b50ec060b2bb71a55315ed0b02d901d5e53c59fe3478e6cc5610fbe90f7795a9

Analysis

max time kernel
147s
max time network
150s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 17:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06b94c07e4a4d272eca5947b614c8988_JaffaCakes118.html
Size

61KB
MD5

06b94c07e4a4d272eca5947b614c8988
SHA1

eaeae97c326432536a9109eb809f69c37b2c48f4
SHA256

b50ec060b2bb71a55315ed0b02d901d5e53c59fe3478e6cc5610fbe90f7795a9
SHA512

3fa808f5904e1d85eaf67a4a602ca34b2877b9e9341cd7a73faa4e2cecef84cda69f44a793d8e4bc96ad42624b8c2f9a4f69eac91abfb6b3d3d7585a9353f0bd
SSDEEP

768:8+EttnGJ0y6ZgbC/jiWn+HKsykVt92kmoKMxNrqZlIx+ZlIyhZlIhpZlIYaZj4dQ:87GJ0abC/jiWn+HKsykTksPu

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433965484"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5B7618D1-801A-11EF-913A-D61F2295B977} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2812	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2812	iexplore.exe
2812	iexplore.exe
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE
2948	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 2948	2812	iexplore.exe	30
PID 2812 wrote to memory of 2948	2812	iexplore.exe	30
PID 2812 wrote to memory of 2948	2812	iexplore.exe	30
PID 2812 wrote to memory of 2948	2812	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\06b94c07e4a4d272eca5947b614c8988_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2812 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48a13cad186674f300079648c7d0bb44

SHA1
3c7ac4846aaaf89dea9df843c8407d32a0f09963

SHA256
707c1cb510e19c7380b3b65800fb0fb7467c8c1787f74a7a61aa590d8ffb1cd4

SHA512
2e5e1ec2b36f21ba7e702bd498311d8a457054dcaa948982ccfe6fe8458d18f439fb5e18e71f557c064c09e45db13205e3f3a11102b244dd38d83d6c22919f60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a4625d1a51f22fd6c233c9ba45619d3

SHA1
a1e43baea977ee56d93d26deb5bde8e3835ba884

SHA256
975761978e21bd4211683b3e20a109bd59728e824b473b628a3536f3b5df8619

SHA512
61d15c2af86ed8bf2e65353bf51fd558a2fb5e225f2a720ffb32c14851b19eb27cba0354756b242cf6f1183f0d88eead5c28b675301f2b731c229bb1443feba5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61ed497aa4dd180b53ef2d91b3e90252

SHA1
c62da1a739063fa0594a7d97f217dc821fdea49c

SHA256
b93f57da885fbcfdbfa75c60b9ad28f3cc60eb6fae277dc972302d45c5a5e155

SHA512
33317b3faf2ff43de3e943156911f5fa6e0e359912ba763dfd953e2d86a01019d9aa3da1bf70e8563e4e392d6a4ce512fe0d520cdc1821377761846dadaad710

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
200d2078745db8369a871ced52cab409

SHA1
a0b7ebda4f7e14aee44b9689cd127065e99067b5

SHA256
0de6718511725bde28882ace680ba4b88615453053d122126ab8e72e9a2baa6e

SHA512
ed18cbb7380641b015e31f9fcbdc84de886f155762cef3caaff04c45fa4649b6f36197febf3a7e72f78a46d3380b41f2e388e77b1e277b1ed38a4e959904dca4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6f6376429109fe83dae4ba42ca9f3a7

SHA1
5a7dff235af6ca6747ff4fdcd403ead23b7f47ff

SHA256
ac293e30f235963d37eed3043dc29afa1c2d0dee9d43ea933c5699f519c0e303

SHA512
0247b7af97da6a4e53151aff257fb2a3f925fe1458c5b3e3584702c22cc3fd6c67fedd7e1cfaf11be570ba340c854e3e773288f8bbb7452b5c0f6478ab776166

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e33a904920f571e6065d22241b614d2d

SHA1
c3689c24ebd0c044c905f3272a8163b39df5b60f

SHA256
b0975fd4fb7aaed1c5d039fdb8edd176a6d44fe8dd7bcac67d1b20cb2dcd605a

SHA512
3c20e2ef17641ffcb71699a1d5846c49f2bf3c3e6ecc9056aa4502ebae516b5456c347a4ad96c2a93d66c72a2b18bb5532cdca7e74090f1fae1a1c7dec16d992

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42539bed219baeba7e99611234c49305

SHA1
c37d031a5223363b8f86af2f60a5ead4636f10b5

SHA256
258772aeeec5d512aaca9dff5c2e5251152136b50de76988de10daca4e8f5310

SHA512
b6600083b22946259f644a16e64181acb36fd6bf1075c62ba64d2e0dfe30d5bf69f6cd5dd13065c0e34545a73efa205c5742d411408420fac2f417d4bf722180

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c64f4a22cabe28912d0ab2989a2835d

SHA1
81f8b016de81e6f63b6ba0782f94934d753f0993

SHA256
e4aec37180887078950989ea3d24084568868b7ec2abee93adac8daedb70016f

SHA512
1401073c3f5bf99b8bdaf40ee60fd3a3a936e86f7ec35e8255975da2f498e79e78602a9a444ff6bb87f0a8ca4dcb2507ae5e365d4c7e6b692ce115591a3e025c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab68B4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6953.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit