793059efa90aae626550aa9e3d4f7b60d32cd6ec5bb47f544364a9e6da9acb37

Analysis

max time kernel
140s
max time network
142s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 07:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ead183bc1debb5ac238e83a3282d571e_JaffaCakes118.html
Size

25KB
MD5

ead183bc1debb5ac238e83a3282d571e
SHA1

e853d68119b40ed8493599450c195979852c6854
SHA256

793059efa90aae626550aa9e3d4f7b60d32cd6ec5bb47f544364a9e6da9acb37
SHA512

7d40fd1f1165866deccf84f5e88b50b12dfdade8ef44c3eaf04696cfbdca58aa8d921322e5413f4368854c9fd957b5eb860597a0ab628bf6bbf4b877b09dbfa8
SSDEEP

768:SAlRfYp+VWjXedWg69N81vhMSxA8tYeqEazwgRpjVB5A:SAlR/xA8meqEgwgRpxB+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432891558"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EDA24861-7655-11EF-B961-D22B03723C32} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2320	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2320	iexplore.exe
2320	iexplore.exe
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2516	2320	iexplore.exe	31
PID 2320 wrote to memory of 2516	2320	iexplore.exe	31
PID 2320 wrote to memory of 2516	2320	iexplore.exe	31
PID 2320 wrote to memory of 2516	2320	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ead183bc1debb5ac238e83a3282d571e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2320 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a34647ddceb766c0c5b0436666d9716d

SHA1
37f46e677b8a17ac16dde066911c8ab49ecba71e

SHA256
0ac755c3e5f62a988c44d27cd749bdeebdd4b349658ef3cce78e01297aa3048a

SHA512
c51389e133e61eb9c008fd9cd0b39b4f4f64d04a4424215f1271eba47b38b5625dec842ff238f5e2cc26c47a2946f7038618838976e7d8faeb8c626b6136f2ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9721cc102be47c604c79e8a2469bce81

SHA1
c1a860ab96b15f856784b41e96e7463ace391068

SHA256
0efeac631f061042f379f4baaecb86f892e35c09b8d760be01cd749c1a01cd5e

SHA512
6ea1e52027f21741e8fc6d072a201a5ce1f83fdd73ecc799ed02bbb7d92db0c4be26f9b8cf25848e6ee717f6125a6ff1b41ef5e0f15a410a2528e3e7376ff311

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eba4c737f3aced3eb3a0efbd14793d10

SHA1
a59ba1264be0b7e12d3cb50a8e2c4ea52aa64366

SHA256
9657a813f8e0abf550d34ffb03005842a1c28dc2a2c29a5901d29e71181b4a36

SHA512
37162b439244fedbd1b215c371116046be6e3ee7a5bb4a5d25b0ed4d4c88d2732cc05667d737050602c706901e82dd88687abb2049dae2b2c628e99c5b40b366

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b35d5377a9952c4a6194128c5420a0c

SHA1
86bdfa6ea8e850379c5f79a86da5dc2a2edcf7e8

SHA256
45e3efc0803efee41fcd8a3f474e3edd1285704b60624870eab495f9fa581dcb

SHA512
67e894b9cf8bf23d7b8c33e54e0c9f2dbb028727003f9f90189fcb1f6b3c78dee331eef0be1e56306a104acca2dd8a29ab6ee7bcb60ca7a5edf002feabb039ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b422a144a0905f03894e4601074ae8d

SHA1
7678b54bde695369d64f2905f1d341164991847e

SHA256
e5463886ebf2bf184584ef26f87635e77e8d416cea456c3aca765bd98d10c16a

SHA512
bea3a920438cc7246d46eb44d4d5428d6ae03f619050b5b472228a87ad75a98c72153a8ac1a2d2f7ddd212a95647da828651bbc5edb3e66c0aad75b3dfeb82fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe9da3223aece5c1c9e6e3c2d8e3b219

SHA1
721b3e6af63699d4d0e39a9e7f39212f66982357

SHA256
4ba996eb12942556eafdbbff8053ae61ddbf5f1eca87f57788eb0ce00072f661

SHA512
ea6787bdf0714b95d023eba691d193b8c7e2fb48a35df0edeb0b552115d7f1b7f4b33e4ec9bbecbfc8f55c309692d4c079542f72ad2c3e7542a167e142487cee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a9fa35c638b3d2e4526a42f8ee2dceb

SHA1
735e1a6f37d98634ab724f36e17d02f21eecbba9

SHA256
c6027838607dc14ad264766b932c2d11d82f03420d5e979aac4263dece762b17

SHA512
ebd9f649933168b78b04bff8b31f62bf331486a4628254063f7e5ef932164348c2ccc8a1f8b5f022877fe9ec8e725ac7c13105c56957e299d395d8e0877d93ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c95ecb4e92bcf1930c535be1cd22ef53

SHA1
f703215f89bf328607ba82cbe3e595dcb81bd443

SHA256
eaf833657b4453dd0dd57163b61bca001b4e1bfd073130241e835e0b2093a64f

SHA512
7bae2cd49803c55ece2e4af053f24a8bda6864b3e7ea1ca7f383b23345540d6e8d11b55fd0e74f63a5603b0c1b51f2cb9bcd6a1a5496921baab909fca52cc8b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f0adc094b8a1d1844c582cb3d3b04e4

SHA1
9235d73cfc31227266b407620255b681dc35922a

SHA256
5a9dde379b32906dc44798be4fdb12cd2116d76b3640e5702976d33fc363c7d1

SHA512
11244accf381e893ef7404b248e8345d16c02dab3fe077dd9854d2be848dfe12d09ae609f4d8aa97984cdbf8edca993188879b32853e247874e3342ff00606d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de52037887f711e21c0dc32403890682

SHA1
1be355e6106f3376070e5951137eb2dc38bda651

SHA256
b0fe38267f08bc4a339e48ca5ceb51f8b106c23f0ea34b770666717ddac79252

SHA512
170247b577cdd1fb28201015f2b67492a6ea2e27e0e700d4b668d253ce84e2c1a61a38867193a367399705bc737d67d55753286e49f197dc9c966ed98a37bec5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD395.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD445.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit