be866394e4e6bc898c706f41b554c02353f1872d776519228ed8a7e5e99e60ba

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/09/2024, 21:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ee79ebf5948ce4f9eaeafd603c70b9e0_JaffaCakes118.html
Size

60KB
MD5

ee79ebf5948ce4f9eaeafd603c70b9e0
SHA1

db529d90d6d22e0c74a94d6c5f25560b845993aa
SHA256

be866394e4e6bc898c706f41b554c02353f1872d776519228ed8a7e5e99e60ba
SHA512

077e0bdc8f2f0ee4636f5d8b231c17a8e3ade26d3331058d1d9092c9f667a245360b71f5a766b54bf565f7fa801ed516a059f526a8179b876a636587b84eb449
SSDEEP

768:4M6e6Bsihur51v1+d8fOFJCozezgYJCWzezgYJC1zezgYJCbzezgYJC3zezgYJCk:izhgDjC5wsNuG

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433030388"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2A1E5011-7799-11EF-AF16-EA7747D117E6} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2708	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2708	iexplore.exe
2708	iexplore.exe
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 2668	2708	iexplore.exe	30
PID 2708 wrote to memory of 2668	2708	iexplore.exe	30
PID 2708 wrote to memory of 2668	2708	iexplore.exe	30
PID 2708 wrote to memory of 2668	2708	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ee79ebf5948ce4f9eaeafd603c70b9e0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2708 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41fbe16f34560bed85a2b4a8260c1fea

SHA1
b5b2e9670a33accbc0a826fb681d88bc21a5eb76

SHA256
c14e59cae8301675facc959eadeb3e2daa8dcc8bf42ebae03ab3f01c2f36a418

SHA512
c1ff927a91237b17c084645adf1547893619870919aaf5342f25298d9b43b60daaf7e880de99f199b4d2d536e53359279ed27008739fb9c3aaa8efb956bd6991

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e263213c2e883a1f9b23c4f49365fe5e

SHA1
a307c124a53ce217398728022d2b0fa16c60412d

SHA256
07d2036f7175800def8185008e705c25bbe67b8c154faaa9a35c934d33b2947a

SHA512
34ff88809672ae034d5d085b7ac93cf2047f4dfb4588407531606084312db6ac3762beecfcefff7445e4f1cdd13dad9841b60333c2f1113d03f1be4bce74f651

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
580ce29f28fedc1815c3f36a57a5bb64

SHA1
111c6d4801b995bb80383ca5ded60c1f3c5397a7

SHA256
23501b2eb57784ee7d425b9c63783108ffbfaa61a8213806c001fdac78767ab6

SHA512
49ace86ef667d9c1ae09fb6a3a57da8d9c362136a119c1b38ca22f45723a2046e2e5a0f7dd897a29815b34a0f5c45495cb340f3e1809ec68da72dd49d3728b8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4464e8211fa711b7349add572a28a27c

SHA1
77c8e8f498048644af025e0257ab44bd61781034

SHA256
b7047d96b25531c08fa45cf5ef88127e8ace0953fe62a3f8545e43c54ae52f92

SHA512
f3e6f5433a17e17798fd336ec04091a0c2ebf6b5f723360232b9c3e0c7b0fdca3efb2fb258835c7999a1cdec7c87b941b7d0c16bdfa45c91a514aa0608308270

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24f29f54ea6a62aa3a3a3d9fd7c7fbd5

SHA1
96e13da510bda834e636d6793bdd6ec9d4ff414e

SHA256
f7573f7585719d2e3bc318cf068211b506a08c41907999020835d212874780d2

SHA512
745a93d8d149d2c1a90155d2de8ac866f2f8be5f2ffdc7d9d26160bd8bc8eb04fe92125a878a16417da28b3d06f6b8ae3239b20d40340d47eccafe7a39e0f584

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61a22a6a2e4accc24997540988a23c27

SHA1
a591fe7e0e5518a5c09a14afb10e84e6ab8859c5

SHA256
0ead4d83f6cd4b585af93328d96878246e8e987927cb245e754249d306142d3a

SHA512
897ef5a8a0a15b5f0fdedc71ecbf142165de5e7b5340ac13cf98dbd1e25448f2908fcf5c29ecb92c00ae28d840f03d0f446303b167dcf5e9b8623e3fadf61e66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8343fad1867e00341711dde893f11a4

SHA1
33350679c24fe990b7ee2c24b8601cb3ad39a103

SHA256
21556771d6e7377e9d074dee6bd4b16e25212c3dab50a1809e2273299827a4be

SHA512
e4b96600feff32d13d8d63dbbde22d3d258c4d313f2f91cf88c46816119d2b6f6131a8a91b9db78130a81d7340461c884c7f37530f0ecce5f05f6e49a2a29987

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de3f5dfe61443e0e0b31fe27f1ffff81

SHA1
75f756850d1315bb35617e0036b51114c3f0d5f4

SHA256
84d241dfc91ccb53bdcc0713e905f4b1407f05405396cd378b775581bb715108

SHA512
7fade8a97cf53315babbf22233900c950e5aa2bd1729c6a9e46c325c21afcf9f29e61ba7cc4d68a71d5ac2772870148cb3fca06425a9452b2dc775a35923b54e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fde15af2add214adb49988d7fe6ac8fe

SHA1
1ac570fac53e856b3b676c7e5f31340c266d966d

SHA256
4cb138cce326677a3dcdacdbb71a85a728e8756a0742b3b1c8d33e41b5b7580d

SHA512
793dd579c1d77351bd2004f6376901b78cf2decb181e44e837676afcda7bc4ad9e65a7b6d6ed7afce9a7c5d045525b031fefe2816d3e53429dee0f143ae0be77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5623470a9a5a375fed31b53ef87d4f89

SHA1
b8f08c7adc0b7c46e021fac9d2fbcb1c0bce993d

SHA256
4d039bd62d0624a6e7475e76111e82e109c0430027f14c059ea86eff4b94fe3f

SHA512
1d911777a3c41316cf1d8212362b437824fd44005f9c9048fa4f3fc7f62deeec0b19376e5140b3c8d884391e0069f3d17eb6ee8137350482f38fc9a77c4b5b75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c102bfd67c9eb87fe9942a41712bc950

SHA1
d35da9a165e518c5c3d210b4bf93dc7a45c389a4

SHA256
948192e16fcdd24ea91c2ca24aab58209c2b639844989403de061a0cddea1daf

SHA512
e671b7b3dd2e05568745a5572665f6aa53bf19b425093e2e7181a184f25e26dd3692cc0e5a1c65de9d5d83b868f42487fac8c7d49fb8eda5e5f9e072030e31cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16f08b894e325873dbc429a91cb4636e

SHA1
de34bf6d656c735fc885b0c04b3d0d710f311dec

SHA256
5d39aecbc90a3e80b0c7675825a326adda7eec12bdf40fa91f2cc9520e88b941

SHA512
10b0b4a1e52fd665524e2309bc0756cf54349af00c80a2029e6b39420264d83e4aded8179e32ad976533898249cd9d9488dcd1804cba80565c532936ce4e4060

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDE6F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDF9B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit