372ec5abd71bf1b174a25f6e7127afc9d1f817361f51a16ab789646982a0bdb5

Analysis

max time kernel
131s
max time network
141s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 09:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05578b1eda7bb2f354d7fb81b8d5048d_JaffaCakes118.html
Size

141KB
MD5

05578b1eda7bb2f354d7fb81b8d5048d
SHA1

48c7ab20678a0824e4f88b4a163d4a709843800a
SHA256

372ec5abd71bf1b174a25f6e7127afc9d1f817361f51a16ab789646982a0bdb5
SHA512

f0b06b18182a35238867c259adf73bb128c2e1e221ebc6bf7a3a730d84b1d3bda2c030baf9cc62bf2b5e354545ac9dcdd3795d07e11f494e960bc2c561b8f8d8
SSDEEP

1536:S4XQ1UTlSlqTo9x76vuyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXu:SqTlOx7dyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{048D4FF1-7FDB-11EF-ABB3-E67A421F41DB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433938279"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2056	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2056	iexplore.exe
2056	iexplore.exe
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 3068	2056	iexplore.exe	30
PID 2056 wrote to memory of 3068	2056	iexplore.exe	30
PID 2056 wrote to memory of 3068	2056	iexplore.exe	30
PID 2056 wrote to memory of 3068	2056	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\05578b1eda7bb2f354d7fb81b8d5048d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2056 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e86ca597f0cc056f1553baa49229623b

SHA1
f71375558f99fb892cc01283005e8c96b7445266

SHA256
f0309784bfb36fbe36c638bb8c5d955d813dfe6b7d73038bc978d09d09f78b24

SHA512
1b435cf16bee9ac07a6897d10ae45db635b264a3d6fbe9f6dab05d973e3eb9481457387acbd05f26bc261290dbfb2da2f175ad3c898a3ee3b0300ce558d152f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e1e52670dc69987d473879bef14f6c5

SHA1
2a87c3129fd005046454aae68d9752395e93dbe0

SHA256
60cc9a5262e3ec5f6bbc1dae6248f61e8dfd00bb97b44716b02a85b5f5f55285

SHA512
ba914ad3e8db9978c7fd7237536daea40d6057dc2b8943b03c5d7d9ba831da16f8b5e50f6320b26a16f406f0ae0737460163ff70f662f37cd074198df5173983

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96f5b505223c3862582e45634cce56fe

SHA1
9de4f09580f4e6d2f1c91c4566d08b1ccb1c4c00

SHA256
b3ed946d496fabea41b51bd7734430841ba98ef880dc8244b50a1e46badfe849

SHA512
780eb87fde40d309a9aff9bff82ab4dc3a782c37764ee4cdd060252628505f8288d3812e961032470112e634b8625bde6fb3267a5a49537dc1ab4551a6247b6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
624c25d29fc4d4896df49b731fedc4ba

SHA1
7be94780f70bcbdf6070b801baa06656be4455ee

SHA256
e642d79e3eaf26584c12bdb3b17eeced4f299a08098b2b7d3568357cf046f090

SHA512
1c862bec63265c92ed8bb1f797dd53f159bcfcae379ecdf0cc856022e9a2e0dcc6fef388248d0cf7ec22e956c81d7311588253a2b200e2ee5a0a5b7124930696

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a38548aab1806ed9fd8fccdfbaa386f4

SHA1
52dea5315ec41a0684954fcb3569165fa7c6b968

SHA256
8c1b067114102fcdd844d9538d91e59663f2cba39a2f2aaa8154f8cc143c83a6

SHA512
4ba7fa149201866e68b8ab2e5cde56c86dde8606e6e56c4f2db8a26ed4fb1dc7777901c3880a31b9abae4e1d72cf5aa1df1bf65cb55df99279a1edc3acc87258

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a60ff5a845a2adbfc72022feaa3cbc09

SHA1
f901dcf9829e1487d3ac9df2117f3038a7ba129e

SHA256
8b5114807cc5cd33ea1a9b27b4ec89194af41dfa129ffa6fc05e8e6b48c2f51a

SHA512
22991e4a7a55cb5cdc07e4bb70d6293ebab34fd3a76bd968defc4e54fbc5f41dd6b343643e8c3831125406f1331ecf66379cb8518c45cf0ffcaa402c17693ac7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e910bf33e8fa38024439738c79ededf3

SHA1
ed0e00680382dc2d0581c352a0ee4db4d412e7a8

SHA256
254590eb79bc6b6ec9f9a8d5fff6491b729d63f5124a2cf50ad1f24ff0b17b1a

SHA512
20002af1e695c0a40e0791283f692d07ddfecdcd276b8e97d2a4d025e6e3a8024b05288ae5d2ae2e4df5ed17554bc719c839e7c4d93db5a2c37b14dd3082c1f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
958ab1cec89cd4504c1fcbe8674f9b5e

SHA1
1c6156d4dd15acbdfe6dde6e293b88c1b26a8a79

SHA256
54c8305b4ac9557b0681d61c23ecd884a18da971b129f4acb930b156479013b2

SHA512
08ce32f5ed3cabec7fed8dd0f8a4d8275bd51f6f0ffe4c792bdfcb7636dfc3b37ce3accb081b5d60183186398c6e681c42c8300834176bb022b5d971838663ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e647810f6cacafb4e9a86bc586b6695b

SHA1
82e0d569e7c22fda3bb6fe63383f9b098a93df1b

SHA256
2e68196bc01adb872f7d2e356be69e336f2ac238637e8416d8d3391912b75821

SHA512
76335c32616728a477af8a08bfcd1e4a6c2fce6eb8670105709e4c81537809ce23c1405cb536d8acf753b0e83e8784d6767b7b22e342c1c6b07d62738bea7446

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef7030632b0c59742df79a7433d3bbf4

SHA1
674dd993a578029f3200fcd0f18c0da8135390da

SHA256
6ef9c41250277cc36c6356115cb06f8eb73d042e27691948d71b4455c4dcfaa5

SHA512
b51f99de508c72e733656c4af87ca0bb0ee1836091ccef86bb3ba85741f6dd45f3855debde61e02c676502e3bc98ceccd7e5764b2f6fcc5d01b5c4a47c7568d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA3D0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA430.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit