c020a48ae90fcaeed3c7a07b562fbcb14cb10fb2fd72561aeceb7e96b2f5393c

Analysis

max time kernel
134s
max time network
144s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 13:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb6aa0d6c57fd543fe8edc6b3767f1dc_JaffaCakes118.html
Size

141KB
MD5

eb6aa0d6c57fd543fe8edc6b3767f1dc
SHA1

8244325101f8087c3351fd58a31d73592fc8746c
SHA256

c020a48ae90fcaeed3c7a07b562fbcb14cb10fb2fd72561aeceb7e96b2f5393c
SHA512

862fcd201afb48f8f79cede10bc47d1319e4e4a92fd83c6de67b8b95169819c6b9e604902a7b6ba5cd4d54418cf49065f2b9ae387e7a0353d1090e6b18ff22ea
SSDEEP

3072:SPt9kZNA8x7dyfkMY+BES09JXAnyrZalI+YQ:SPvkZNA8x7osMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0CBBA051-768A-11EF-BB31-7694D31B45CA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432913943"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2512	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2512	iexplore.exe
2512	iexplore.exe
304	IEXPLORE.EXE
304	IEXPLORE.EXE
304	IEXPLORE.EXE
304	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 304	2512	iexplore.exe	31
PID 2512 wrote to memory of 304	2512	iexplore.exe	31
PID 2512 wrote to memory of 304	2512	iexplore.exe	31
PID 2512 wrote to memory of 304	2512	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eb6aa0d6c57fd543fe8edc6b3767f1dc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2512 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
529d1c450618f3e9715c9e27b5812a16

SHA1
87bcd93050c6838474631077ace547af9560ff9d

SHA256
f94c360d1a194eb84358e99dfb673fa008b0920207475140b3bac5faf6e8850e

SHA512
c11bcc9d4056483b8c1294404a04ee0329591fd0618b9667500d69fc5816901a47909b2eb56dd567b39fd9de2cf8bdefc741a9acd2fa89a05ce6098edf90d785

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
503d6066bbc90f7d4d8ba4094fbd5c5a

SHA1
e2db3e5d01cc4c2b143688c2d95eff3c3151736b

SHA256
9991030d73aa67df50076ede2355c98504aa2fe1db5bc86ed1857df85d1fad1d

SHA512
f4d934c2b7d54dc33dbae38e35a304e216f9aa8670485d595f09c222dd92eb0105f6e4dc019104c84c7dab46afc140b93f44c35b52c7e5f88f81ea70ed6235f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef5ffd30c954bd2091e7fdb8c529c13f

SHA1
50dc798cb0a45e2bc3a7b645a9298513543d1d5e

SHA256
6c4e459109b0b56c6823d417074b603c91546d99fa6da50d3bf1854a1e90f21c

SHA512
e745a7074542f03b967200cc4c7b8ce6b9c4d37b8c584ff47fc4445d9234551f08dc18dd3333b8722cb5fd3b5cc5b93951e81e638f92d1bdc5350ea7e36e8264

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e14e26808fd8a59dc0528436e14f3fa

SHA1
e5fdfa42f15daf218121df4290a0d1fe1725f7f3

SHA256
ceae81fd213b47ebdfe2753da9ba86c3e9bd3310e28d9881fe9d9ee487378b9d

SHA512
187ec4c6ee4b1921351d07d152b3a93bb67a6d558f2b417f4d3ab250d5cf954a8a1965d8c7f585d495d4d217690277e45f14aed219a64f161d5ffc9c9659f8ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eeba3f14e13593849c5d4dcef4e633fb

SHA1
256f77bbd0b766730be9c008663e7545406deb76

SHA256
f63ed825b8aeae7e8b17bd38d1933d5952e976e685fb537cd22dc88c40f51761

SHA512
34888dc700fe956738d480102f7cfa6d86abd57ac877b52e40b26f4c66bf6891b34dfcb46a0d62b260b3daba2c3c4b41fdf717c02937e885f9eb76d3282ee60c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19c7b764193f4aa2d75247639051e410

SHA1
07c86fd1e6b2814e8a17f2577c98be778e36cdec

SHA256
6d2679a3f9d7c584d22db57c981774af75c64de7fd27369ce8924797a03057f8

SHA512
4e929f5e9823afa3024ce434de649cd184df659ace5fbd917f4df4e8179343d0fe01037acdcc64fc516e519721990adb0d19100be764519e6cb47eba4b05d3c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e1e5c95ac97a645f2c1436bd8f3d00f

SHA1
6f91fbeb59b4904ced2a97dd0068de30704e398b

SHA256
fccfe1c31acd6116073c1abd4ace5cdb12712abda58de59d343afc7e6b9a29e5

SHA512
9efdd58672946be10903b145f639a9576a83785587d6c8f3b67a2c9ec2ddf1a08d19db1a9025cb43803b1545ca6af24dac8e916b9e984ef2fb009a8178ed8fa9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93105a3fd0d6420bdda906f13548cbc8

SHA1
12b78aa868f94b6dd4a618fd587ffa0a374edc46

SHA256
158d5b56dc491157e47f86ad7f05e67d0876391974b0fc9b57c95b021872c96b

SHA512
30e283555d615306402cb33a5fc7c9a4463e91122584befe6966c4ab60c19d66ea967301639ca621f838b0d412d4ab59284cc03469004b08eff831d032aa5474

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7224c244f307293b16eac5f0b0f8949f

SHA1
c1d81d1124c8de3cad6862e66a3ef572e98cf8b1

SHA256
b3400816b65f0afe8df9e3a176e3a3a7e5ca277add99877ee3bd6bcd08540451

SHA512
2fdc77dba82849abd520afd616e6182dd85bd34f267bc785ef3c64a172df59839a476902320accabdef4d2422e787bce2026ab6aeea56c2509b5906f7ade1ea7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD5F7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD667.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit