7e8a5e292fefdd451e0d8a3793175cfbef8a83659ff5e3e0a58eb506df0fffce

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-10-2024 04:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0455951661a7f0b6da2d3215cd537d29_JaffaCakes118.html
Size

46KB
MD5

0455951661a7f0b6da2d3215cd537d29
SHA1

071303de48396d1571a4c672faf327c940c57f14
SHA256

7e8a5e292fefdd451e0d8a3793175cfbef8a83659ff5e3e0a58eb506df0fffce
SHA512

2da6f448246ca85c57b323bd8f19a57b311ed12992506cb2818f1a9b62bce0d423b96c122d4a8e116822b9b514a114df694d2ee61730add29237567aaf0cd0e1
SSDEEP

384:H9lIcEti4uVGTHdTzqioAHtW9gLGTG3ngPuGtxuGXkxx4H/qSSlt3rlaxkaWHbhG:xxA7LgKsd6OeWgc5xLZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433918012"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D3E2A5A1-7FAB-11EF-9AA4-4E0B11BE40FD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2308	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2308	iexplore.exe
2308	iexplore.exe
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2456	2308	iexplore.exe	31
PID 2308 wrote to memory of 2456	2308	iexplore.exe	31
PID 2308 wrote to memory of 2456	2308	iexplore.exe	31
PID 2308 wrote to memory of 2456	2308	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0455951661a7f0b6da2d3215cd537d29_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2308 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79b059573b32b0affb09e7df7befd453

SHA1
4831e57c4abf6a85a7984fba6e28958ad155e9e9

SHA256
47761382643c5eedcaf948d7065a784ee7302f60c9d281a99957efbb227b8ab4

SHA512
2fc3d037644e27c57152188feeda3764663eb72f899f7394850bb6137dfc0e3339e21498b0b68229c74fcaf9e7d48e8863cc09b8e26a3e483f17f9c7697b4abc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64aa864eff9e91d9005a663704de0d28

SHA1
b2b50fb9f4dca372c3dc155b821e261b9e40a021

SHA256
78ce968d0ea923aa3dcf2c23b38f43f1bff93c385a7c11e60f4e7359b318bb60

SHA512
d00eff3c2d9fb5d28c444b141b43b817ad5a2bf779a448ca07733dec2d7d88dcb5998462cbcceee6b2444fdcb901ee5c5b97a268541e0df80775c2a7ea8c001f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25da13384b49302d6378d4f84edd3cf8

SHA1
57006adea86824d654348058d47182acd739df7a

SHA256
138113109887993072548ba722baa93359e3fcba66d80acc610d3adeb8a1789e

SHA512
5aa50a7233d1732ea3492d9ab2ca0fe04bca69652b50d821e38da605bdf4c2e4af14c2f05883d8a90bb82d23496cf2202e99ea435e3fdccf90bc23dbb222e4d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5636151a307d02a4345840f7e5ce2771

SHA1
5345923c51f532f262c19546df7a5eed98b83516

SHA256
61405a11c0b18149d41c0c20f825b48a1316dc8879ddb1209475cc27564bb519

SHA512
7c86a164ddcff1903e1f006966a269933b24fdb520c5a8c0674c9dd36f17595791d9f6779565bc202efa930620fb4a0579abfe3a0f5b2fe5d7104739a7ea0c1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b86609cdae54a3f0f2a38f731aa01d2

SHA1
6b006a17f26342f419a37016a6b61e8efe6980bf

SHA256
6dad02ae72d37355c36da536f8ce818784a7ebbe9e7d87aad730be3b7ae8d6b6

SHA512
a96b041c75d649714a923b18f2daf8c46d9054a54f5aa8a711d7e9ef13f3cd887464c014eb1f52f5526a7c4b1e7beb7090f80b457e865807f765c630f202c9b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33afb4a21f5a9429a051f526eb683df6

SHA1
141844352ef92e27352d0eccce6fe1f80aa01145

SHA256
f01ae70469a8ac79f148622a3a0df28f72b0f22cb7de682344796a563c0c193b

SHA512
139ea0b9fdb7368577a9de1a317c37d7b90893bc7481f6263b955eb6a1f50b839c00e3cf287fb31ca169211d526837d0e257dd11b8872575739ece21fb77e742

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8310f3d166622b7c2a27a725af0d210b

SHA1
394addd126db59c334babce75663f9e2751ed3a7

SHA256
194f84d17d7685bbd17f3c641ba72fa110f66b5ad224afd6d8100b8429aaa052

SHA512
7270a6ff7bc755c9bd4c1b24b6e9e0ca47220b5f1ef7e465bf801ff752befa9dfa284ff51faa60386a55e459c7fc285772095ef680a6fcef72af1ca777be6737

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f95e62f3a25c1955c3ef5c0505d46cce

SHA1
a00fbdb0716d9fbb4a3a3b6574a7830fe6ca4010

SHA256
c39fe4f5d793f22823b88ccfba003aefb6a6bf66be929a9a11172510ea2a2d2e

SHA512
0e77cf1dba0e35f608d8a1a96b8d901666903ef1b355932d87dc4e0f09bf1630b0fc75e899f3f9f1e3833509f5e1700d0882a391f1bfc096af7b2b9181be0274

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd8bd01ef7517b6c2774df19fa23ef9f

SHA1
9ad3b929ffc5cb0dbff1376f55f10cf1cf67cb0a

SHA256
572cc7110bbbefc435dbd0fe9cf4c38e3b4057d327da38c54fdd8639bba1b6a0

SHA512
d9b91952f9be63918493c7060fdf66208c68e7902250ee9c95780f103fbea2494fdf0be8311520238411f57b3bf1abbab84c6999172c346accb59a3514415cba

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDFA7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE008.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit