53024c727921c0b5e29e464d2571c3621b6edbc7d807e1ecbad1ba57b9459763

Analysis

max time kernel
137s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eabb7370070ec0cd09a78216a36c47a1_JaffaCakes118.html
Size

43KB
MD5

eabb7370070ec0cd09a78216a36c47a1
SHA1

71d4988cb05b9eabf35fdc242a3d2fe5d17b8a9d
SHA256

53024c727921c0b5e29e464d2571c3621b6edbc7d807e1ecbad1ba57b9459763
SHA512

d86a52b191aa6434d1a2bc59c6f4e013e4896de5a441384291abd05ca6cf3506437b6fd12588013b52b82f644670613d9e3e1cfd38fba80059d05347817c58ec
SSDEEP

192:BOLTY+a/XjDnlFJ263gyZDxgVeOgHloNB88crI32oIVm3tmC0Kp+SBrnxXgg597y:BpbDpIyVieEmG5qSlxXJBMhtV

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B3B81DD1-764D-11EF-943D-F245C6AC432F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432888026"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2776	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2776	iexplore.exe
2776	iexplore.exe
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2948	2776	iexplore.exe	30
PID 2776 wrote to memory of 2948	2776	iexplore.exe	30
PID 2776 wrote to memory of 2948	2776	iexplore.exe	30
PID 2776 wrote to memory of 2948	2776	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eabb7370070ec0cd09a78216a36c47a1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2776 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
485a62d5a1aefc7404685bda7f5be902

SHA1
ed29d014cb67e13be2248a2fadeb4cf36e4011e2

SHA256
11ad1badfcbbc747a025c2f5cfc606316980a68059bb53a7b4098c9c23a0d99a

SHA512
f61c31d233b22226645b32836380b6de61e5cde86635e90e4a60012705ec169098766f73942f095edea2d8da6a59891497994645c5b416c307250d20dfe17706

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e364722334b096579613ec388bd5ca83

SHA1
d19067c1e5c99cc51d07e4c877279f81356f3e0d

SHA256
1b2c76b2a6030daf73c58e4b80a22732fe5dc7d30524b50bcd8680def543fdff

SHA512
5106704b46fa019bd6506b6282df66167b41858fdfb8941f8543702afd52c84805e219117f39242c2d0c7e2acf39e59200775d276b2be545769e27954d9a24ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
067a168205141b1993cb72d917f14c60

SHA1
289b5372fbea466e11c495d0655f33dc0068cc1f

SHA256
13d22732c887e91ed3b303be7e8b5b8294d82c833d80e0c92e2ceae64d9504ef

SHA512
abe889bf287054b62a2e94ccf9ac58de6aa6ff78ae47b22b5288e4098c21a9b0e3989b474c3b3d317281ce6ee55b5bfdefbfb4d251002bff024ee28cacb1bfd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
253caae5a9368020c3aafaf9da0e8af6

SHA1
f47c1825c48addbe71ea75e52a24e2a028faecb1

SHA256
a1f54d7f7a4652d506df93de7b653e066cb999cfc1e66a8c6c86a913332cd989

SHA512
6a821386809aedee2b2b81fdfa387fac11e524e523ac01441ffb6759b14e5b230538826767277d3bf4a7d26e2ecfe805db3017ea927c4e6bbb3d4bb7851e971a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe49e23e01587421274ac195a35b16ae

SHA1
c13a88cd65bc3193fc5c9324a0811c5929097b21

SHA256
24445e721f9a2d7a87068b56cc67d510d8009fa72be4e00da1fddf64d75517cc

SHA512
d0673c87fcb637e1f93ff29eabc8c307bdd250d6684e59b0d30ad4dd6753292bd2a0d4298fb9c01f494b60f281942edb555406aa0003a0e3b37cced0464c32c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75a78794791764bf8205ea8877c003df

SHA1
6811f6fc57f43165c4a4df16adbed575cfde6912

SHA256
02478cd01d9d29b40e3ef1f1ae54da06990c28e45d537b52c5ec91367208d913

SHA512
376bc023fc6ba962fc558b3db1af16bddadec3e4398320b861d6c20af02d36c94ef59fb5787ad1d5064651c7ce3142c7cd7d3f99a68ca98fe79588eb7aaff38e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e030b85d12a5e25c3b1e9e0edcb4f91d

SHA1
dcf1b3bcbdb91a1a8df147213798431fffa58c04

SHA256
81694b710a7fb6df25b982a85fdc508026ca3ae27ae2738b8e7d60ef221a0376

SHA512
0501ad6a77dac55319eb2d68751679f5e3bd7c0ad20f9a715482b2d34e042e51ed079cf2c0eb5279480c3fd2e7cd069658933160644c4194d08f89c2a46417c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
043408cbe52b82de9f18f1beee9a9fb6

SHA1
c4e2f67f9beceb675a8b2dcfa7e1274f03d5d837

SHA256
c67f3dcde41204df006d952b2e7a1c8e80e879db29033c1c9fede57e9193ae0b

SHA512
a24a76ceb674880bcf2c4e30fdcd54dd87d0e36d8f08fdefe5df0211498295eac2d4f836433db650ead5dd7ccd4ef5762d2ca1c188fda9767ccbf48fe07fa8ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ca4842fbc43de3673d682fd7e9a223f

SHA1
3d8a2e3c53825dfa9137971c34d9d8ce589b0602

SHA256
29990526ee975356a408fe9504cf357806a08a520b8d9b0a8f840870d5fb1857

SHA512
d38bcc3c2f0eba91a13fe62ff428b9ae26512d98544d9197664b4ec08ab1d40a8a96f9ca5b0f05a4703e653969490e9c2b51cb5a12e99f69574f9dcae1db4a45

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab511E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar520B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit