591c9fc82c11affa86bb424c93de06da171c927185f96ff4b6290f52003d39f9

Analysis

max time kernel
130s
max time network
141s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 01:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f97ae38d19b26fd5122a070acb76266f_JaffaCakes118.html
Size

18KB
MD5

f97ae38d19b26fd5122a070acb76266f
SHA1

e8742281e6e98a8db2234dfba00c7740769f9a18
SHA256

591c9fc82c11affa86bb424c93de06da171c927185f96ff4b6290f52003d39f9
SHA512

6c393177d90ecc48a49632415a05a2d8b6bfd35ade3808e5ecb2d77b8af427d1536cecedf58197c3b44d88abeb2c6ee5028f4ebdb34c173d3dd9d22822e6bc7f
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIu4KzUnjBhKs82qDB8:SIMd0I5nvHRsvK/xDB8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433563021"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4CCD89F1-7C71-11EF-98DB-E29800E22076} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2096	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2096	iexplore.exe
2096	iexplore.exe
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE
2384	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2384	2096	iexplore.exe	30
PID 2096 wrote to memory of 2384	2096	iexplore.exe	30
PID 2096 wrote to memory of 2384	2096	iexplore.exe	30
PID 2096 wrote to memory of 2384	2096	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f97ae38d19b26fd5122a070acb76266f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2096 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa0f3d79bbc9365bb44b9956247ffabe

SHA1
291e394cd8dccc193bc79caa0e66bda43c9d3e6d

SHA256
373cb931e41c6201e17b6ba681280b6522e5c2e71f769518809ba1c606b77969

SHA512
94f388924fdb1c50c4892cc4b09aada68efdd7e16150d019cf073d687b37db43e26fb82bc14db64589c9cf3276a4584868dea91231c70dd77d22bc94d8972eda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c70accfd44446495bbec740ac9519847

SHA1
f7c36063340f793b3707d689f39518bfd64ac9b2

SHA256
49c12cde91c96fbb54f817bbb3a4ee3763018ed956b24698a85e2a2c7b9f221e

SHA512
9f774331ebe608e9e497f948046832f6cfd03283230fefffb782f20327206c4708469521ebd21e3927533973139aae0738bd93ee9afe31fd58294ab5ea303ef8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c8f0a8ae3bb24e0a4e4bdd59b6371fb

SHA1
5933128e4236fa73243a9c10aa173bb7164848d8

SHA256
0410595456e5069327f8afdead93498cbb98cc9e70a8082b95c26945952e430f

SHA512
9ed277b2dda68290ce22d91d5472e23a6cd1ff8c46e267df012add57cf86d3982e1c5ad3c3d84f05dcf2f5cc987b374b76cb8ee99f5fb8835801ef83f6f9dfc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d71ddeac9f66f19321ca70c94bfe8811

SHA1
d3c79820e847783703155bbf1d223cdf2adb2d21

SHA256
15f8e196aff5280d2c0f223615663f0149770a3385e86abef5f3cafb93031256

SHA512
e0abdb6b9a6a90d11ec931f8dd04435cd726898cc1dd82f59b6219679a3520d4533e23fc33e1e2f2cbe13758d8e9957b8d5accbd3a4a17a687a603c895f3ee41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03783a7a08c7ff4990760df3110c18b6

SHA1
27784eb6f3a6b6043c567b958ad115ad5dc7d657

SHA256
f3cde38c0d75af3455d0a0c9cefdb58a1c6ec005c6a7dce38ce7c5f2f4e2fafd

SHA512
0418358aede26f251517779dff19d000cb7cfd5bdc6529fe19fdd7037db5f0c4f38416a3b281972a6d4333c9feaa3e74839a4e4e8ee186181470d3fde39ed4b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a004b37f8a73c43cbb4f17245522fad2

SHA1
008bcae688e8df11cbdc35cfd2fd6b29ee6d4668

SHA256
0626ef9c71ca3d5194499f8674c292cf373097684c76822114038856cea11da6

SHA512
5cbe4bda3fb54572f178e293feb6c7ca53793c26c2cefdf5c68287f08fdd3b5ac2ac7290f0be5d7859cd760cd512d413b10cc588673fa8352cceeeca768dd07a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a685ab7035c3157b971e65e5a9870cb8

SHA1
09857e8967f2bc824c65cce17c03b748a7e961cb

SHA256
243db0e226ecbf96f2ca8699bab3b880f7a53bf47bacdcd222b3833dce4d1b00

SHA512
75617f6a93ca0b738ab786a9771c09b816d45fcfd9f2b1a388d9e96c0d02594e698fa868f2e1c3e32cadb956bd16bd1f245e50b0a53e9e811d7236a654b776a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
035c1ca9fe700a9aac7ed9f32caa5934

SHA1
ef1e499a068890c628d49c97c3364068ca50b828

SHA256
b99d653f8d46a4e9d999bf732edaece28b59d3a624bdde7d826304bae9f3db1a

SHA512
c215789ce89a56992149cfbffcbb324b0f96128f5ff4e35d33b5805f401a6c3b0856195ec52f8ec45c80aed0326c8f5e66ebfc95a8cd44032c31af2e102a9ad7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fdfd94e66e13696de96f402bf11d0435

SHA1
1a61d18db1284125dd576a5320cabb198f6979df

SHA256
2ec69180ee93d4b1f55f1ff746f71b2b82af84951d35087167f307b06b3d2195

SHA512
32f2145be802c6bd8a786e9d3512492ef923ce72ef3d4d762febf56999734ceb5fd005499740cc7c29983a499a0436c8bfffd856713b75975a839bdae67464fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB167.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB206.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit