1056dce73a351f12ef2c09666698517381cb421d57148b1d643d953b6504c8a0

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 05:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eab4f0e5578d9029789f77d2d8a79d64_JaffaCakes118.html
Size

40KB
MD5

eab4f0e5578d9029789f77d2d8a79d64
SHA1

30b1b9e78fe4e3bbefbdf676e6b06949697efe96
SHA256

1056dce73a351f12ef2c09666698517381cb421d57148b1d643d953b6504c8a0
SHA512

c6aa4b504c4e94f3c66af9705fcd5e2af520f4ac2375f8a211a23d868d87fe6c12346160c27d6de61d1cbc40e80b3fb83d43dc6a5b90399b5711b3a552737dfb
SSDEEP

768:vzppGh0OQHoY0EFV40MnA1in0h0OffeyOmdy4dS32SBmQPsTKwPXu5G0KTwPJOqx:vzppG2MSmovHGdPKxM0h7kxAlyBOKr4s

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{92CC25A1-764B-11EF-8595-E61828AB23DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432887112"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1120	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1120	iexplore.exe
1120	iexplore.exe
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE
2136	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 2136	1120	iexplore.exe	29
PID 1120 wrote to memory of 2136	1120	iexplore.exe	29
PID 1120 wrote to memory of 2136	1120	iexplore.exe	29
PID 1120 wrote to memory of 2136	1120	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eab4f0e5578d9029789f77d2d8a79d64_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1120 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2409df22d365900d2dc7b498175843be

SHA1
c0785a1418617469ff9ca535dd834f3106218587

SHA256
302bc33bc9debd39d14ab8936b3293842ebfef645166fc88fe01b6b9256b79e5

SHA512
75292c3c982a881fd2022c2f765532ed2ee229119e274f1329c01ec277285614aa7c2a6759af1c3ec7ff972ed2ee7ab2f20a3bdff659596fec7253b9cd7f3796

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7267a79736756da3412ad5b9b54d0bee

SHA1
006d54f37f0b2d64165b55ad61afe5989514c5ff

SHA256
e0c146c2a62ff138c71b776b2a75783ffc46825936347aa29713889a65b9ec54

SHA512
d1c4cbbdc9a1af33263cd3a570270396e379116ad493623913edd64fdbfa354b6ff2b824a58126ef63ac54e48398bd3c945b72bf7764ca3b01194300625f5eee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3ca250c7c62157cb503a2ca4c331b79

SHA1
a03045c53644d4c239959a1ca660dc2a4e7b4a06

SHA256
2bb861f62f559060bc44b54eae480957469895aeddddccca6b0d128e876b2017

SHA512
6c999d4811c2686bf983f25c9cb72c69da45076bc92ecdadf104734ccca3ced8926e6137e38de5b6339f44b35d252333ea271eb83c280692c7cb20cf68d50867

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b322fef3b655049f7ce3880341bdf3ee

SHA1
aa301a490d677699bc73c7072b6cea1c8210b261

SHA256
7405453881cbb4b9054c0d0e9610e203983c27a0f16d2c8f79c81714a1742e08

SHA512
15502feedd76b24ea6cda6499cc62c4dacf8082b5a86dc510a3686d16e003920c21e4ef6ea1ba7cffec06eb0e80da8c803f96d2e750b78722bf4690fdf9723ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
afa68ea57e1daac1046cceb2b8d28842

SHA1
e8ce3f90ee6559eabd4f8b18a0d535f522889518

SHA256
3f3977f024f5f20ba52786326e9ada55211b30b28cb523e83a0df3a41be84a83

SHA512
b582dd0e23ac9cdf4e5d65bb13921707baddb1f7171b6718caa8abdc76c4d1206f293c1de446bc4f65ca70ef5f40bc30d9765cc91ddac61b9402e569060b66d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55c7587c42133057149baf7cbf11ade4

SHA1
df8cfe31dc367533945d8c749c8f0cfecd16c296

SHA256
5e3bb546326ad84a46817b76868ab549f16d652eb0fe3f40caac8412c430bbac

SHA512
9dcb124bd311f8c413df98ed3dafb371ecd902580dc03a69513fc59bdea4c4f0a3aeb970971d9037233265fcd2fca4b962b8b83601758e5a4535ba63fce432c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c67d985d89a4685810571c6c491c29ef

SHA1
7866a2adde1d1dd7432481784037499144170f9a

SHA256
d0b50b0f22f72b2174418ecef56ade335553bd1abdc2c556ad159a89498c39c0

SHA512
2b63a206b9755d1406a32554f09186520b3146b435639e1b12094e9a179b3c5e4d67e9695422aeabc228d15cb991cf1f8f4087bf0c4bfd60bc3291c7cb65d8ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38ad3960b7338ed567b192b503faf15c

SHA1
110df6166c9acb9715613902576d7b0dadc5bb44

SHA256
dbca6bab88653683b22fc482f717e098ddb26dda78519ddedb6baa5e8d178365

SHA512
4417f924cefaa67eb514041554e64f5223aa47e6507fbf088d7a8f7dc5aed9c2fe582cf57357eec97cf069dfcceca55977843c680cb6e5134cbd62b8dc87640a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ff22c89303190f93b316a4b69fc0a75

SHA1
0689d298913883a2e4f1aded1a4b46af19dbadbe

SHA256
6ebee02c5c2c8ce04f84f052789cc8b3c4ef73cadece207f954eb0ea0b7d6f3e

SHA512
c6ba057bebe45532eefbf05bfefa754799f213376779f543f45b055ba857aa7d03d3eb0f23f9b1f9cc938c697c597d44d3589606f1c41633a3c7709d4d9da403

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0563817c793da4cb79698b03681cae51

SHA1
ae573b4ff01527067eee34c21579890142570763

SHA256
d5cfdfbeef5d51876ab6a6a53a8ce8c9d33b302dd7db5fb77e32381f32affe84

SHA512
7f38b68698b8d7e0930e425cf6ec6c40e6df6f8647df24fc02e6bf340da53015da228144e2fca7cb83f1023b23ff5479cca3f03714352431f435704817776087

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8e7448db5146e9f72a495cdafe6886e

SHA1
61454f7b646c03e8ce976d692039613ec2369604

SHA256
3cc1c24122b742b6083d89217812f61baca385c125ff8aa53b5b1c03cf619baf

SHA512
f32a49157dfc24d88151fe6155090bf2504e92f7baee825184f139c91f7467ee5770e4c241166cb8baea5314a96e958d9ecf0f5d9711c1df53e5a64a0304fb20

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1546.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1605.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit