4aaef3a395f7265c02c5c839faf8203624acb4024726a4ba69d93295b823472c

Analysis

max time kernel
145s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eabc99094785206ff3d68df90d8909fe_JaffaCakes118.html
Size

25KB
MD5

eabc99094785206ff3d68df90d8909fe
SHA1

8892f2657c1b8fc1da4b9f008b51b8254e575403
SHA256

4aaef3a395f7265c02c5c839faf8203624acb4024726a4ba69d93295b823472c
SHA512

b89c577aa2d5c8fae90fd6e97c9eb8ef8972747d95011a626e43cde1568de7e3e09fe15845f68cd1310430f3b7872950e68543cc8e72d215e3ce2bd666c28dea
SSDEEP

384:SnFucujI6RoxqMwMPdKcEz4xZEf4rNXaruuvuM:SnF93ooDzIz4xZVfuvT

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432888217"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{263AE7C1-764E-11EF-B25F-FE6EB537C9A6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1992	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2348	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2348	iexplore.exe
2348	iexplore.exe
1992	IEXPLORE.EXE
1992	IEXPLORE.EXE
1992	IEXPLORE.EXE
1992	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 1992	2348	iexplore.exe	30
PID 2348 wrote to memory of 1992	2348	iexplore.exe	30
PID 2348 wrote to memory of 1992	2348	iexplore.exe	30
PID 2348 wrote to memory of 1992	2348	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eabc99094785206ff3d68df90d8909fe_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2348 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60f0afa151e4877dc9e07b1124f7c0c9

SHA1
8cde42110a109abf596dec846cef0b7a3941fbb8

SHA256
91a806a74909a76f32564bff1dd2f46cc36b5f5870677df6bff315c398e46342

SHA512
eab251c78ce1fb583d24a3cd1ef4a773f4de62619c5c0a47a14016f4dd95fbecb669d9aa819b67d29cae393acf4b35ffc35138f6e8cd6e89b33d0734a8870479

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
831a52508e91172e07d51dea76f6ee27

SHA1
a43740df275dc6e6b4675934bb1934b2acf25dd2

SHA256
d26fc3b83be439ed91a45093e556956ac6fdb5d97fefb84d1afc3cc2e26fb309

SHA512
cef4a304cb7c30330bbea70d0c80a39ede498805c8e8c2ec743fecabf3b60779e4cce22ca2c8bd420b2fe84020a4c07e02422d2344e8dd7e9f0b8490bc0c290a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e92b4d50178313516da7119ecbdf49a

SHA1
787f7c10fd5cdb1e86ee1900833fbbba2670c4b3

SHA256
900694e68f32a3a08eaddbd02eb3075308f54ee8d33d8447ceace5e44c6b364a

SHA512
1ba30de3d7732c8b7ad7576d0f0832471591469e641c628da4824ee0bcb6724d2262d9ac41e147084c0eed0bf0eb456867a226226aeaf014e5e5c531150059c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa015f639ef391dcc9177c8feacd63cf

SHA1
f7e9274bc11438665009b9980b20ef4e15cedc30

SHA256
9d779bb8a0410b05e910cbb78c4894fe4ed1efb8986da5313a61af32fbf60c05

SHA512
4dc04c6816c37611e7a503850555a02237bc263d261087ad59e264b36ce7198b4efd27ce7c8bf13eb3e0249842b84c93b7e923914a777b30287abaebf1ebb781

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9be9e0ed7586f4e1112d36545bc24e9

SHA1
40891a1d512d4d2517868ad1807a080fc5545c4d

SHA256
994399c34d008513591c31e63e3980a70edd3aaf5635b5268a9c6362396297c2

SHA512
c3892273d52b6d578281d5690071d447cd1ca54b8a4d0d6a7ed8c27eb106549261ebc10b5788360c89a1d5b5734267ada83d3277a77826225e5c36333706db24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
137092f2eca0ca9af1f6207852661fb6

SHA1
bb9095d9919ef76a0335b84cafab0042a831c161

SHA256
8a993e7cdc9add68f5bb27316c1fe66bd2c30dd64bee28ad5775ac66d623fa36

SHA512
a072dc8ff57d1d1d21a82f217cf23194e71c13b52dde2c185f63f908d84cd3e625af2bdacdb7f8c58fd42a4acb67acb1f1ad2a6d276b607adc5a0a9f6c5cd6c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68590005a0d27c0b80ee3147a718172d

SHA1
5b302f75b01d939f904e7c12a974adce4184aed7

SHA256
ab9a14efe55d129167e5541337f4e2ba636ee5a8da2ecc68422d82340efe0a2c

SHA512
a74e62d0543e6e6139d413f5e92bdb459aa95b1095e0138b077a50f25538cd8e9408a688d6e71cbb169ad1fad66bd4e6654dc337ef23750bf49699850d7d2eee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e631481762be5a0207b5f24096e2fcf

SHA1
09f0548b52e4a4c05d739d9589c6fcfd8887ea02

SHA256
ec7a8ac82444a2035423b9a955a4144cb97f71702c45bada6877d79baefecfc4

SHA512
affc8a13af84b2865e05b06e4ae3f0047ea57407c5780d924064d7265d1878bcfefdf00ca6cd61446b4d95c4ea33c2727f274ad243974a9b809317920be20933

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a581a24b89926599b8e85435e536e41

SHA1
9db497e333891f6d883b7a398cf14b6a1f56d0d7

SHA256
a01eb094dd8752fbe8200b479babb31e2533f7173862b0808b4cd4a636811099

SHA512
a94a461012d48f24b4e486e79415e42b2d0023935e9d5fa02e65dd8f722dcdad1b7f2563f9b701f5f6fc65de81825af1f628503df0d031e8244a556e10a88874

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB0BA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB179.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit