68c158a73bb3b79b175a719b12d1bf6ed01a7413b6d556d007bfab78a95c02c0

Analysis

max time kernel
132s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 18:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f0705e302fda6c03a07f1b1b6b943825_JaffaCakes118.html
Size

29KB
MD5

f0705e302fda6c03a07f1b1b6b943825
SHA1

e61b90a55e0a6aca7a7d82a4a843f0c5f9fbbfc2
SHA256

68c158a73bb3b79b175a719b12d1bf6ed01a7413b6d556d007bfab78a95c02c0
SHA512

d76e0ea04c1b29d373a3cb06442a9717b818e1d9e32c26a1edcb06de187b82bc5c6084cb58dcac22bbc3b3a21efb8ea3039069dbaa41571416c89e1fe5b462ae
SSDEEP

768:D26dmzagoZizosmRHvOdB3R8utZ02Rb4CeQFZhv7G8:KmRHvOd1b04b4CeQFZhv7G8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433106614"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A592E011-784A-11EF-856C-4E0B11BE40FD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2988	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2988	iexplore.exe
2988	iexplore.exe
2088	IEXPLORE.EXE
2088	IEXPLORE.EXE
2088	IEXPLORE.EXE
2088	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2088	2988	iexplore.exe	30
PID 2988 wrote to memory of 2088	2988	iexplore.exe	30
PID 2988 wrote to memory of 2088	2988	iexplore.exe	30
PID 2988 wrote to memory of 2088	2988	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f0705e302fda6c03a07f1b1b6b943825_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2988 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dadc48345a28b993277100006b988583

SHA1
8da5073ed8463391a5f57c52fb09174b4ceb3c27

SHA256
7c5584423f1240b0b0dcb0562f7208d485e28fe96e71e1236437b98922cfa8e2

SHA512
e30b2e2f916b710a3efe80855affaff4373d61f45fe62082df586c385332e6a848ac364b9255a0beae5401a93b5dabd1954ef024936cc0f0b193c42dcdf5dd8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
124f621288c7f6fb3f93e80084c83332

SHA1
49fc0f28858734b298d62a65931c51a8616ba0d3

SHA256
d4ea9e07bd82b06fcefb454b1070e6802bc91fb4067d59646d965a04b2f3303f

SHA512
e918b5deb48481e0ecf921c679c980f9ea5883ab5a207f443cbd6b5bfe81a599660776f5485e7126955e4768ee8d7dcec338b359554acce63c571454beaad7cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40ebc6c5dc816b0c8afa900ab8c65715

SHA1
090b4d9bec5bd46237d61ab97d3225b0192839ee

SHA256
4061ae078ab777c085780d4bfca1112526e10ba016f766d620cad2f0bec83865

SHA512
c155f0c0341ae81766d33f671477a2c00f9b19e916a49a3bcf728daefba6602ab8d9ee55e2591321f33a537ff062c94aca40dd35475260760f036f8b00d2bbec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42010fb6d94c1fff3b5662fd316ea0cb

SHA1
f0985fb43a51e3ef0e7eb58ee2b19ee64c5b7f0e

SHA256
0a037cebf2a34720d448d4440181de64b46554e134d681028e06904dc9a7affd

SHA512
19cd2105c51ea9788e8bfb94492c567bb05f52baf7c9101e00f2ee8b3da4747048b1224b1d5cac9bcc9567faf4ed75ce4e4f79d8f09203e76ec52acaf33f5412

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24e77f5457910319c5c1e68c91a32d98

SHA1
2caf920ab4aef4df66a7413063be16b23a8159f1

SHA256
9cee08fdf84a45b2835c3daf1958cb957b848c4452434e92d70688cc00722f35

SHA512
781db762e29c332a15d089a46eb89c4e3b6998aff2e75373b85c5195dd901fd4cf034240f27b56a8183be0694da86963c75820ee884e304e43860b24c984d808

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
959ddc3786382787c44b6fd45c1b92ad

SHA1
41e166555f7a6397e3a053dd02c8380ec3c02b43

SHA256
e227c3597543ae0fb52f8c2a15a2da537afccb224f9defc15f1a452969c9d9d7

SHA512
beed3667180d145fc0d688fa4540372e737ab4c5e0acb93fd685cb79af127f456b451c7ea4da051eb336072b109dedda969e6686ac2819281b992aed9952acdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b94fe24b697cdccc1bcf2467789d4227

SHA1
5aab6da15d38f05257da6ff0eb29c3d2b8063742

SHA256
8ce81928e33a79ea85b9f7fa3ac56207efe1e4280bf686a1238ad5eea89d570f

SHA512
687b2bbe6a5627c7a3086c7871a69e37e02ac45d496bc3a0d83e528b8482ec22c2cf09d6db87f870e07294f5d2918e727dbe3eadf30cd8ccd2d31b543735defe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5b118f8d96cd1a6f7af10ac8a058e2d

SHA1
daf7068b222fddd1f0d9e8f7a9db3c763237587b

SHA256
77a73924bc96038ed6c038c078ca682448c8452ac6a73c919321426b3e71e045

SHA512
c0f5a62b294462ad81aaa0392ef8854ccb8e2369d1f61bc27bb9bf444af54903ce548b8525f750164e924fe7de7c83e1ec144459d2a8b281933622f47daf6f4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f3214bf274b283cbece9eaf5d7dd457

SHA1
a6d4431667cb6b025ff4e86151ee77787be352ef

SHA256
10612f8ba45ebcc35a5bfe172a16f072d0592f2085076780e9fedc6c37d63b98

SHA512
ce97c6fbe6b7850992a817c23e7ed457058887d231de593d336e05a55e494b7be5684fc1f523f497b24df2424e99d5fdfbf31928d9696f17fd171c6688fce0e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC303.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC373.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit