7cab389e734cdb9d1af9219c7af97ad44990372d6d0ca79f3bc19ea5394d33815dcb3fd7c007bf2ed2e1945272025cfdce10d5a9a5585

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d5320dd0d87460d690b047621f5e39e

SHA1
bbe9a093e6fc4a0ad796745d0cb5ae77f086f1c8

SHA256
02d5dcfb0758e2564ddc8f7cb18a1aa1e6e267fda91693845dc65b049837db19

SHA512
fe2824f0285d86c040cf7520f6ba965f5c8d72755d96b0cd4ee49ebaa9cb8cd39c50c4a9a45b0e2c1f9f9aaf4795a74c1cc15ac21b858205a07a05d70f7838c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb4f18dc0353c40482d9594f4743000e

SHA1
29d72f9c2d58f3fd2deb986a2c12a15aaed1c032

SHA256
eca0f506e8d69bb21bb0cd1d5b7ac1b88df207f48c9365a67b5f73a96ae1018e

SHA512
cf1aac2c163e41d92bab91b14b0e97f67d60e5227068676953b02bfaf8167b8e2f03a13e607a158f3b1b3936886992396ff916371b10e75b6a2674fabd601452

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de10cbb35ee31408a4e97d0f89496755

SHA1
e6145f0c3b42136411884e5a06b98d34f6b82e4a

SHA256
8fbb7a242d9d991d946c55b3eb1475f1b69cf8ef94eb571c0d4096bb47c0d65c

SHA512
6f33073631d62ae821be53b7c6c77172e381293188f7fa462b384bb35c33f75127c8138a0d09c59b360aaa52882e5ebc40883fd1d1c9744dc5cc9c436416cd11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21bac158c9b181dddd8f353c22eff1ab

SHA1
afef1e360f031abf53b53f207c81aee8aff485aa

SHA256
ee67e255277ac390c9864d60b4ff91cde20d8b4ada8df9d2010c9fa7db807b45

SHA512
a7bea1ae56136a60862b42365c0b1c2f2080c3adbc36308599f1e6089a2bdddb13569f41f5042dbd796a5ec28a92bccab2f0e751673f0b26cd8f9d5292d00090

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE9B5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEA25.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit