9ee8929eb863bea6f3a4b35ba7d5b76ac4d9f5305feaf12944f148222a5615f6

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 02:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1166418400c27a5b6d1ab396e9214dfd_JaffaCakes118.html
Size

10KB
MD5

1166418400c27a5b6d1ab396e9214dfd
SHA1

d5037b38d55237d0ee61ab5b067c2692238476f0
SHA256

9ee8929eb863bea6f3a4b35ba7d5b76ac4d9f5305feaf12944f148222a5615f6
SHA512

ed57192a6867c3c4d7d7a8001014767ee50eecc9d7f2106485956585f7444747022784a3fc0c04432fc7478b061f0593a1d80273abe4004c4b0f753d8c0e89f3
SSDEEP

192:2VZlIsr03Oz8k/w1whqJk1CBKRnfC47Xt01y5uBuLbdU8d:sZlIcuOl/g6CBKRnfC47Xt0y5guLZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{94252681-81F5-11EF-A045-62CAC36041A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434169590"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
268	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
268	iexplore.exe
268	iexplore.exe
2312	IEXPLORE.EXE
2312	IEXPLORE.EXE
2312	IEXPLORE.EXE
2312	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 268 wrote to memory of 2312	268	iexplore.exe	31
PID 268 wrote to memory of 2312	268	iexplore.exe	31
PID 268 wrote to memory of 2312	268	iexplore.exe	31
PID 268 wrote to memory of 2312	268	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1166418400c27a5b6d1ab396e9214dfd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:268
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:268 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34ca319a6c06b8b82737c8cd0afd977b

SHA1
b05590663d4b9589f71839165cb4f3118e71be01

SHA256
bf093813c7980fbea5d9565203ec138d95c5ea57ed47f2a6ce8dec615438ab44

SHA512
a293f6af88aaf01a901b9cd12510f556de2f1916b6a6cb9718f5dab07b37ea0ea84968a76cc20f24813c18e1ae1d64aeff6b5eb970cfb8860589b1fb6c686b26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a39cba6f37bbbc5c31b4dc2f38c58de

SHA1
6748055e2d2e0effd899a788402378850253b6b1

SHA256
9e8ee12723442ee3eb1a2b2ff155fd00eb9555f8b68d2332d2a1045ee16d35ca

SHA512
db515409e81df6b1fadc0093093d568178349c11825268fbb150f9781940ff69bfef8a9abdfc80ef799ee5a0597e57316def4cd03106973a76fc49a8ac97a25c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c847fb650505e1fdf12d1165aea42989

SHA1
be55d1e5b0ad77936ca8bf49ec6375672c6bafe8

SHA256
b857578399e2f61e0f49998c650b863163b11373526d799c43ef7524e4541b9a

SHA512
6a26086a476c933906978a039f75df3fc3d2a57f51d65f9e2dec5faba570fd6b3902d72a91cfe5d591663204a7ed64e357a5d4f213230768b17e6ed7c38824b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
383246c13713c183b06bc06fc51ff1c0

SHA1
f6a535ea0fde4fe6c89746fc009fdf599977c608

SHA256
e4ade8476a4b92bcaa22bb481af754a62d29792647679efe188fa854ee928ada

SHA512
f52687997f5b73af57aae9cff7d006ef344f67508341f8f975955b0e4b0540778ca1c56a3d397ca0ad4071e158408fa8cab34cfcea59fff6a595526ebd74a006

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3079c2521f5ca28000c99908c96087dc

SHA1
24408b12eceb680051876ca3a6573a793784aa90

SHA256
f32b2920eaf390370c31dc77db8946f983b253549c7409b0aa5b168aa952b045

SHA512
cb665cadf2e0289aa6ae6b618484c480dfac958134ed1c6cb42717918ce8c3f45c2b4a798b363b4037ab740258f4e3740637ca91512c829d83303eb223ab3d68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ee1f6a7dda0c7d210521cff7d14ab65

SHA1
ceca94154bae0e463402d62fb938431a6260c60a

SHA256
722000fe7ff87ec1442049ec7bea82d3bf278ce1aaf29566820185e71d06c38b

SHA512
38d3b6f08a998bae0806fe0e5d6c1fb05cfa03677a9f58d1a4b5564dd275319df9842fe0a7b058eed32d5e00e26cf362c04943dc8d3c4215a39009ddcd281b1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbb29b1b3a09eb3fc804b7d9678c3587

SHA1
fc2d43dcd26621488f8d7667e3b48e8d4a0415e7

SHA256
4e097540799b6f5bac73a0e8c8939e25a2be78ab4936aa31696f4e971cd622f2

SHA512
9e6d3cd8d99d521998b0d1cad38e0f1f3c5df174861807e831e040b472618f13f87b370adbe32d9d81933c11ebee201ee6f40e91e9809a59652436bc4a115240

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
519a55b3f1f80b439417033ccd8879dc

SHA1
5c90638605f88e97355ea3b6288a91950f4927cf

SHA256
39389088e5d3d94f35c63d842b40b8d2df5db8d47542904779969803d989e09c

SHA512
8abd0207e87f9fb9214afc90c5eb8361059cb8f42a17e72c1f890ae47aaff0475fa5e5b8dc2690deafbaf990895b53b9d85ffe91b6cc26f71bb4145b2f14ad13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b9b3bafa1d7a78eedb345af622673dd

SHA1
9a9dab3e0d12a6e2a473fd31b87274d984e21c9c

SHA256
87e1a49855e54b84173acd899f3ecb339d7b8090989c5e2ac3236f34997cc2e7

SHA512
5977c00613486037b9da39ec32e0a1ba99ca22914f7d9d2dace017fc3b7204ef8f24941f69079c307ccc5e7a7046adccf1f1b5a154d9501c341936dbeb72d235

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD54B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD5AC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit