0367c08a69bd017282b1822999f2273641f05a7cfbe1c1cfe3c63fe62a9262fa

Analysis

max time kernel
131s
max time network
140s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-09-2024 02:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f4f136c11fdb96ad131169bcac1e6222_JaffaCakes118.html
Size

19KB
MD5

f4f136c11fdb96ad131169bcac1e6222
SHA1

3851b432512baf7f605841f911adb9e1060a63d7
SHA256

0367c08a69bd017282b1822999f2273641f05a7cfbe1c1cfe3c63fe62a9262fa
SHA512

c9b005be5906229d8330b473237e72ccc33bae8ea4d635a04f277868a2d69b80c6a929ad202ed26c4ec04cf23e64aabd2a4294343b1f096cd77ef7ea9c807e80
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIo40zUnjBhcW82qDB8:SIMd0I5nO9HhsvcVxDB8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{34BB26E1-7AE3-11EF-AE26-F245C6AC432F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433392040"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2276	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2276	iexplore.exe
2276	iexplore.exe
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 2940	2276	iexplore.exe	30
PID 2276 wrote to memory of 2940	2276	iexplore.exe	30
PID 2276 wrote to memory of 2940	2276	iexplore.exe	30
PID 2276 wrote to memory of 2940	2276	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f4f136c11fdb96ad131169bcac1e6222_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cde7511e94efede7fd80ae30a7b3e821

SHA1
dddc98498a90601ca251b5227868843f0fcee8d4

SHA256
fda1577aee9120586eb35edb8f6037441fe096f4f44da87f6ff97fd15d1eec6b

SHA512
5ed3b472d591b6e3224c162956227936f9edf368180bb7615af77b1166e304cd383839f3c32788f549aadc18ca5ce69a796185e8a637a6826bafec68d79e9e0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ccc9ee2370e773596d146b40d5ba9b3

SHA1
dfba11abd560ebbb707182d42200d3d18e76251a

SHA256
c57d243b076c4ac8ef6c0d3991d7fcfeb6471b77d2097d44a0727c18713e6cd9

SHA512
0e3570015784bb9e167b5922f015f0e5365334edc5cf7e3d573c96f5d5d82044567b7061f1a5ab58441b0e7cd595cbd3f7346faba53e2980a631b4b23696ab2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a77d4727bee3637b9c953d434eb599c2

SHA1
e8eb92bf0bb2699b3e642a7c4a45eb0887e0ab0b

SHA256
90fba9aea5ab9f92792a66e69af5630741cc21724e4c8bfbebb25b10ed905e38

SHA512
b2d2d65b1a9fb812ee9874641ab47bbc128d138c601028089bb3adec10df82d218898314328b8a9f4b78c64f25b262697d8ea56ffea3fb99e7f1d16440224f2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7088ce4b76200bd6b994b5e30eaa34ee

SHA1
72c700ad73a3f5555d6696b6f3d3edc8494dd435

SHA256
e11efbd9e84abcb58743ae51fb4623d8bfcc13dfdc6137914426a8b953c03d14

SHA512
6b8afd9766c03eba440e9e5e81765a0327a1a265d2c299d8c283114fdff0ca8e5d0259eb548b4470970f795918e01fdf9bef2062b299f3d2b7ceca13ad96e83a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5394c03285fd3ca43a37b84160ee9dd9

SHA1
8fd850644c466b91dfbb2e74dee77dca60f7532a

SHA256
730b62ab13500413c56a51549b7701b545a4b92ba509892cf59f1d21265b3fb8

SHA512
5cf554ce80cf9ed38cd4d43ba33296ad58874258ca17ba831ab80e88404ce63ec16605dcba1ad775194c718a4b9d7a343c654cfa00a43fc96dfe70a172313358

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d76709b42bfaab104b3ba5fe949f004

SHA1
912df6d5479d5b7a17f22225af5995974a8294e3

SHA256
109a831263fbda51c686178fb8b561cbe677d206acb6871036a57a23e2994f47

SHA512
5f08e8340c721b8dd52fbb005e8cc5d4298aeda05220f5ed325d1c200e488a6c60a39d02402938b1e194943c92481dc714e248c3b096a1f0b7e8eb25bc9a0b9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53bd234b967e9cec63f3ca249d50bc76

SHA1
7b576a4927a11eeda0ee41a031c2f3c43163408a

SHA256
faa3c1739e05736f7adee64b2eb1cd4ec742431e482d99e67af0baedc338bea7

SHA512
237846f7895924938b829070c4932902780e85e3b0f56d97abdc555963588ca8c4e476623f33c3d58f7d776f452a505ea2488323d5cc87a4fdeb5b2fcc8c3637

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
981cca261034c6952cfc327f54c32f9c

SHA1
8f8fd2efa877332aa1b127c44f7fdfb8d8de0b3d

SHA256
dbe0b39aaf76fc129841dd2d669878743f75172667102288ce2901611160428b

SHA512
da6cd2a0eff3b665d1cec689f247a41cc532ccf682a4a2d0602f409773fd6aec3caa260d7ed170cb4c4626930fb6e7f55f034cd25603ca5ac7360025e825a929

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c787e8527b95cf3585369b7e5ff582e0

SHA1
9c99b87358c731940333298f281a71fc829e6567

SHA256
8ee418b6fafdee75b5a5ad863dd8e85fb7a3dd40fee54e71f809c63a1a0d09ff

SHA512
3688ddcc28e24443a19940a5248ba9101628ae60312aa04dc0a4a36cc3742cfbad083306277cf469a034b898f63f067833962dc1d29891234e4b9cdfcc1054da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
194f2acaacc4c4695a19148effbaf57e

SHA1
18e9e4ccec114fe77bf00e4a476f7a88f0eeda93

SHA256
24b783f27858fac49b98dcaf2e745456825d30606c495f6c8147403ab6bed9d0

SHA512
e7739fb89a88a80035b7e517bcc24ee0652cd1b28a55c82e1e6f8cc3030b5db3515775cf2a430a04767e803f310cfd8a0c008735f2b41cfb688ca9d431f23575

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e316fa6324262d32e8ecbc3a3960b5b

SHA1
0217957fbc3bf2c25cd46947b50f6c8971bfbe10

SHA256
320c13bafb1f143bdb377f1dcb58c4f537b0cf10843f2e2349b591af3cbf85a5

SHA512
60ca6cfffd715abca381fd0965906a04e0f4c552c973ecfe6af26bfaaae88e4f14cf825954afb8cf01f0bd9317fbe155dd3914739cc353548e9ce031e8627fef

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC0A3.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC0F5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit