da5b2b35bd4d977c71e2394f72cc2253d17e181669a684a32ecf136354b8e99b

Analysis

max time kernel
131s
max time network
139s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 05:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eab0022828ed6ae2539c2d30dfc9add9_JaffaCakes118.html
Size

20KB
MD5

eab0022828ed6ae2539c2d30dfc9add9
SHA1

e2598d05219ae66ffe38807cee8c04f108b97882
SHA256

da5b2b35bd4d977c71e2394f72cc2253d17e181669a684a32ecf136354b8e99b
SHA512

90becb7388eb56e1f6ee44227237784dc0134512876712de5e24167a5fd70f55878a1e9bf3a3690809188751f522eada6e7ae06d7ea9e441df752430d4304fa5
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIu44zUnjBhku82qDB8:SIMd0I5nvH3svkdxDB8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A4E5DA81-7649-11EF-BB30-566676D6F1CF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432886282"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2948	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2948	iexplore.exe
2948	iexplore.exe
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 2412	2948	iexplore.exe	28
PID 2948 wrote to memory of 2412	2948	iexplore.exe	28
PID 2948 wrote to memory of 2412	2948	iexplore.exe	28
PID 2948 wrote to memory of 2412	2948	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eab0022828ed6ae2539c2d30dfc9add9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2948 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44b041ed4d973559fc8da26fa88c8de2

SHA1
98b1804269e00b57a54e5f2dcea6fed446524d31

SHA256
d0b04ba632d4ce5c9db567c04b15932c63e826962d5c9dc9451755fabf993ac9

SHA512
cdebbb191c1b26518e62658f2d739455df511b4bdfd9e7f52ba5b3f3be0883a3d980ce48a776ef4dde85cb3038ac415a746115d62a9ad2aac93b59e0e14bd214

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fcff27e70e77b01d5cbce7a7491d5f85

SHA1
2b69a9e9f4f1312dddde484d7c20190743ec3207

SHA256
933c8be1246115cc05b5f9bf03186d4b52832625902a8d9f061dca79dc015604

SHA512
dc4f6d956a2e637bee086c9ae6f93a1809cce5dcd2e2eb70c3db59de46d91faa998499e124fae5096ac89ab57f7e217b047c0eb161b47cad39a686741f4d43f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b081bd87dc33864385fc4126a8ff6c21

SHA1
9d50c2abc5a4a6b29542d5f89bad00a3b1ee2bd0

SHA256
b2306a142df38dbead1cb8c83a79133f61d0f103e1f532b2aef1b4d7d2d087e3

SHA512
ce1a6e56f01bbaead25380b2716f92ae7b4b8e3c1154a01b748dbfb93f31da304858f8d41850e09cf67e072e7b802548cc74e5860fd02cecfd6bafd3db75a400

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d318854ddde8aeccaf8ecfb85fcbaad6

SHA1
dc0be9af17ee267492a5111de444a24d149b15c2

SHA256
629630a3cfe452247172b231f0bf70e25b89c5d296d9d612e1ad2315b27449c0

SHA512
543b421092e09ccfd1b27eb79bada2f666ba8873cfc4674b8fc112450ce87b7c9410f9374c64e54c56e82748287d60df340a1c7bd354072e5e5dec9da4e01171

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6aa9df2b03e21a25b22f9df1ef2b9e49

SHA1
fcc0f397e33cf19f218821e394f45c553d448bca

SHA256
f53665821e4b86c5ca0949a607eff715686269903911c98dec640e7fa30f750d

SHA512
5dc4cb06d789536e6cc66a2e23f81656d51f677b6cd276f1638e766df2f612c6cac2c773f0300e81c850d95316eb8f18b120bd7c28f09a442519fe9f1911b7fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b80a8f024e6606d17afd2f9ab9ada46

SHA1
d083da3d2003b3862b533bd74d24b457d4d9827c

SHA256
705081eb8f17993ca02e77e6f23a8f777d649867ff5b68b8a3c8dbe442e51cc3

SHA512
6a5aa519144c1806220d3bd45cd75b274196a516012ad1b4a6f140daa1396fda3f63ad7ac584bfe1082e0b2535ec699308f4643f8d083dcc54094cccae9e3111

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76aa369b7129ea48004b0daacb3ae933

SHA1
1587ec3702e68520274ce7a9a8b981d85146c4ca

SHA256
fc6a0fd434c1265daf0932fd6a1883c3c6f746807333fdfddd87b3d50cef4f82

SHA512
76b3207bddf45e93c1b83a36d329dd478636f21a86959c403cb76d3475f9c51305aa68bfd7eb562442ecd0944203002219cbfe5f7aeee82f66048c3f07ad160d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b1dcc2149a5d8950b01205ba84adf5a

SHA1
ecfd3028b4c974dfcfe81e217a63ceb23f2dc493

SHA256
37a648da6d89d2a348c95f5d6a9347b40f6097e3424a9c916fbf2d5ac3e7af33

SHA512
cc0b522044e327d28f09bbe58f9b22776239b3b9dbba13fbeac599af18d275cddad01cfc1934819759dc2c1cfa08eed6c4e78992a03ca6c188ff72a9f6b4412d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1152fcac6007b8f4381de8696fca283

SHA1
57d0d0cd8e09516862136feec3d718fce81425b9

SHA256
eaf9d8cf8eb06d85edfb17fe6ac725130ad31695932ed6767e869c581b762ab9

SHA512
a0c2590761b7acf2f4a155e6629e62a4211c2c42822317e12469673b1fe71f134b30bfd91e1bbcd5cbf680c0a4cf65d7d8d5a0700d2ac08f26190b2a88e07358

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAA53.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAB13.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit