17240f0ee22c464867764676e4a1a3007788d42ff289e4bcdb82724e322082c0

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eac51b2cbcdb1671f03e17a240df8971_JaffaCakes118.html
Size

132KB
MD5

eac51b2cbcdb1671f03e17a240df8971
SHA1

acb9558c7fad0ac39fc099e15a59cdeb652b8091
SHA256

17240f0ee22c464867764676e4a1a3007788d42ff289e4bcdb82724e322082c0
SHA512

0cc8174fe39449d4eca3bf7c9b8e2a9a50eb20221c3d2662fae4f1010655bf92b97a85b75fb3c04b3c06359549fe4b61af3c0f9890733dffaeec6e4a947acc4e
SSDEEP

1536:S92m5GuumZgLQnWvMNP49yGNQvT+XMqWROJzh8MEyLi+rffMxqNisaQx4V5roEIj:SBJyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432889612"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{65B58C41-7651-11EF-9527-EAF82BEC9AF0} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2648	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2648	iexplore.exe
2648	iexplore.exe
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2936	2648	iexplore.exe	30
PID 2648 wrote to memory of 2936	2648	iexplore.exe	30
PID 2648 wrote to memory of 2936	2648	iexplore.exe	30
PID 2648 wrote to memory of 2936	2648	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eac51b2cbcdb1671f03e17a240df8971_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2648 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c2b5064aa3485f5ecafd652d1f89c3e

SHA1
1286d81d28263114a3946b443dd7f51c7da6a3e1

SHA256
6706c6dff068c4a3e62f4935dc2a3930fbc38bfc0363977e428ff0330baea67c

SHA512
bdca031e437039d5a11db4832948a0b8320bfb15c8ee75760b50b25e6c552c684b6146721ff0f9bc1e320019e5368aa876453088b78a084c926ce3abece930e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15df7ef28b68c98ee0db4242e8c18198

SHA1
e501332d95ff7702e37ede91fe6d3ac57785ead4

SHA256
69218914bf73056af7b7bf0f60d640cb0aadde1baba2cb015d6ab59aa9785b7d

SHA512
cea010a748d88e945b6d7ca9b113716ccd656ead7c16d6fa25951b37608f57034ecd24406bf6a3a02cdc7a24bb917d6d1f809a7e9f0c5654b1925c966afc86b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0760d8215b7eb29643505d4e10912ddc

SHA1
0012f40278799c21b54bf48b9871fe53770e5f7c

SHA256
86ac15dc17948b79fe410ec5fb49dfd74d5ae34647a11b79ccb48c2005b9e6b6

SHA512
d173ca94dd19a74adc5af46805952aaa91b7fcbcc3a8fdf5e320741f2b8ba0da9a3425a5f9f104173e7099bfac04c6703af80d5d31c1b4b71cb92e5eb1c4beda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78ab4b8758e496f09234d0aaef958e6b

SHA1
3b77288e4f816d2703bae7184d622a9c943dd200

SHA256
c6598c0dd89ecfe0ce0d97cbf4a267099f501d81d487a65963b58c6d48c16429

SHA512
6c7aab72f25a88397831fe6c821da468cff8fd4fc23e436b9f582a6c6ee757f8d42ffec3f895abf77b28b58fbfee37a904b271e8914b94c06863675fcbd19a8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36073a137bd3f94d8436f5b12ac77825

SHA1
5d295d67c6e1a5cfb57c97efe342238c8f61cae8

SHA256
9513c66a48a7be7c5799612914a899755f69b29b718d2d1961c220d3ba925b5c

SHA512
4aea5f17770b3350e0f2f1c3f15fabd67038f294523d09e6fb7ded26686a5e3110267ce2d2b238f415f5b5fb832ad7d32c68323a0e59146b3ebb62c91bf6e570

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2e0cafc03cc663c26579dd00c74da66

SHA1
c7ab0c48788909fc35d244518249b4224f0ea1ea

SHA256
db0c378645f6365bcf0c5a12a3125d85ebec47357e1499407613477a7c6060e0

SHA512
58f66307865ae71c361ce8397410e44823cdb9e17a6436c22d643fe3e746c462cfbc47fd9a568f62f3d7c8e6bb0bc4d29dd0eb684629bf025976fd8110aca4b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0eb7b096e9b6d623ceddae8f74b54e2

SHA1
437769e9ae43e5dd17f56f30ebe5f6a8bb9663da

SHA256
0eb53329f6eabe7a9cea2907f7e6337fba3f4c7f373fcd2605c921a594d62711

SHA512
800ff9f15dd78e4919a36fc396ea3c271dd5a50cbf4067abe71b2f55c2571dad1a3b5cce9a7cd401d0d809ba694405017c70ec0a2ada543cfe5ae12fcb88f46d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80d718a594ae4971e947a0874ff728bf

SHA1
5bebdf006debaa1cc2f2ab7904b0b604086bf02b

SHA256
53bcac5a0a9ed5c9f1b3858693ede6dbe7e2e87dd5d633b2bfc9ae80170a0ae8

SHA512
b415a5d7e7528194bbd34ddf8035aac0c0ce84a5c20c30db1ff45f2e81806c7721ac0408b9830a993783c3c9383a670a6a53498c04d116a232b0ec5db79b0cf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF7B7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF829.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit