830a090d39580d7b334703e80eabd15ef94c14915037ff2c01002a50a843b554

Analysis

max time kernel
130s
max time network
140s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eac317bb73dd49f3850a2e756ff78add_JaffaCakes118.html
Size

189KB
MD5

eac317bb73dd49f3850a2e756ff78add
SHA1

c412b45266e31b4ec3bb6d1612f38470abc8a46d
SHA256

830a090d39580d7b334703e80eabd15ef94c14915037ff2c01002a50a843b554
SHA512

3ef762aa126f9b8e98eb65b5943b2d843c5f05c83092b044bf69b6264849a7a639604337b6924aa90c4972df85bf86d8551a67da4584c5f249172edcdded8fcf
SSDEEP

3072:fYzcbwTaNoMVyfkMY+BES09JXAnyrZalI+YW:+zsMYod+X3oI+YW

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432889252"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8F2AE8F1-7650-11EF-ADF2-46BBF83CD43C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2084	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2084	iexplore.exe
2084	iexplore.exe
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE
3048	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 3048	2084	iexplore.exe	30
PID 2084 wrote to memory of 3048	2084	iexplore.exe	30
PID 2084 wrote to memory of 3048	2084	iexplore.exe	30
PID 2084 wrote to memory of 3048	2084	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eac317bb73dd49f3850a2e756ff78add_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2084 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fda49f63abe88a5872997e9a98b23fd5

SHA1
efc5f1e0321386db769adbcc487282abcbf11dfb

SHA256
397d251b89801282a082593e6d993b1db328cae07cae15c49dd3cf3818020354

SHA512
d4e624dff30741bb739edbdb68faf978b59a7d794903d5459387d4a43f0bedb6f30f96bee99b4a43e06368621d4115a53368933fa282f35396dd12cc7f153386

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e1538a3c30c883e58f023080682cfb8

SHA1
4d40bae4258463bbdddc928ceecc8f34cd6904b5

SHA256
e2e33b10792a61771a799f4a2ba5e0534e7ed209f87a6c06a95fbbcb3eb2a7f4

SHA512
b47ceb6f958acb4b084bb95e11670e457fb8ea7683f4592af9e3edc2de90f2725954f42715573941aeca98f6cb9e08e224ae6b03a19ab51cb941f67a6dfca94e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf7699243fc1e007ad7877253c708544

SHA1
88966b00fd2e1bd613499c10ffd92761137dbb33

SHA256
32ca92eac3862f47a7eee30c040b71dbefbfc5b763853a273b940c9ae771c4fa

SHA512
6c3d712c3772234c80aeba1fbfc7a45f7a410bdeba5f570c7d08d3125929482f3411f19992bb12f985da54a1454d439bb31329e4fa5246c6eb52dece59f32bed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28737457244708b550a8961da4774b1c

SHA1
a1b1d6f85377b09331f6419bd69c0be8afeca3d5

SHA256
8572c8a8db3bcaf68333a251ad9439c0cfab610f43a123751e53d7f11d656158

SHA512
d8c5f0c7bb439e4cb140022c6db1ff393243d64a1febe5effa47d41e89ea5490a2900968f0136aac017df7b1777931e954d2f1765d6ad74cea36dbe8e1d9842e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81eba9ddccf44bdae828cd37c85e2ad7

SHA1
fe9fc158945d6d58698668910a7a03f06345082b

SHA256
544ecbbb991f6d42b1490c29dacd3bb6d95b0fcaa07ac884f03005f22ca65288

SHA512
9ce9e247c4f90caf929ca9f2ee907b99bd90ab3d266e08acbbf65a7308bf1044a1a5e1891ccab899047d10aadf55eeaac56259e28f2035e196f32915bcbed914

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
018b341756a46a1c6b2093fa45b7f1a0

SHA1
00eee74f54f7d6c60936a5a6096eb0460b5f6872

SHA256
2b9748afb96a18da33b737a3684d81688e6964e0f4a6046f64e4935f1467740f

SHA512
29657e5ba6188a91222ce8d278d65b82864cae9768e574a73e97773cfb6e5360f210794aca9ecd5dc270eb587afd18a42650d46f70f9f6c9d1ad7d18e72f2d8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5fb25bdca275b973fd3ad08f59f18968

SHA1
e2720c1d3740b6efb40487939b66b7a8235bb951

SHA256
60d1af2d14accd12ce85f016ab3fa2c6d00eb474c6e48051a9a219be32959202

SHA512
1cb366b4ac225e9091b004fdacb20a87c29802d67fe3e18081020068863a00a191df321284b5d03fb783934d9b4739adc9b6a1de2d1aa30e1e29379fc33dbff3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ed7314cf2b15385a30f524469448e36

SHA1
eebb83309c33e2913e067e321d0f8f02fddcbee1

SHA256
e8b0cc0e1609e485049c326a1c51c4e4019835b5abcb46b2c7821ea6015bbbd4

SHA512
69fd43def018b82adfcbb26090357cad11c8566af3c460026c328f30ebbe8db632be59d6fa5b170fb77add65e73303425e587e116835ff1fa331c88c2293084d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8cc716173d85ee9410534836731385b4

SHA1
707d482fb2b295d167a2f3c91142deaa5170afb1

SHA256
beb6134a6b0365d37cecd1b677338753a7cd98d8b4609548701f694bc8aa6209

SHA512
3fcd8b57645c5e84049537164973a7d091819531fd28a9565d2f0416477c1145d3881b0881b7ba05bb2d4bc43454d97d5e0d5ec584dc99c64282039d0e1b1282

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB432.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB4E3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit