485b57b52c56fb2ac80fe7dea9ea5501a3779f832aff2191c3e475662cb24ed4

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
29-09-2024 02:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fda1dc2153a3d2fa8a4cf28eed265c5e_JaffaCakes118.html
Size

11KB
MD5

fda1dc2153a3d2fa8a4cf28eed265c5e
SHA1

857843e675e19264809ea98b8e7003ad58867560
SHA256

485b57b52c56fb2ac80fe7dea9ea5501a3779f832aff2191c3e475662cb24ed4
SHA512

74c263e83f1bb7c2335f16dc26b95c17fe8feecc66baedc8ef0966038453489497a54b468732c19d26aae22cb0991852f9252f0cb6b30b354bd85320a901df50
SSDEEP

192:2VflIsr03TQ8k/w1wvqyGBelnDGqKf401JauBuLbdU8d:sflIcuTw/gcGBelnDGqKf40JaguLZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8200C7E1-7E0B-11EF-8EE4-42572FC766F9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433739203"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2564	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2564	iexplore.exe
2564	iexplore.exe
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE
2036	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 2036	2564	iexplore.exe	31
PID 2564 wrote to memory of 2036	2564	iexplore.exe	31
PID 2564 wrote to memory of 2036	2564	iexplore.exe	31
PID 2564 wrote to memory of 2036	2564	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fda1dc2153a3d2fa8a4cf28eed265c5e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2564 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26dca9901078f9710ce3f3225a534093

SHA1
148bc4b01cef9d49ee7c5545533f5ff3387f29bf

SHA256
c2e87abdccff4f911e2263762a515ac11ed76150365ab3507fc2a3beecedec85

SHA512
fb956419100eff65f18cd56db586ab38d17c425b8d17894f4310c72deaaf41cb1a5b529d5567b74e409d21ce72da183de5bf27a5f03e19a383cfd9a05baaa1dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ce982f905c2fd71d0a0c3c6a2d705b6

SHA1
e6c9a363fe5de03f977d15a76ab5db515a9aacfb

SHA256
a6581b0d8a1c18933e9ac3cfb9455f68b368aa31d04029439462ebdc4d42327e

SHA512
549f7efcb9d0e1d3b1e65cad01b3d76102ebe3188bc1895266bd655e069e6b5e9d5788194d5733202f092b0e5e78be4daa74448f6d9e51eb7b4c91fc46cc5a34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19b757d9e1dedee81dc6ed6b582dc450

SHA1
c3f6ca6d9be0729a7c8f9d4f94a4a1a1f968d7c1

SHA256
fe4a8d04267982abb35aa5a16053754115eb914642d495afe51bb8b51ffde9ec

SHA512
856137a13939b907bc44f5da7727aac7870751eb96b94490adaf94a051b6a30125d8ba703f93fa98b9d593bb7c4fda251fa836d9fcc9399bc4f6184103b5e3a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9c833937837e1c8dbe26cbc6ded37a5

SHA1
821c8e24b18e01992844fcc1202360285f02f2c9

SHA256
ba6520c4af26118f327e39a4e4a950e8f23263dd7134f1865b331615c645adf4

SHA512
93290e760c7c700776b0d27bd8aedc1415b1b8496f7ef464bc9212445864c8349c64bbe13f279d8d0d29bdeec339a5bb846988e9219dd19b1f0fac42d6b37628

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95928eae183af48f7dbe83445c53e970

SHA1
de789f51dc348af52fd500d2548ee3ce7bc69c02

SHA256
d5b3f0f46d2a2665fa9c4ee6f43fbdc3ba18e868a3cb8c455240d8f6036aa516

SHA512
35a7443e079599b9000524f8ea69c7f88dc8b6ee554d99dbb1352b6f55031d450d3ab1916a193220442f849b80c516b4c4d69c4cb382905c0fa2b2acd4871166

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
514589ead030cd569fab28403d9d01c5

SHA1
188dee6057632cee9c827d335004099a5fa3eab6

SHA256
cb07af65c13f0cdef95d0cf93972faa5c9892d8ade05628385742252e638f61e

SHA512
a6e10e1b28fda026ae4e72ee8e038bd16e58d63fa24ecf62e480117daf5fb53713128f052ad469c1e1d90e1bc09e6d90222802d40fb24e4f553bec43ba83f3ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
048c1c1a1e9e76e4291d7831f1b9fc8b

SHA1
2d423e8529af988c0774778cfacd32e9413d8084

SHA256
bfd3f7b9fa94a79a96ded9a4394c46735a041471d33fbf40b79f53f65ab2cb2f

SHA512
fc75ea2c972b73fb032ed52f195a003d3db028203023abbcb1aaadad8e555ff367dcd1e4c71054402c34209e126b63da4b62ab09f77c66376b24edb338d0135a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
573cd14eac35389b6c3b2dbf3bb2364a

SHA1
d7e9794dbbcc7f90bde623d85ae2d47c3bbb07d7

SHA256
ab1879829727b8505d7aa6f35763d532e2be25caeaf10dafd8416a09e5277050

SHA512
82edbdfafedc9db61b2d79c41695d509aeb8ac95dc6acf3feb1eb376ca334a42352ab971969b464155ce83a61574bed9f6947c035287e2f5bac16fccca94a7d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
068b91c0348a22ff85358584bfefe7ca

SHA1
2b38bdd7959bec132677999bcca266ab3e36d4c1

SHA256
68e8e281a554a35748054c09b2b0474ffff5ee71721b10f49438a7b8675ec5e2

SHA512
b7ee65712275bbe9020d1f0a40c1f739867424e3d6e4bc98452412e8419f8e1832da42614bc2d54f913c511eb2292f47db550fd50445766563ff50db897e0848

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCC56.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCCB6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit