3375c238b2ca9366f9e83de905a6f281d02ec07010d30bad17ecae15ee7ff90d

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 13:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

efed3eaeb764c8bc8b2c8c3b1a3d24b8_JaffaCakes118.html
Size

47KB
MD5

efed3eaeb764c8bc8b2c8c3b1a3d24b8
SHA1

257164a1115f90136e29a884f8b5622ce1f473b2
SHA256

3375c238b2ca9366f9e83de905a6f281d02ec07010d30bad17ecae15ee7ff90d
SHA512

35eafc45b3d77b5cf74a7e82afe01bedf3b780efc23ddd5731998911db80b66a3bb4746aa21fa4e3775fbfb8f975199c752694bddc73e017fcf3c53ac91c8d52
SSDEEP

384:tJiGjT6HRDUWemi/cW5n/TEIfeUpDbLQjWg1P266H9YgIoLJfvUBEI4pD08N8w81:tJ5Gi/jgobLQjWgc66cEI4wq+8o9Z7X

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{35573911-7820-11EF-B0DA-FA59FB4FA467} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433088389"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2160	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2160	iexplore.exe
2160	iexplore.exe
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2784	2160	iexplore.exe	29
PID 2160 wrote to memory of 2784	2160	iexplore.exe	29
PID 2160 wrote to memory of 2784	2160	iexplore.exe	29
PID 2160 wrote to memory of 2784	2160	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\efed3eaeb764c8bc8b2c8c3b1a3d24b8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2160 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1e1447e8afaae507dd6df028111c587

SHA1
813a9d43114e161c59eb34ac5a7daafb930462e9

SHA256
7b75b2b0abfd971f5afed8574e251fa8e09d85a49149a12689f237a0096e436d

SHA512
cb82cf7261e5213aee50630706f4bea343e91c0846cc71d95d395db86f8515ef9c1e228eb00c3066bf198f7a54693471cf205fd7eb5fe5a6db8f46807ffb9b45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c17c27c217e88caaaebb1235bd44b5f

SHA1
0b6a33d5b43497b31e3837b43ff7d8a5c1b68456

SHA256
671da99674bd8984277bcdeffd0eb73b5d0eb0e69772d938b9d5dc8fabed0ebc

SHA512
370c9dc5ff750798e5e82fc8ca40ae05f5d8d819253ea70ed18b134cecfc7a8f858c66aeb0fc929901beaa8edc08a206f5493c231b748bf7f69b69f9719b0da3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c88a5e5dfdc42b002a9410bab5f7a364

SHA1
cd006ad4c9cdc3c11b03da1d7e3785da66955f2a

SHA256
03fd971807d8eaf150c661d4a7753ab8ddfe25ce24d7e33f3613d965c340cd93

SHA512
d737d43699bd5792be54eef220f59fa809206859396c6f3f197b2c7c2072ab939a735ed4f49d79ad2da279336029b12f19e56a8dd50012cae8abc3e8df6aaeb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55b510d314e4a9dd329a9ab651105876

SHA1
92bf6c39c28d42d36915c6f8718f8a4239767537

SHA256
c863ca92a15fa2a34d7de3c0e7b6ffadbc59a26f1b1db2575e3a4cc6d8379672

SHA512
70663af63777c92722bbc67eda3ff6f1614ff0bfb9c820594047d94f2dfe75eb82cb7f3f4427a2f6e3dbffee76f8d76a25fa25101e798c93dc50a7f254cccbad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
179f801fda5d655b4316d0bfe7c00212

SHA1
a942573289f05a36f50b9bdce0f233ed0798e97f

SHA256
ea5ba98db6ad7c309d018dc7e1aa890bc375f051e5380c1f64ffa90c1daae01f

SHA512
1854f165405d69fe36e52a26636d8d35121f4d6134e19c306aa2c0967aadd7394d2dba64f188bae3ac55f72c178325e63ebdb0a0b8730633a421edde05471d6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
281ea77254e79f361021add044ee0c73

SHA1
f77cfa1af8c7f08df1dd86d0fda0791ed36a3748

SHA256
5f9a6654a824bc9f669714436eafb1cd822546af2722b6765513b1277b1e52ec

SHA512
7707829546fccbecf62a1ed904cf1cb522592ddf03f99b69c626f15a23415442b23a102c660366bc2fa9df999371d2cc76c51cf118981902086593572a7b7a53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c332951eab5054535747854b59363b0

SHA1
44f4acd9e6b0ceb79d0d826869d8416a4d1dc671

SHA256
458d1bd773485dab2133093b1f836e230fac08d8697d70af6aae42ec09326031

SHA512
5fd73c51d3d7f19997efa7c5cdb8e5bdcfae0319b748f94510f17c95235adbb6cccdc6d465b0ec3d03c30334b14ab61c29e8554e1f40faa6b74ca1a87f114a5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3f18b48c849e5d36a66cbb8402d3f18

SHA1
e9552cd5715c882d4c7fade9c5ea0cadcabf2ec1

SHA256
c2eade0e1eaeefac5eff0ae2e844eac4b7a201654ba7fa68fc261bdfc5337189

SHA512
6c6bd8b59d7b3b102c1609ef9057cba79f147fb5b88035839b03840e0622c3df30b6f618b6dec84994f8235e4eafa5e56df1158dcedadacd8fd3802528838147

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6a7035798f4e52601e90cb5754bea32

SHA1
6c2732a707592cf18d70d6c6455d66846c629db7

SHA256
aae6cea94a4c699d0df0a613dd30a65f819f0eeaf521617dcc50aacd12804396

SHA512
72c5867464971c8de74e2f7b103fa925853b60663943eb69487a3319967bbf3574b787943a402519e5b165f9fee53ea5de02f702d12e041ee209bfbc877a6aca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89eed992ad735c3f634e5129f8c6d5ba

SHA1
7367ff392166499eabac79b5591bae50acc0dbdb

SHA256
cc1faea87ad678107d558c45e45d6571d0bf4d028f6c634e935af2e209bdf9ec

SHA512
71e1254d45bbcc12527e2164fabb087020a631a62268cf19e4d1f2a6f1403493ae9de97e2241ca47e127a4b64ff310c665fda0dc09bacea1b78a04edb018a9f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6DE0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6DE1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit