862fa264610b55a66d14a2eef5cbcf507c40137f06d147f086adbebe2523cb5a

Analysis

max time kernel
130s
max time network
135s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 17:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f68b56b2bf71469ce37e5ae0dffac1b3_JaffaCakes118.html
Size

213KB
MD5

f68b56b2bf71469ce37e5ae0dffac1b3
SHA1

6e3807c84c5b26fbec9e0e1fdec1db229f812843
SHA256

862fa264610b55a66d14a2eef5cbcf507c40137f06d147f086adbebe2523cb5a
SHA512

c369524a34cab6089eb98b0cb9f01913783f9245658c16dab642c93531f22b74205dd2cd1e53889275033afd24291dcdc699a822ebfff85e04c132ffbf2e791d
SSDEEP

3072:STPlQAeFr3zkzyfkMY+BES09JXAnyrZalI+YQ:STuBQWsMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433448570"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D2B3A561-7B66-11EF-BA23-C60424AAF5E1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1972	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1972	iexplore.exe
1972	iexplore.exe
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE
2356	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2356	1972	iexplore.exe	30
PID 1972 wrote to memory of 2356	1972	iexplore.exe	30
PID 1972 wrote to memory of 2356	1972	iexplore.exe	30
PID 1972 wrote to memory of 2356	1972	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f68b56b2bf71469ce37e5ae0dffac1b3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1972 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5de5c4d537adfcaf9a819c941a08d1a7

SHA1
c03d331151346ab8f74a75560dbb3c27003ec731

SHA256
e0e80bc66b97cbe7281d6ed1bbfe7656f454124349fc2d62b1fb94e688c74ca0

SHA512
b3198d929990aebad69cbeb26eb937475100cded118f8fb4a063156563f41cec3ce3e2b402f53297c8f4257304eb4bdae014a4769d2ed9ebefba44c9db51862e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66547513316b17ecacb6d0ce9f6fba66

SHA1
bc14c2bd6882f0594f39e5476f8804d35760b598

SHA256
aa57bfef2f479b5537ae1f0f4307f9205f3232b27df3a1e66f3737c53f3f2fb7

SHA512
8aa99a14314fb64808a2cb7a65b0e8faab89eb8f1fc7b2864fc73de67837ffc96f19ed32a3eb35ae787d2aa9ce670596c0cf95d0ef23475a12af6f0a0f53f532

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cfac6c9ec553e8e1f6058dabb5bbe2ad

SHA1
7fc9db222823b6e9a3d111555a3a2a198232f4ae

SHA256
2b9599310818e751b0c69d75543a8ae60e70d73de70e396def79e7063e6b9e97

SHA512
bcf2ab3a3157de472666939157bbae70c0c1dfd79dd1831632c016e2e7da0ef0fb42a835a31600d40929d72a8f3cd09a22b5fb6e9b857b96761dc327635ab33d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6194dd856e98dec33eb47e62132a842b

SHA1
59256054f4c49d7fafeba2b71e43dbbe8948c83a

SHA256
ec855fb07cb3b62e5ce919d294e1636964c112a86e7dd66974c75173b5fb4296

SHA512
dcdc813be1e141c0c1587e03d30a680260b5901c97f3870cdc6438e3debeee6d29d2553eb26b37d2043c983e3db74ffbae5684b904fcae4b4a8dfa9b9638c2f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0cc71162449ea65d8bfab3b33b3f114

SHA1
e391927aae089a5891f64b43a6b950a11f4c85d7

SHA256
35f5a3383563d1e70b8872dd80eec731a5682df6926a3c02154bfd5b5e209ea0

SHA512
e65613f698fccf701a8c429bf1be323a98f9a6f3993f69b6a4cd88ec1fe309980915aec81b7cc2d41cc4fa27af6e256bff092192081aa3d74a9f7a2c396d17e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af5bd6b60fe786957f7358754ab1cab7

SHA1
9b6f94b696579b3c60a8a1cd773db271ea1743a1

SHA256
d843b702ab143dfd796219e6ab7640dcba48133678167990455060cc3be31940

SHA512
b5d0bb15a496d30bd6e863e7792025703ffb5e7581d174ff9a2275225682ceafa6953b0043b632f2a4cc1d470dc83aae834bedeff208f006e12ffc9a122b1ede

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4746247bf181d0b04e56f2a5c7ed844

SHA1
9b2b4eead508b7c0bb7f688fbfc0b98282cff754

SHA256
4893ae2eb31c6f7ccdd49e3e75decf1fd4bd7688d15b51d726b3821bf84b7fab

SHA512
b3c51d01876b6b541d5ba0e46de07c2b9492e7e1889b108dbc5ff8f048cae64b8169d0c18751fbd667bb6dac5381b4ead0d74611a1e5db26d4a2d46dd875ac84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab971731de303178d25833cff4b14313

SHA1
0477ffd053bfe73b3add34d1ce21739eb910af9e

SHA256
235102e48076ac89ce1cd9aeb4bd70d3ee22fe556e0eb68604c35069ead3350c

SHA512
93162c5318ff363071b624fdc9426ebab6bb5cdb41ff201ed476909a7a208a6b90d88e5be80309c0e6c2e798049795b4feb91b01f23d61c2f6ebbdfe644edc25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0cf9f0f295c5046c9c940d57d6085dcb

SHA1
0885dde4bc21abc5113819b3f4bfb28eaeced1a4

SHA256
cf71bdac654a433109ad0d34a0b2dbe7278ad630ab87896042b9ae99b3bb4aac

SHA512
3af701bd433ba20c9999f778e576947143c5f66154b4606d1afd8f235c19ea94825a7cce930c5692fd70db2be004c3f6f7327eb7eb49a987fa106053bab6befa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9df6e4ecec73904a85305dadd7d0f5c

SHA1
7606b057e096db435b19721b5a4d736dc78363c9

SHA256
059046f81eb3527e99130d744a8962db3f8690f417b7e42d92a58c856827c640

SHA512
f437b87427d18d466c2df79379b736bb0503e50249be93ee4b850233ded8086c9debc658bb453e6e0f848b0df7d8d251c7039b4e7f052a76bda652affce24c5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA574.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA604.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit