718a7992b6f5b44a783957872427ad27c77b6570df2ea4772d26735de77a458c

Analysis

max time kernel
132s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 11:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a665dadccb216c5e48dc2455a7b9bb0_JaffaCakes118.html
Size

85KB
MD5

0a665dadccb216c5e48dc2455a7b9bb0
SHA1

1b957e15ecb9364e64af80b4a17f9249ef79a513
SHA256

718a7992b6f5b44a783957872427ad27c77b6570df2ea4772d26735de77a458c
SHA512

f9928376fa9dcee4659f8ff4417bc15d74f54e0b4e0acb5a58c48f3cab73b223096bc6f887439088edf8125760e286cdb9e9d08f2af14324a50f81cba697411f
SSDEEP

1536:L+ipVn1BUNqvLKvr7R/ZnVCWCU4So0mjiMpbqqvmznhKv++nPLB1V2:LBvLKvr7RfqiyuznhKv++nTB1w

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434029975"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{830866A1-80B0-11EF-80CF-C28ADB222BBA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2192	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2192	iexplore.exe
2192	iexplore.exe
1804	IEXPLORE.EXE
1804	IEXPLORE.EXE
1804	IEXPLORE.EXE
1804	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 1804	2192	iexplore.exe	31
PID 2192 wrote to memory of 1804	2192	iexplore.exe	31
PID 2192 wrote to memory of 1804	2192	iexplore.exe	31
PID 2192 wrote to memory of 1804	2192	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0a665dadccb216c5e48dc2455a7b9bb0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2192 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18892660800b3ebe07e276da619aeba0

SHA1
6752fc340157b0f0e635cf2207c24ccf4830041d

SHA256
83723553eb96b753711c8a0d3c0171f46e7c0718e52cae08b3a941d16dafbb2e

SHA512
21529f1beb749b78acebfb5fb54ad026d5a1039dcd2d39344203ac959c3720605e7bb9e4965f02ab0d933ec9d9ea2fe1f577a965588910fc9aff93649a31db0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b4f6fd10aa00a5bea2e36df5f0a0498

SHA1
8e28b78e33c1ea48dea9d702fc65551df0e79c23

SHA256
c33cdb3fe9d17550d43e525002d227ca62622460f738dec481f8f2ffb6b8194f

SHA512
8fab0db8bdd3eab61c2630c91726ba787a71a3088972e31e4b28e00a17327d2efc39edb523b5a837861ade16569de70626d479838ef4fe96b7f66d1a59e2fc7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10ecd3ec5271e5b1f13ae39180c48a4a

SHA1
921eddb2005a521d64e6ddff237f7cb972e429a7

SHA256
2aebb83406833dab56b418dfa26c08bd376ca58a1b7b64d8b3ed9663de96d32b

SHA512
169b65955c0ad23e629921673d682e05efe50b572e71258c0dbbc3f67688d37d2a58f31bc3eba2921cf2c3c588fb0e471aaba2ec22ab739cd6b925c08a7d517d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cf80967a22425667019481a56a2ff9d

SHA1
a11be3774285b0338068b35c95f7bcba7db52bc3

SHA256
7d5511303faed8a8d07fabbbf17a835b806c5b85a9ce48b117412525b12f005d

SHA512
3bd9475dd46fcba74c986de755136cf8a355d591359a915c7e789e2bd023b5cfb2079b40029aedb1bac8d3ca256fd7fa9a90715e552697ea5b6b7e6d36c41046

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b732aaa87837e49cd060a78a1ba51d95

SHA1
37b2ab9d43b9b21c096c2972563af0c825bcad8a

SHA256
4d33fb22ae071c470b638e9109c91a618eda4e226045f36ae9232b4c87aff96a

SHA512
e3d7cd0a87006b2d7490d0d76d6bc283d9c61b38d61fd4e8acec554870c5b9b12f413d0939c30e00774623720824d0b0cb623dee77717a37e39cde25fe7487d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebe3adfabea2d7c1f11dcc3c76394192

SHA1
42607e1e789b9c4e96a37a5d1f736e5cc31d01c3

SHA256
f4b79ff3ca25ee9f371def4f5742d847d6b9020f6c9df2458fcc7375e6e58d73

SHA512
ab7daf8360946ff06fa1f386b1fe84f52690383218fbe74f4cb3e6e09120621de7b3a3db62c5f12bb8ce619f735f3815204dfe634f82ff57e0c3756c51788b8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4808b09e2bc26f520ed117ec677daa5d

SHA1
d1f30d0f1e948556a4c0266315d16da2ca109bc4

SHA256
9929ce6dcaa234f8bbf0ed593cd6eae1165ecb26b7ecd2ef3fc27e9eaabab96d

SHA512
1d47d7de2070548432bbc57088a434e6cae7c8d0002575fb01dd057ab6a793af172abafff6459c91a2a90d2573db5a4968355672f34187e64234591b4ac0e2a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07e2fcd148bfda672a8c44e40744a338

SHA1
8faccb6dbe9f895ab338b5bf3b25459aeaec947f

SHA256
08b75ed69a75216e7c7d019deb5c81296fcc9123386fc83c7e52dd5417e6f672

SHA512
90e355fccb46602c7a5aa3582f5a93b31dce1644ca4e2a9b0bda7fb22c115dd62c8f44242ba17413841ad2ed211ceb718bcf89a526daeb77484fd256daf1622b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92f61e0cfb8bec1e03d05cc544c70daa

SHA1
0d0c32e92d1b4fe6ad0aa685b153189bcb077a3b

SHA256
75e4c097aebf3c2a7f9401a9ddc4af44322341e07304ddb75b4097988a9be313

SHA512
a77e3c951af39248db527cd693dc486d44a05f6d98be0c6ff0935de4734981d6142ebf805f31ede0b593e72cb14c8ff0293e589cc92d1bed3eebdf85abdadf8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDDB3.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDE43.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit