9b13203a11ca6687fc9fcb946ce881a231127314a73fbb7c891a8f995509f5a0

Analysis

max time kernel
133s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eac4d9bf9daac5ff8fd49deea541c780_JaffaCakes118.html
Size

40KB
MD5

eac4d9bf9daac5ff8fd49deea541c780
SHA1

065cc23451138e993126c01814b8700f59553bbb
SHA256

9b13203a11ca6687fc9fcb946ce881a231127314a73fbb7c891a8f995509f5a0
SHA512

a500d31ee11c93839dc0bc32cbb48b1203d6628722f5cee5bf2f89168be7e9c4365833e4f05727db25b68852bd4951924cf88d94b6396b66074ed2df5ba7dc77
SSDEEP

768:1izppGh0OQHoY0EFV40MnA1in0h0OffeyOmdy4dS32SBmQPsTKwPXu5G0KTwPJOE:4zppG2MSmovHGdPKxM0h7kxAlyBOKr4s

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432889569"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4C1E08C1-7651-11EF-A0C3-D60C98DC526F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2500	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2500	iexplore.exe
2500	iexplore.exe
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2128	2500	iexplore.exe	30
PID 2500 wrote to memory of 2128	2500	iexplore.exe	30
PID 2500 wrote to memory of 2128	2500	iexplore.exe	30
PID 2500 wrote to memory of 2128	2500	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eac4d9bf9daac5ff8fd49deea541c780_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2500 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e35c73b31ecd81547900867d9990fff

SHA1
6b3a5e5b643200bbdafa27508817164f4e5d8400

SHA256
fdca0f79365146c17e95494fc0a6a6a34c114d7d663c73130e994533dd90d179

SHA512
7488dd22017c97219c51a66843bd4da99c185d995d3d0d60c5a78175997d1b9b3a1cf6bf9da0a13be1e3dae03222c7b4b24451aec1f5da0eb5e973bb2027bf8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c87d8179422f774f2de126c667f50499

SHA1
857ef3118368cc05e332166b8d266d46aa739905

SHA256
5f7098706e43b31b72ca14956411ec8cd41ea7d755472232476948a2da888fee

SHA512
a4b566040a23ec2e8a229575c08b97d7a05286fd4716d24aa3525784c9b0d43599f4852c271f7bd2953e774cef650af4a70d97abf942c0dc22a5c89005a3155e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f3a044dee323e81d0713b0e1cc74271

SHA1
699142ed3f590dd1f7e317e1b9c1c041a076e972

SHA256
9c8c53f09835e3d30e409c8e3c52d98a59d15d00d8529cb8bb0349ab7921cfa8

SHA512
cfd50262af67a18695a3d1e859ed072e4365a05cd686e8990b67f759f300eb7799d7e8753e3e9bacf0c433df09b0b6650b4f059906504284abdc99c2c84834d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04b1b9f44d7396271e87fc3bc10c5ce4

SHA1
e6cb72f0a55e8fd7f3a4096ec7655a195466b777

SHA256
869e3bbffbb0a2d35ee8aaf7f999fb2cfb8f5644680d1ef9f280eb4ccf75b0f2

SHA512
aa29aee535cdb5b7a3f3c2017ad89e43ebbb326ac536e0ac4b6ea44d0227d67d81facecdebc1b00afe278f69eb30bef3c8090cba5de424376cdba52fa2e058d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9cd8b075af23bff28526fac842f9b6c6

SHA1
3c48e2e6eb6da803fc86cc0e6f53c473e8720865

SHA256
762f15d668996c7e6093798c8e3f5468e7405eb6f1042f38d965f715546a4193

SHA512
2fffcae08183f68400bee2a6e4b60b8d3d5ca827761d6c703bc560058058e321b501cdeb750f205bab530fd0464c44de5358cdc9b2446aebba86553474f90759

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4daee23d2083aa167de6ea21f66056bf

SHA1
5305c502728798768b1432fef0aff097dace96f1

SHA256
00f30e20bede169485e45569e1e7b032c174a733ae20ff222d69a5cba29bad97

SHA512
2d23efd6d398fc33cc8422d6c2d08aaa8d71b9d12945cce317a91c22718072dfb0a80d9950180642128fece0f23e65fc393b102ea6274e061a7ffeaf973c58bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb88a15b51a07c62b3e6b4ba0c306a5a

SHA1
64809978e38b22f907821014b2448a23674aa553

SHA256
d63bbf7032cfdb6385ac7a01f051d63849c76f1f85c5cb98b3b8ce9806a088e6

SHA512
d537aee34f1a24b8ffba76499207ed518d0ec42d75f68068f143c00201e7888cd612ddc5cb017c42d15e556e99c42fed668a262b0c33c3a81a33b10b48c102c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
251ddc3f963d2c30753ed0eeaf6aec5f

SHA1
d553e1e3f06b7fe4eafcacb0d9012cbec0ffcd4c

SHA256
b44bbde7afb5f8fa6e11df4dabca2813d5bf9d58bad5e7ec91a7da6808e12917

SHA512
b504e3cecc80a04d0dae121f23107dda2db0ad0ccda838920efd63afee416b2de664724aac11feb0ccf8d831e699754f03846099cdf5d66e19a284ff32fb26f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
974d72cb2c7366f1c4983c5169e9298f

SHA1
dc461c9cf08840c4bac541bb6b150ed4db441980

SHA256
650cda32968e2034eeb67b78277f5c9f5ec3cc21fc88153bf750dcdb24eaf502

SHA512
a3d70e46559d182ac3deab72c2b2775535ba6aa6c4da25284b34cb82aaeb96295abde9a56eadc887402711c650e7b03375cc4fd32bd9a725a3cf3594a5213ce5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB4CF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB56F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit