18804d7df54c4ae427b28daf15dd81f770383c2e0d567c9152b4fccf83dd6849

Analysis

max time kernel
148s
max time network
137s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 05:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eaab9263e51579456ca6c1698f21b72e_JaffaCakes118.html
Size

22KB
MD5

eaab9263e51579456ca6c1698f21b72e
SHA1

0510070a1ea811df0e6d83e6be2b6c148f6ca9d3
SHA256

18804d7df54c4ae427b28daf15dd81f770383c2e0d567c9152b4fccf83dd6849
SHA512

2ce8f2b7188fa80ba0040e4a14c1408c49e57809f008ead2fabea4c3d099b7ffdde74132137ef91f46b66da6af388b52ff6fe6b1563810259b014214d36e1acd
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIU4AzUnjBhcG82qDB8:SIMd0I5nvH9svcFxDB8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432885557"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F5571031-7647-11EF-A429-7A64CBF9805C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1892	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1892	iexplore.exe
1892	iexplore.exe
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE
2152	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 2152	1892	iexplore.exe	30
PID 1892 wrote to memory of 2152	1892	iexplore.exe	30
PID 1892 wrote to memory of 2152	1892	iexplore.exe	30
PID 1892 wrote to memory of 2152	1892	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eaab9263e51579456ca6c1698f21b72e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1892 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd0a3a0541fa972a27af6a817e3bf376

SHA1
685b73ea3b787a3c68248297489ff88de5d553f9

SHA256
6b68b1b1a4b5e63ab32beedf92e7d5f946ec0f482de093ae0d917cd46470565e

SHA512
0d0da917abf2ca01b148f98800a12f2c31e4c40cea7f5d00767679efec087e89bedc6fcb683528b43aeda7f75f81f3cd6384abe29f231e92aaa8e41624ad63bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47d51b4fbcaec3524eb29d4727d77da8

SHA1
37d320c74652677e33c8795bf965fe24193865a7

SHA256
d205a3790d463148578775cceb7117738eeca357a7bb11a7dd525ff26b2bf2b9

SHA512
8bdbb6d5c0d68a2b336ff137615840e354ba9d811768ddaf1ad83c538a49ded049d41499b2bdd601c4da9e1827eb1925ea383b5fd4611094ac991ed296c8b210

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab7b80dc59463c579d8adefd9578eda7

SHA1
4c546826de92512b234d79b37ba2c5cef8f0bec9

SHA256
6137e1ced8c0811443c6283df928f9e24a8d11bc09eb83be36f441ca44d1d43f

SHA512
34903e30d65793b29f3d01b27beb230fe503bff7ddf48d05776666d543e35abcd5435564a83cc3822034d8d6ad4e1a0c5c23faa376ef9281faeaa755e9433211

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83be8f1176f2404894ae84e0fe5d6939

SHA1
eb2be274542eafe2aa0e7270799163d79e2c8f40

SHA256
f1fe473fa6b12176dcc345b2aad9804c33c2dd52d4f298a2dc1c5349968db72d

SHA512
28a91a0d84aa9f6fc42b57c7d55281d376f7a84bae078feeb65c410463057d24ce14d3febf85146dbc4a62606694c5662f3233aef6e3ad2dab1d38504b7a758b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f34b3feba2fc1d0dd0a51d127a435c4

SHA1
ba37a08c7b228dad0ceab0da6e9fc805f1abbd8e

SHA256
1d760fa1b20343f991cd7df74fd072a21ec3253b6d593922b0452b56c4ee82e6

SHA512
2f9f8df594b444a1f99315cb62b8c4fc6aa822aa490eae1512067d5a7b171025925d795fa7e380c7340be995f7d88ea5b28e5369da8a70d990419ea364f65b15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63131a4b96cdb2cbd64cfb6af1cae245

SHA1
480429500d625878348e2bacea0a0b7df04a7155

SHA256
8662c36b8ac453988d01bea5eccf4f7513aac1ee04c9532dd25fd8308e53e811

SHA512
db7300d376a478b981f998be972433df47bcacdf9d2ddd0e2d9401482b5ffa3e4629d0a3d2b3120972a45194b56a4e6294c8a92730208bbd6a0af205f9a13c78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17eed0a8c369ac1240500343685c25bf

SHA1
4f0f0e49a9c233d93a97fd621a659efb450c182d

SHA256
56a6ed73ed924a5ac7617560212236c39add4122119f826d9cf55f60e49df362

SHA512
e57477a50c9ab4c709b14e3014940d6f743addcc504ea5eb8f58a159e6b3ca198705944c670b80eae567c4347c767917dc5410e3f9e8684c5c059e7e618470e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b63e56cfcf4a1de4efd0d19254829ee

SHA1
eb91ef7dbe003b0b071621600ae215be6c21fbff

SHA256
ea36b1f4fb32e9b672dd954cd6561ecfb7e73772c22d429c35ec6acc5c348517

SHA512
34bf2e4a9144214e47ec3be72532efd1debac8a512056fcc0bccda4378039d40870188bf49a88c77806baee64ee82f8d0d6ab2fe63626fe0fc55e083e5cdaa95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2383e0c6c0a2bd2b3592093eba528cf

SHA1
9410619238264d44f134c56241ae6911785d915d

SHA256
94de702473639d93dc7b07cae0dc078f5082c9078a19374636ac83778583dd30

SHA512
6a2af55ffae457ea9cd1b7023cd6cb8be075dbd5a89147a8299ce1e380d520361f23cefdf4803c39f8bfb25974264766504f2ec76a70a9da10fddaff5946593b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB405.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB485.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit