26e17a35fb0492e6c8d77032995ab6a8a3db9737f0c09c56fb2e65171f50231f

Analysis

max time kernel
133s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 09:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a1a6adf4348fb46525f1275dec55e0c_JaffaCakes118.html
Size

56KB
MD5

0a1a6adf4348fb46525f1275dec55e0c
SHA1

67b4f6ffe9aee3969876b7fcef65be0ec6ff53fb
SHA256

26e17a35fb0492e6c8d77032995ab6a8a3db9737f0c09c56fb2e65171f50231f
SHA512

815950794ef19b59c89c4979b1c1f97a14e379ac1d9ae4564e1a77ee68d2f88aea168e5ea952ae0cbbfe5c7faf049eea0b203e34a83f2dc9d88df5c83ac57c25
SSDEEP

1536:ujsD3NwWf9d6jIG0kJx5pOWecOE16dBl1NSJA3ZR60kP:GWf90hNJx5pRecP6dB7NSJA3ZRLkP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1474D941-80A5-11EF-B4B0-E62D5E492327} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434025065"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2416	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2416	iexplore.exe
2416	iexplore.exe
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2940	2416	iexplore.exe	31
PID 2416 wrote to memory of 2940	2416	iexplore.exe	31
PID 2416 wrote to memory of 2940	2416	iexplore.exe	31
PID 2416 wrote to memory of 2940	2416	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0a1a6adf4348fb46525f1275dec55e0c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2416 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
43a12a038eeeb3a038fdb8f9493a5a89

SHA1
cd3ee6cffdbaaa21a9385fb7ac69760a73de2259

SHA256
f094039b4ea66bf8a58f7ffe28bc6084d73f6e1bfff1eca0096869569d5e7e98

SHA512
1e7b589a1ccc24114510eb411b338d93ef49ab272e22bd7a4595c282b2094c5f5922d1d361c939b8790a194e69d2b62ca844e336e35540dba62aa9ea0e44f8cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd8d95a5eb1abf48d6e7f2e7f200fb31

SHA1
a8246118aa946aa14257e2d57740bd8ab316d461

SHA256
782b72c3858ab6adb7096018086fe07cc0d2648e476e1fbe3b7ae5422ecfdcf8

SHA512
e4e42c9ffcba4c6ef6fcfa174efafa1127ce5f97f07a926c730ace238c76919c47f8e4646c5f97e7081eaeca8a561b03c47fc03beefdf114c41a59ded5b635a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
567ec1c0b7615ad9658f34eebfff8e5d

SHA1
89131c7615d2e61fca214b7ff23aa08620cfdc7e

SHA256
d8a862560cbc4c404987cc5a250f5ee9f9205afc9c7bc562b48b126c4f0a40c5

SHA512
3e5a2b70a8907758136906d901a936ec390e93cd1b87f8d34a90b8dc9dc810b341674f995d1e851a1f7c4e3128fc5b508e1e56f6825fc7bde5747c698fc743ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7256bfcc2b3df3dd17375e16b777959

SHA1
0027205c9470cf7359764a59e1b89eeae735a2cd

SHA256
1c378d607e2ec4a9400ed548b9682be429edcabe47496354bf2e12f7066ffa8f

SHA512
4994d45c4e86fbb27ec79fb198a525a0f98f75835ede20aa8a9281889850f29c2cbba01172a191127b8a11bea337689cc5697930072f29a281eb2c7b5b88714e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eea391e36ed787518f4ea201f9503da8

SHA1
48cb8aec14ab8fe2b723f04fea0b4aeab3d0c52c

SHA256
ac4c2c47f905154a123e46ecd625e92ee95324bacb944d08ccdee4701d9e72fa

SHA512
8efb6c78b127c6e54ccc7d7c5a649675c118123e81b35efc23da288912c0035f4bff7355646de4999c2bf22e60dc8abcfff03fbcf9e43d2e45892db8e71e40e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74f09baeadadb642e2fef93b45fcb9ac

SHA1
a0155be27d085b2b1c98ea3fa39c02ffcb75e36f

SHA256
36820a277ca6686c54d473949403dc269aa6db8dda746e8282bcf894b2f90b5e

SHA512
186edf0e01ee831d81b442b946a320cfef1b43e977cc659255023490f5364b8117c444d2e6954cc1cf05f9a7b9be4a412969b2da223d5f81714738982ea24f2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7688f6f0dca81721a71cbee5576e485

SHA1
5a670a48cd3bf8d2c6a5e3697bcde96e8e091e76

SHA256
2962f5694d630a304b1d13b6f333461d26565c029dce347bf8309b9db09b9c89

SHA512
24768b2e59b725886ffe8aff3c8673bb1160e2a052af17a7bce46d59543c0f7901675ae841fb25bcc15d3ac66dcb1bbfd343f90241b77ff41ee3793c8f9ea478

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c981680141eb2854c60680d2fbbf7631

SHA1
e51181a0c9818840aa7790c6c34d975230e39cfb

SHA256
2ae520da9c86f1029257eaca994feaca83405f8482f4b0318f90dc68f407cec9

SHA512
224e02456eed0f1ee5c614901e5b65e5e4358898807aa83be43c24a2c679ae392ae6645c7b211b2d45b2738a0e67c38d8015dcc26ebb53a75f851bb91a0746d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d10c11864a304d6989085492810b2e84

SHA1
031eb6e6e066012f38c0b85e7cc02fed03ec74d8

SHA256
322b160d79827720e5189ee1459bd2db0a5f61d7ba45cf9dcc5ab10c5a28206e

SHA512
6348d2c5484937d21fbb96e47018dcf3557259df4e6e77dcc91b0f2c91d36c05922515887c11381892f500aa28e2472f5efe3ecddd98d94f7b04618589257748

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
f7a44abbb674c0074b4b8aaa565c6353

SHA1
211de9d3f24e93dfb48a9e6d6d3b1d5430abaafd

SHA256
765a5c810331faa96fabca0deb66b2188b26fdbb998bfb5cff6a87241918c2a0

SHA512
ccda5570a6434b7cf2310dc712b66ea22efc86639bdfb9af39388417cefc04656e6c3a684a9b6ba6369d8fd4a4d8b61556c9927d2c142f71ff7faa7f9d807e3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD970.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD971.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit