d334c284c9f1476ef1e53de4b932ba294d65d5fefd0f63467ef37f56f01dd86d

Analysis

max time kernel
148s
max time network
147s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eabe526fa375b9edd4f1093696d18663_JaffaCakes118.html
Size

23KB
MD5

eabe526fa375b9edd4f1093696d18663
SHA1

17f188693afbbf3166649bc2ed0b1da765527bdf
SHA256

d334c284c9f1476ef1e53de4b932ba294d65d5fefd0f63467ef37f56f01dd86d
SHA512

114d8e9d124dc82f60196f9877cd47f11052f3dfcfc3fb294b4d8ca5dfdb20bbe66bb8b3ff10bbea8e1aa3c27acc8286f6ff4b533a01b93720fa338f0fe28474
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAID4/zUnjBh9n82qDB8:SIMd0I5nvHhsv98xDB8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A2D3E891-764E-11EF-A3CD-E6140BA5C80C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432888426"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2760	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2760	iexplore.exe
2760	iexplore.exe
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 3064	2760	iexplore.exe	30
PID 2760 wrote to memory of 3064	2760	iexplore.exe	30
PID 2760 wrote to memory of 3064	2760	iexplore.exe	30
PID 2760 wrote to memory of 3064	2760	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eabe526fa375b9edd4f1093696d18663_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2760 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a84eb213244a7dc78fe2bfd613d95bf6

SHA1
fc28721dd2f4c20157fed46285a20a11528a6984

SHA256
52159aa8ffc7d0f664af9303aa882474c69753b3c13cc7525319dd812718916e

SHA512
2c12f098371aa5b72d1914b14eb3ab93e038724dc6819a9ffd45966162c4be121923f99ff96dd1e5fad531dff02ab23bb9fbaafb698d02a3d4de54d846170642

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
461e42eb2d070e31b950821df1e6fa41

SHA1
221e4c6d651309d4878f095fd4ad24b34fdbc284

SHA256
bcec5f40f97b04563b5f019edbb9a4c49142082022284d7649efd1307229b87c

SHA512
bb700bf514618816533d9239582907e2a652ffccc328f4adc9484dd879af1edbf86ec830ee447cca059203d3c2f5d4bb37d60a3129e1d8d3e2582cad1d7b3790

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf04b1a1853b81361e1883d50c50d46e

SHA1
cacda2ec4e6cdb3676ef3c3e592772e7a491ce9f

SHA256
21b128169e44ceabca867bf351c2898a95b08d425b1ac9a841fd927f7823fc94

SHA512
a3079eb4f39894fdc9cd8e769b8718404f3a8e520371a82d85f24483928a57951c4e106149f182899d760e1e0e3968a0813478446dc47e222b2fdbacfcd53198

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c8c9417662ea7f8ccec2cb3f757622c

SHA1
1e6ced9d1d1c819a5756fb84db4c837d7c525d76

SHA256
db2ca07a82c18a345d4893871bf494cffe351d22c90045f8e83e46b04cc39c5c

SHA512
26005350fe0d8052aa0a42c1f69ccdc6f74eeb4cbe164818c0c5a042713fbe016843cdde3f2570f6a7ece770fd41f440c46fcaa7958a7d38daa05e320ef0a8c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6951a3e20981fc997d9bc4d6f2047ddb

SHA1
bf80adb5cc789df6bad3eb5e14005685a94997dc

SHA256
8c194680f3a2bce59395a70c1bc6c5bd3102e49329f9f56c97f3c4715de084fc

SHA512
3478233fabd358b334aab6b37dabc0e2f1681099000e9027030fdf7a4a0f4d8abd4df1a7843e162247116b150dfba75a5fe0ea9893b627943e72634da442854b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aef6b25e035c6b7444fc60a77730aba2

SHA1
49b38b2c9c09731f05e17070ec92ee9f1d458948

SHA256
2571ba279f2a2685e2cbf3b8730817c8f948bbf907a80ca2152961fa5c9c317d

SHA512
4584302e8bcf054f3e3552f48bd098ab02ea98807c155acba6fbdac808069fa64ba6a5012b6f52ae14b92873713b2cecb4bd8ef945023ae858e54e42a889f0be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a41d44fc2a869b4db2bc86d01730531

SHA1
f905c92c121b113305ac5b3790ecc88e4973bbd1

SHA256
484674c024fbb69751aeca4493cdf9fee548e22b76bcf6d5aad789d38d068f08

SHA512
3f395682a9558393bd8fec56fd39e84e568a8d8472450400a17c4025413968c77dcb5a19ed25adc0df63817508ab094e793c1161cb94ca3c0efb0b9355c1d5f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68e80e0c692d1a22aed1c6e9423acb1b

SHA1
7f3b221703f01de2269cbc76b22dfcfb053e512a

SHA256
b2e3122533bd28171ca7d95a396968f126bf799623f8f2c4b24d50d3fbe6b747

SHA512
685d0329a5ad4641311c46c19fe6d79da552fb40f769f14abae743589a1b3ef31e706cfe30e68ab35eacc8670e474a398289adc9863407f0129f9528bbad2598

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8955ef25a79cedc6dfe700b988107333

SHA1
1c4aaba876d36eb8aead6a65cbdbdb658af55043

SHA256
bd4a3635894797d6fd297f60882c399f860f1171edf8ec3403066124df41d446

SHA512
ae830da293f51b87038eb75295d5fc65c5e9e85a69dc61aa69cba65d314f2c7185bf89aa2aa83455017bcd1b7989c60d2cb9e45b7a342498ee604bf59a4c7553

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab71D8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7286.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit