531987e024afe6319da51c553ec726e7aa7d5b6fca534014998f2ad772f886c9

Analysis

max time kernel
133s
max time network
143s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 05:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eab34da544147b798b18e917ad563cfd_JaffaCakes118.html
Size

19KB
MD5

eab34da544147b798b18e917ad563cfd
SHA1

c93871833baa9eef08df46808f383467a5adaebc
SHA256

531987e024afe6319da51c553ec726e7aa7d5b6fca534014998f2ad772f886c9
SHA512

9eced473dfec7f8ba72e365de41fd1af3f8e1f2f6a3948ae79084f84c6a23688260922e1b7a64b16e8f6b60c3412101627671a7583ab7aadb96c7762673aa957
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIo4gzUnjBhQa82qDB8:SIMd0I5nO9HVsvQZxDB8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432886823"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E7F13991-764A-11EF-81C1-5EE01BAFE073} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2588	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2588	iexplore.exe
2588	iexplore.exe
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 3060	2588	iexplore.exe	31
PID 2588 wrote to memory of 3060	2588	iexplore.exe	31
PID 2588 wrote to memory of 3060	2588	iexplore.exe	31
PID 2588 wrote to memory of 3060	2588	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eab34da544147b798b18e917ad563cfd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2588 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef7db8f60b3137dd335409ee080a7fd7

SHA1
e42418cd62f7b683520238fb7339ef2a00946857

SHA256
eb94cb4152065ba17fbb4fed6f1dff95cf96e20b18f2053ef5a4f71c7d301f81

SHA512
13a7a6963095c8e3b79f005cc0c64889e3d99b4e4b602c76759dd04a0372e48afce923c07b5cdfd6e056627656caaa49d24d378a8f0c1be0489e446ca9a5932e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0511838c7861be60ebeaa59996e3ab29

SHA1
7589071d4412874e6a3d0d42fb1548fb3e6f20bd

SHA256
0bdde5e9bc608eb3e61cdecd815e35d8e6455c9aee152b4583d382a058eb1c1f

SHA512
230636f7bdf0d26b40e328dedac66275fc6abc54f4588e536e305e904fc2c74151629ee189704e9682a98f5613a32969b21c25142893a0d668bd594c389c7451

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c336d06e449d6703caf4bc6bab87b00c

SHA1
472893a6b12f49d219cef0eb09cf9b72f86b78d9

SHA256
1103321b1d3d697b7419c3ef19bed247a25c531d9f370e2cfccc614b8cc3f13f

SHA512
6f57938d81be59ebc116fa6e107b89cf41e28389e6b36d5c1d2ab614a597488003cba1eccd80b1246348e2a7ed6c208fb02ba19831588f273987f000857979c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d698f6eeb4d997a74642291f5deee587

SHA1
e019b8fa220c825c35090b9e60eed7cc02d9f1be

SHA256
fb4d1a89402361a30d7e2506efa71c07149abb0bf0ae3d22a622119e513b2131

SHA512
65778d1921e07cd510b4887696199a61431bdae0101cd293b2035dcdd16797aae51adddb0a7065e20b9053cc532be461726e34daeb2c5482306406d4dc7225cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e7ebea648d506a34006ccd279d34692

SHA1
843a1307a1c993ec3fc3b5f1fb5aae95bd63abe1

SHA256
2de507485ff32abbbbf878d6326b8679d429df47dce6e54e15be4c70aef1a2c6

SHA512
5c27d04141655c6b262d3a6c098744f52b3542643296d0e93e140de295c44f6f43e076779568a1fa00d44f75f91a85380e7ee3fbe58697120c4737ddb6831a0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
546f38eced734ad14ffa8d8a88e268aa

SHA1
3f07b5518f4709d08b6f8de0999b7f9dbf1d5530

SHA256
1dccdb45ce9435fc21ba3d27d8b4a242d377f77a8b84fd47d856a32d8a6630ac

SHA512
933ee36d5c21763735aa9c5c2f75892d94db6cad0318ded5cce6ff0233a32b7d69a1a48784d2b0a39b6776f39b027a750b6e894e9efe5995bde8454af8b2a15c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fdee0ce6ae246305f46a24397cd7e06e

SHA1
1c804df12457f99307ab608d8d4e5ba57bd9670b

SHA256
b44e779a95ed8ceb6261ff8ad2dc5971eba69d24f7a827499abcd55422c66142

SHA512
f180f2a927bb8d476539deb815584f1210ba54fac365b6893b47311eb9c30ae18b722644349d7ed0eeadf6101cf85c35e2669da0a9e3d9f740044c6662185bdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fdf9388803824b2bd905f644c692c78

SHA1
7cebbe71a80b9c3c593afa8e5f4b701603b26b3d

SHA256
00e9db6a95397af7a1992f20ae520a2df33cb3475b7ce037fbd2c26ed14af41a

SHA512
2a27f7bab5a3f86ce1385c070cc7ffc6259d67d9b294e71aba45e00b9a6e1ade8583bccc78a4752aaf942ca237d517ba8256fe9bb16bd39d89fb3ac6d0274516

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
815e206c967ce4d15a32548a0c2d88ef

SHA1
69fbc5257c58ac1b05a63d0b505fb1f48b8a04b4

SHA256
3590ad5f36d5746cd1b7923fcb407768714bdf751cd42546eedef0ca4f3de08b

SHA512
c6187da6b592af14c4b2128472d1a9355c2e9fa8b5f70adaad83c8ba98f45dc8008d468aa6695824d2a5e1c6f25b26995d673128ceb51cf46964622ceb2562c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9964.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar99C5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit