181dbf402d810361b25c5f9d2a2ef468d4d290867bb6068dc0b581ac3ad4c99f

Analysis

max time kernel
132s
max time network
142s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eac67c52f661f893dd3bd9bf9031f68b_JaffaCakes118.html
Size

185KB
MD5

eac67c52f661f893dd3bd9bf9031f68b
SHA1

3088729d38a180d34de89b7b3b11c72e06665c7c
SHA256

181dbf402d810361b25c5f9d2a2ef468d4d290867bb6068dc0b581ac3ad4c99f
SHA512

6874c09729865d99ab802f9f2fae7e3097de8448163e4f7ce333871b64d6069adef57ee769fdd334dd63e50fff6af153b9e69b0ef91c23f027735af6693d74fc
SSDEEP

3072:SmIzBGHyfkMY+BES09JXAnyrZalI+Y5N86QwUdedbFilfO5YFiM:SmIYSsMYod+X3oI+Yn86/U9jFiM

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D104E451-7651-11EF-9CB4-D238DC34531D} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432889792"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2328	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2328	iexplore.exe
2328	iexplore.exe
1928	IEXPLORE.EXE
1928	IEXPLORE.EXE
1928	IEXPLORE.EXE
1928	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 1928	2328	iexplore.exe	31
PID 2328 wrote to memory of 1928	2328	iexplore.exe	31
PID 2328 wrote to memory of 1928	2328	iexplore.exe	31
PID 2328 wrote to memory of 1928	2328	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eac67c52f661f893dd3bd9bf9031f68b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2328 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7b0b9dd856ad0906ac5d27199393c6e

SHA1
8b01c3cd3ab8f355960aff960a15c6aad9cc2b60

SHA256
cad37dfc861e4d93320b7c4b268d9bfc7b0959b8590b64db9967d29444c29c7c

SHA512
d473e9b514e1ed76157512d69913e041dce55b177927bfad6e81ad6452135fd66aee0d2054888352ae8e12a8660cff345e2db7516d2440edff7ddd96160d3864

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3be37233e99d6aa267066eedfa5977d

SHA1
93a3a860c7f013dcde3587f6d2c91b27b94bbce8

SHA256
16c148b7567f0465dd275023bd3820527b71b2c37ab4788d15d01f0f78730cb7

SHA512
606adecb42be65b74e9f6f77ac23e5be46984258702aa7d08a9cc11e9b6746d73155eaf4ba8f0e4d0d50b10f3a01e04eea831e133d2ec4869c2e4339ef37d626

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8eb4824afb5e04119636c6e7455721a7

SHA1
f87343adf8011dcc3b3cc37432f16137a5d0273e

SHA256
ad366be0e0d163174506924f2094785e967012c9fc4be491be2766a59c6ea361

SHA512
99f184595625da8a26b492fe41fa286a6d0d801adc19b501aabae62ea107f52178db8791eae99b3ef53103c971d86c408adf795c7dd6dc4952e888885023a215

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0940a70c719da739abfe4cb2a8ce55de

SHA1
66de45c04fda35a494d5cd17fcbd1ecdbbba1fcb

SHA256
a43d09e23838426cd652221127537721920deb5ea9dad5c9a8dcd488a5efe9c9

SHA512
5fbc800ea3c8dbaee588bfac11f7d9a3a4629aa6827fa232c46cfb6a9975fa410784fd0f548b981aa0e8b4318ccf70b8eedada2fa6db4b75fc0f968d8e924c95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a136aa4231928f9686849af4575cc917

SHA1
87ac2cd0dff122257479b99532c81abd72d8f0aa

SHA256
7e5d3af3c3abb3fffbea6d534954ca363e8d2759f6db28782e1d8b211f1bb38d

SHA512
979b1931caac25c36c3ce61eaead7bd72bc0b5e487418da83f6b01056369ce108bfa653fc3d1823379fb3692740554403b8921076c416b865c67e41ef28ab04a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
939a7f66bd90347bb4d6798500b5d9f0

SHA1
0f8e30cd8e9d5d2c43d3f681044ce0a395984100

SHA256
0f9932841773896ef2922f40f6a6e578d9994e6ea82ea3c8bd07802680379560

SHA512
7c852b3e0fa6da001310324634881fbbaf38f0a5a7c361f8e5c91aa4c0886a1d4cd59910db28a6e23044bdd2116d58226a2b445f61526620351f3cbe3b31de76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb12e78bcedfab17322e2b1785a20f4a

SHA1
5da9c3a2e1db439127ea8bd9b7e6292614033390

SHA256
1e57aec7ddc9061367a4edda5eaa4256f29746f50c94c7e6b94e78ef10b4b007

SHA512
f7fdfbf1dd552b90d18b6e0ac61f9eb9478b324b281e912266da73c4b18ca6cd20ce0de81cdba6758a83406279fd1f5789a59c5b2f6744ba42811387aae57d2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1039198b4c54549b4c6e3004a7dda80b

SHA1
5eb16f594231a559c104e1d90e958029ef0d9717

SHA256
cf77a708fd30cf3ccf22a240af22c7a70082260de0dff62f609daba90f94e4af

SHA512
9d51037063eb093366ba83ae6d1181c31b10f0bc854fd4a4861e9d0c47d2544f333585b7df3c0f695cae7de32154acfb9c285e3420cf5ca8f38bd3cd61a7abc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12ffdcb6b13e9b33abfc2d0c273d5973

SHA1
df0c6c9d96227e0a46dfe2b4f0966a40e674dfaa

SHA256
11aa724c2695a11578200bd06df2eebb7bcbbb8fd1f6736940e1c42abd663765

SHA512
4862a984f0d41724774a964c84236438cce89097f657b324a803cc1792df177f8a83e009331990c01bb4e48b01df090b0b8241f1f79d54ea5e01346507ab0bcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF2B9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF369.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit