4636b2b671ef0de59c490cde3b81940d678fc40ad9438abb0bc30cffd763b2bb

Analysis

max time kernel
132s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 23:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15610a89722824068a57d4377a5d592e_JaffaCakes118.html
Size

85KB
MD5

15610a89722824068a57d4377a5d592e
SHA1

f297a66e1080ed3b880366d4adb9e7d0aaefc1ca
SHA256

4636b2b671ef0de59c490cde3b81940d678fc40ad9438abb0bc30cffd763b2bb
SHA512

306898185bebcfb638d09097ce90878f427068354ce11737e58b542158e23b67fb733fbba886c9a46165a7676a7a049bbff29b00411939ec04c4aa068ffef61e
SSDEEP

1536:w+ipVn1BUNqvLKvr7R/+nVXWCUPSo0mjiMpbqqvmznhKv++nPLB1Vu:wBvLKvr7RSMiyuznhKv++nTB1k

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434248006"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{28433E41-82AC-11EF-9F10-C28ADB222BBA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2412	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2412	iexplore.exe
2412	iexplore.exe
2432	IEXPLORE.EXE
2432	IEXPLORE.EXE
2432	IEXPLORE.EXE
2432	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2432	2412	iexplore.exe	28
PID 2412 wrote to memory of 2432	2412	iexplore.exe	28
PID 2412 wrote to memory of 2432	2412	iexplore.exe	28
PID 2412 wrote to memory of 2432	2412	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\15610a89722824068a57d4377a5d592e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2412 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9291ce847e665788df1a01bf0efb80c3

SHA1
9f66c4ba82dc8683c29ac5fa01d498a58146682e

SHA256
08b163115c83f38322f82678ba1e10a5a9d5c0befd90944de8ef4b053c7b6875

SHA512
a3f5970e72c698975bfb1872d2c56f419efd463563aaad4eeac990b760999f9b63091963e5209e7f4efd503fa0f895dfe6620db5b30af16823f865c5ab19c074

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2c3922a5fa5d4d507176750b8c381cf

SHA1
cc777fea5af32d7349c57a8daea15bf8d6aea4f0

SHA256
07285243f6f1c596c508780541e98619db60908a4f729ef39a7728b88fe797d2

SHA512
96240eab09d3cd373f10afd6f510f1fdaf12730753d09256c4d9b249b0f0aaf64de67b3fa0fbd4e43d252c57ab41b07d59679339f6c99d967105ecb110175aef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a56bcb799da3b124f671da35ef0a645

SHA1
a10c78616aa4fdfc7adcd45f810d9f08cd206ed6

SHA256
8dea06df27fa75df134640a1832dcba2e311178479ddb1b4ed144e1fbc809229

SHA512
155d56141bba8db8dbec9b12c3dd1e00a17efdfa19e3f714947e687b68be2ef9f177131747e73cbd83da70d0e8098779ad737bc0d0ea6b8be585b0417d09f372

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84b608b472b12c32eb9a03e1e9b51d6b

SHA1
1e21e51c4518514dd59849223811c372d17b813c

SHA256
78a6788ddbe0cdc88e36751ccb261f48e7c575c93ff51b3daf7998b373c9e1ac

SHA512
834152651d634aae017994d3e0b9bd8a67752246e766e3bb0de2d9d5d8492c14a0a301d797d510bd5f7ca86129dfbd74a1662a8a2fec3327a9fa36a6575d1917

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6e90670098c3371f31b84ae772c7847

SHA1
e9de5198c92e677e040818ffa166825484700d93

SHA256
f06ed6a714f790b7eb763ba035de618196b8bef968306a0ebd3d4cf79725e5c7

SHA512
034357481f20a0b4145157e0de0f6140ef433d255858cd3c63e6e25ca43bb3be1d918d6cbaef6e5a76a3c558378fe924f232ebce81edab49c00c7b71040de671

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15b35dfe23dec10d668331f533a755b6

SHA1
4bc830503eaed9f4d593727baaef1c970666fc27

SHA256
78ad493a7e9355236c60912d035357e36af4bd378f0f5891a7fb6f2003109fb9

SHA512
af2906c2e5ff228d0855281d74cbe3702e52b3f2732226ca1d7f675372e8a96259a2ddc6913798ca0f5ff3185635010bf5afbec8f0c15890d59d329a6fa2ae88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d029ac8965d901cca50d3f8799a085a1

SHA1
6f18ddba6793318f4cf671c85fcc2e92503e8a00

SHA256
d296f468e998302b3d81c56ea974c9fc968a09d72811236359234830eeb83854

SHA512
97a77e0857a4a0ae271f9f55b0cda0584ba596e21a309fcbf5326910dc25f06996344f6296ddf44007d4d377eebbbffe324608e235ade0793ed45365d323f4ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c905088b0ee3673b1175ec76c7b71a10

SHA1
8fe934d8a4e96b01754a18d6af712ab0ee38d29d

SHA256
77194ac174b859b8fef0f5319ec1f1545d2f3aafd7e0003dd2beba37d50d97a0

SHA512
df5eb93cbe3003dc5ade93d8e52acaf201ac00086a8fc64c667aa436d70a709a5c4a364144da137936c4e792aec45ba9d6ea6cf7c84a52db63b3539931978823

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a9ff27b8225509248f4c9d732ad9d29

SHA1
bb01ca3a8ba97255cc671a3c674abb92cda75f65

SHA256
cfbc997aaac957f91dff50605b73c41500a1362d885ad2b4c097bb8b16dfd7c3

SHA512
5fd0b7ff82f4093ad4d19311f8c944e0d3a8f689f4cd1c279b0756f6a428990792659b224f82f10341808a0edc128e0ca665fae4aa429822cc1196d897f675f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7FAD.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7FFE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit