6d7cb874507b4b567ff68868e75e48c75fccbc2aea62ec08c628517c81eb880b

Analysis

max time kernel
148s
max time network
145s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25-09-2024 22:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6f05f563b2fe264db5a32bf2e3b12a9_JaffaCakes118.html
Size

19KB
MD5

f6f05f563b2fe264db5a32bf2e3b12a9
SHA1

bb231d7d2e753bf4cf472753cf30a4d65ddff217
SHA256

6d7cb874507b4b567ff68868e75e48c75fccbc2aea62ec08c628517c81eb880b
SHA512

e510d133ca1c13269fa27b5c0f11aa4beee4c3ed5056c68152e44d7bb11f19f24ce1e4f78ffadf72f1df8d2f6355727d7fb08dfc5f89693b63723547e2758a10
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIh4PzUnjBhRr82qDB8:SIMd0I5nO9HdsvRQxDB8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AE042551-7B89-11EF-9584-DA9ECB958399} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433463541"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2180	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2180	iexplore.exe
2180	iexplore.exe
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE
2752	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2752	2180	iexplore.exe	30
PID 2180 wrote to memory of 2752	2180	iexplore.exe	30
PID 2180 wrote to memory of 2752	2180	iexplore.exe	30
PID 2180 wrote to memory of 2752	2180	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f6f05f563b2fe264db5a32bf2e3b12a9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62a7608619cfd753babd648017a3276e

SHA1
386942ee3b30bb7d909c812315d71a95b746d1b3

SHA256
510e2f3370b633d95fafa85acf6e15b531229b860195e27ad23320cf363a02df

SHA512
27943d55ae59fc29326b6b9a1699a648ee4a7d8e61ceec6bb8700b0a22102959edea325c3c4cdd6430ee4e9272b02a70f1206703d1954011cf7b7114cbac113c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91cdc842d6dcfd5d65cb5f3ceae96560

SHA1
b655174e303ac66940d2179dcad1a88ba1c16f40

SHA256
703ae22411c63f5c520a3b7dbd8811e19e63395158236aa1f1acbec532e01acf

SHA512
d7f3e8e4c433de12d728c61da549d9c981a93b815b5327d65297151aa5a3909817fa12b990a6dbd71b205fedfb11904882bce34091d952444304e92eff970bbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f34a39371888c3ff19f3ff9cfb92d328

SHA1
6366fc97c84817b83727be28d25083c84a233f96

SHA256
886c5b3ee9c3c97c2e203d058f39d343a49686d6a97fb0745717e535f1f3fd8a

SHA512
021799d352ff15658ce8a3db22fedc2a0a8ebe38945693acc523c18eccf85276d265e700a4420aac6f262dbc68e7cbbdf1200b5f92a85fa5d4960075fca4bb34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be084ac7d1078d3fa3f13ae2c9cc1e9e

SHA1
0e8a7ead09f47983d5ec818557f6184c44c5a8d8

SHA256
97280a9c45dc481043d5e4d324c864a64e752c24a1d1b89226eca640c9f8217d

SHA512
ab79853b7452476b9c6bf37c7836af4506b53dc9b553010e66ca5d37008805bbbde46386a85fdc6fca551ef8189de8f3641ded55d23078b5c538ef0f39ff361c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c254bf8b1da16df8f2980c901ab7068b

SHA1
b51f1c34f8d65d854b8691b1991e3f68699062c0

SHA256
0ff0eea36400776a1f0e765b4819b3b5fdf714b5c16ee48a6d434c04966f487b

SHA512
5eb50d3f09bee445cdd57e73f419c4d5f567ab0f9bfb10a30e050c6f8b444a2e83dd65bd2c22e8a2b692dfbd677625809f102519617c7f1dd0c3e5c7e3ed324c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17d1eecfe9f60cbeb8c8b5fd789187e5

SHA1
255310dfcd3e696b041b5898812e208d959c3508

SHA256
fe1c84ae5e26e9a6c525e1ac7c267e54022ba29b1263d3634dca404804cd3918

SHA512
cf1fbd87a24ea278ad073610be417bb6c42750e9ae56537ba1e93d883be6878214377e4a16708e70c2c63d74584f1dd1970554c200a91af26c8012cf111c403d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ea41ba60d0a3584015cb96e222c5211

SHA1
93dbaa81c316f163add3a619a6ca68f600804bc8

SHA256
ae2087332917c4019595901ddfb77beca309ae645c96ae05447665808d1ac601

SHA512
a671e51a2cb661871d9ba22faa0d0b3bc1c3de512a7559ae89f2ed03bd81b4e4a8a48ed5f62e502a7d86aca71abab575ec9d59912de966dd52564a2867208468

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b87df074652cff225343a1abc9c9c632

SHA1
93bb10a9f3079432d115cef1c704fd0beff297ab

SHA256
aaeb5de39d06c16d281e5d8a59cc05bf52ecfc860877195e5438682de7c9c4b0

SHA512
c03e25e88bf563c9d783b65f20153a2082aa65c5d52662d287f85894919c5ad7eac14066880240a760b2a23bd4297964cf8a4a3f2d1b3365ea89306ea4d48043

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e49e0dde8348e3cc0995a7aad25abad3

SHA1
58666d13ddada65196354c94b5ad31bb57e5d651

SHA256
a23fe0e8069bc0a7728d21249683908d119b9d491a5d2b36a5cddc1b2d3607ab

SHA512
90f05759113d5640ece2a6b7395e2097c95800477a896c940cc224f448fc011d759b3b03ed3ed6cb51d8cee5ca3824220589089d1e9862a20af116270acf72a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab513C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar51DD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit