a6f2d42c1a404ddcef4365623541089c6f8b9f4b17489f87de2460a10956548f

Analysis

max time kernel
141s
max time network
142s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 05:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eab18f305a0095298978e2386f4c4178_JaffaCakes118.html
Size

190KB
MD5

eab18f305a0095298978e2386f4c4178
SHA1

981afdc0cb45e5bae88fdbcccda5fee3382f69b6
SHA256

a6f2d42c1a404ddcef4365623541089c6f8b9f4b17489f87de2460a10956548f
SHA512

30cf42f0d8d718ba44c9a6603946bf1460a12632beaa9349bdc7753c397028b9086d0b8fd64ee31edd5998d01ff7b7f2056411fc465a5545e331f19c60e62ca5
SSDEEP

3072:SkdIcD9dyfkMY+BES09JXAnyrZalI+Y5N86QwUdedbFilfO5YFiM:SoIcD9osMYod+X3oI+Yn86/U9jFiM

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{365A9BE1-764A-11EF-B0EB-7699BFC84B14} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432886526"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2260	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2260	iexplore.exe
2260	iexplore.exe
1604	IEXPLORE.EXE
1604	IEXPLORE.EXE
1604	IEXPLORE.EXE
1604	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 1604	2260	iexplore.exe	28
PID 2260 wrote to memory of 1604	2260	iexplore.exe	28
PID 2260 wrote to memory of 1604	2260	iexplore.exe	28
PID 2260 wrote to memory of 1604	2260	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eab18f305a0095298978e2386f4c4178_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2260 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b1ce937b4f1783226f60ec6f725eda4

SHA1
dd23908569ba3cd6079f22762b5f79056e46ac7a

SHA256
377b36fd1a3660b6a5371cf5391f80ebc26e924cc6fee571cd373f85b3994a9e

SHA512
32166269e33e67c72c8848826a2dd1326bab77eb9912ffb7a0935e4adf5ff09014cf3e6fd6d5401d5bb20f7b392e3cd066af6c994e499720282be9da7e43566a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43688e55f79bb9c62bf016e144a2f0bf

SHA1
313367a5eece8efb0c7a3aa2988dca74bf42c2da

SHA256
4b0580766403d6b3aab36f75108ff72dde0e5e787baea57eed90f7d533897f14

SHA512
d9ca5ba2c4afbce171603529b7c5d6fb6d2165c2bea0d364f2d09e41bb3296ca48d734f9a9d2fb5aedf0767529a7c2d6c16fd5ff52bd97d4ff91732b1e86679e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f017a8c11b0088f85379d7fc02c64baf

SHA1
3d45ae93618eb7e3ccc582daf167a6b110238939

SHA256
c3e339e57277fac4f7ff58c48789d7b6d1dfff70d0f4ba508b9e9aeefc3529fb

SHA512
7da02aa2ec8f36c391958f4e8cc13dc19972d97542a63fc9051abb7174924e047350a7840ce35985cfa409b6243a2beeb908b19b2b48024b59a5b897dbecc356

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59425309f3c62d7689c0be9a69ab2626

SHA1
c127918bb414ffbbff099a4f8a471b3540dea4a6

SHA256
28cf8197bd53ffd3bb4388d2c6ee1cfd07df18bdcc8933c42167d8867e8746bb

SHA512
3d50bb48e0c508e2ec995d0c5b0f74b74117dbb6649f22fe77f844ddb87b30b9150801cf40f0e29abd7d52e688bb9535ca143d54186ef0e64ee35db8418a8032

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6717be221afc4795769fac71dd849683

SHA1
2471e9c9797e0b0f7384713584b02304ec74a78c

SHA256
3e371932793354797b11ed94702a6ab06c6fd14cd85c6ea912d418b6abd463c0

SHA512
7d0f6b9cbbf171cd9777709809f3a75096e75f97eaa133ab6cb44d27797942f1db475ff98bc4efc6cf4d38ecdefd982a7f3cf902b5c340709f9c7f8ceda9b3e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebdb1e260b7045e2716464fe3176bd6e

SHA1
ce0c5a3e8c7d43d7e84262a45a58d2c59db478e8

SHA256
7b03a856d785bb920699faa33e826d71736ac797be074e14f3fef947bcff1c24

SHA512
2fc334cf2f120b80bc79a4b4dc4fb7530b2fb20bc319d106e1a0af5b1dda3f13777a9a00c2cd64ee84e7540b97957ddb10af1a106206775924a9a22048555394

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02167207ff76c6a0ec173a1d33c3a57a

SHA1
57ad09a86686fba49e8dc8d8f2a7f7733d472e84

SHA256
714514d7cbd857bafa78884a3b976877bf4d90aefd57ac07b220ae8cf44f124a

SHA512
bff8ee03adcac03529302ac08824547da0330113ec065736effcba28fcf5d5d8a15e6df15a12939ade1567f68dc5c217eab2cc39f5233133eca26878248e8ef8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88c8ed54de955e73c57b69a63d5b57ec

SHA1
f5a5698302f8b078e144e2cd016da9130a1307f8

SHA256
f92e0b86bb66e39433f06c8a50c713c9109fcfa22a1020a3e0ff96b18d3c37da

SHA512
c17591cd068f32dfe269900443e8c59a3e3afc5f1b0475a8a2d9c38b847c0551b196a68d707586da00104b74896ed5cc988cd7c33810f2aef7f312845d1e2a7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc99265e7d14c4df4a20ff4399456bac

SHA1
9cdc70f26d3a9907c521a8a7ea91a4f871f3005f

SHA256
cbe39b681e103b8b4a4a021f3ce335f12d85f406c6fde13acb21604c76d9b8d9

SHA512
f0251d4932756d52566afd6ebbd5c9b0ab6385076e574451661bc2e54b035934037a070578439562fe6fd66c530a7aabb2fa2ee7fe00de3c1e950a2d7612847d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b540d7fbe4928ef034032408b3142451

SHA1
bbdb4465792d497368c602ea0fe8a533e874e85c

SHA256
c99b9ee2f7e9a6d075bdbaf5099c752146e2fb65e7338f7cbec8459f4ead1869

SHA512
be5f83ac503dfb1098665f3f9bfa378718d839ea1f7b99d921ba760dfe08ff92f7a33e12741780adbcc5bdc29ef71fa95e28d969ee090f7982c4d4385b4b34aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAC0A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarACC8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit