d07b2c031f2749894e1f552a3148718493d507b477470e9953fa32e84698bfc7

Analysis

max time kernel
132s
max time network
143s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 00:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

157ef31c331de2b0496f135179447374_JaffaCakes118.html
Size

85KB
MD5

157ef31c331de2b0496f135179447374
SHA1

b544ef4e31ef76a518c51e29675fa8d1171444ef
SHA256

d07b2c031f2749894e1f552a3148718493d507b477470e9953fa32e84698bfc7
SHA512

991ba161fe82596488b8d7e7588ad7ee78be7a5c749095f43f455bce34b95420fab2c2c259f9724a23924080be0b880514f46485af001429212725d0fd46ab01
SSDEEP

1536:2+ipVn1BUNqvLKvr7R/FnVmWCUcSo0mjiMpbqqvmznhKv++nPLB1Vr:2BvLKvr7RTSiyuznhKv++nTB1B

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{40B70321-82B2-11EF-B0EB-7699BFC84B14} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434250625"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2248	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2248	iexplore.exe
2248	iexplore.exe
1580	IEXPLORE.EXE
1580	IEXPLORE.EXE
1580	IEXPLORE.EXE
1580	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 1580	2248	iexplore.exe	28
PID 2248 wrote to memory of 1580	2248	iexplore.exe	28
PID 2248 wrote to memory of 1580	2248	iexplore.exe	28
PID 2248 wrote to memory of 1580	2248	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\157ef31c331de2b0496f135179447374_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
538a6ecf6548bf3e05b62ec4d71f2f0e

SHA1
fb93aad9e9ce0764f6b68d7b18e94e28bae6feeb

SHA256
e1e804cf17df2f108d565b7f71ce14fbbcf3c0dde1775f87ead0d0b47f553e55

SHA512
b3b07ca76f92b748f4060628ace7bc33a28c73616001c5517e1d976b587ce40d9bab231ff0587bfbf22ed0e3fb6808fbeb66d104f3288ab9ddb177c7ac538628

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a583c716ed53bb07259deee627ded3f

SHA1
6bd0cc5f0b1dce6a1992dfa67d3ca6ff8bb3ec2e

SHA256
47ae859b5489c5c2a38059f8d15c4ff4480d8bb4c6a350bd95e02130c51f75e1

SHA512
54a6276ed4c93671be4d605820a0e6117255073160773cee5a3df910cf0e39868a49962c3abd09b669cee0ccc4ef1dc8e7380aac9389cc6b40b7837e3e2c15fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b18d4670859cf3bb225428feacf9b79

SHA1
3e3e4c9cc96b09b7a51c27dcd55b84781300bf85

SHA256
4a7aa1c9b32170dc2561c39beafdf7a1c41a3b22859d751ad61ba6ef6876bcd5

SHA512
d69a166c4d94f6445f0142ba493bb97566b19e672da877488c00f98100523cfe20c87163b6bb45ee130df0a666da9d73cc9f777e945308193ed9397130e94914

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
464a697029fdabb54aad5933c93d7e93

SHA1
445623b872f39f6848087d03d522815f474a781f

SHA256
3bc418fe0f3c2263599a7542d14ee8707b3727ac38f7f0d9b34c061a9edcd4fc

SHA512
3a09bfc2d2f4305fe851368492bf0d9bc029bf54bbc890ed7cab55dfec68a25b74ca82d5d302c4ffa27f7537cf14d005145291eefc55c2b8f6cd3ef2d1becebd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a5231fb91fcf5fb92c44de60de929cf

SHA1
881707da441e59d9de068ee48e86fc3d5ec2304a

SHA256
4090b1ba97d3d97ae72e34ab977f2a810efb7e22724229f7159301928db2108a

SHA512
800af02d514fb90ab11a4eaeeb0c18d0bb202fc6b0254fb720aebcc1ca3cfafa49845d198aebd59842a4b4f0d1dfe168cc4e04413fa313c26ed6708e409aeb35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ac481b1453d8d814f624f2a020e7f67

SHA1
a74b5fe6c6a846f290caf6f45906a2d05d5d27ef

SHA256
afc6e069a69bddbbfe3d2b3f06793cf5304dd1c2287859ada6b95b65f7c16628

SHA512
9ab2720e8a1a3a765e9a201ab9a222baceda9980a87b1ad1a8f1e4e29dc130aa024673b668ef1a2122ff9690ad2d234f1bcee4a94d3e1f5ce4985ac656fa3887

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c8cb59a159081949eca46d0865addaa

SHA1
2359e34ca4fa0017a20e106014df82997b8b6b67

SHA256
f849ef7c636a23550282e889d980066886f5a833052941424c5907f68e621713

SHA512
84d6e41384dd6cab85943015aca95308f529333ebbaf61c460824d999c7e04867fcb8323c5a69838f59ea9c951f763fe3dfc4bb21c0e7cc05828a79aa7ad6944

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d18b5b7f38b9694b1f55561de0894759

SHA1
014f052104455b4e831767c4118eb2eae93ffbed

SHA256
1fb0443ee44d62b7c69a6da747e8869abee9d9fd7c5a6bcbd42465f9370d3d18

SHA512
586b7abcf5c45bc5a3dacb527835e464b06b15c96dc67553b6bdbc6d7c3cfab49d18116c96061ce8c452d13f0765c8c30ea3c1cd84cb95e55302f3ef8ae07598

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
212189a96221fbebc405edb8ba494f60

SHA1
df22246881715aed21d480d1ddeb9f56e208cc9c

SHA256
b6d9026509d70ba8acb5c56057154ee325827aa92930d394bd342dd80198b7f7

SHA512
e0f0d1ae9408b6e9804ce27b8f7336c60055e6d634922827427a4bafa8023d3a68ec899fd13f16b44760df84132a067e15518d04cdefac7882e741030fe13897

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAC0A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarACB8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit