0050f9fccd88c21984dae0db5deb3cee17c46bddb560a71706df7c7f957afcba

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 02:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

15bf53d7ff268dd6994401939b7fcd8e_JaffaCakes118.html
Size

85KB
MD5

15bf53d7ff268dd6994401939b7fcd8e
SHA1

68dcf796ee0359f0d7526aa499a344270c9bb9c7
SHA256

0050f9fccd88c21984dae0db5deb3cee17c46bddb560a71706df7c7f957afcba
SHA512

506af692ad3fdef58cce940a00cb11d1a0f1c24cc9ff48960ed20cacf7507aebc89623ea9be3cea1bb8b928d6e45355d03e37664448b7d14f3bfb06dd09ac433
SSDEEP

1536:v+ipVn1BUNqvLKvr7R/fnVaWCUgSo0mjiMpbqqvmznhKv++nPLB1Vp:vBvLKvr7RliiyuznhKv++nTB1n

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BC168BB1-82BE-11EF-8CD4-527E38F5B48B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434255985"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2336	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2336	iexplore.exe
2336	iexplore.exe
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2780	2336	iexplore.exe	30
PID 2336 wrote to memory of 2780	2336	iexplore.exe	30
PID 2336 wrote to memory of 2780	2336	iexplore.exe	30
PID 2336 wrote to memory of 2780	2336	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\15bf53d7ff268dd6994401939b7fcd8e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2336 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9388f163e5d9d94adcf1df857b52bb50

SHA1
7d7f649dec28848671b8f6487c20cd063cec488e

SHA256
342553d0808d7d406d41caa30dcc28e29b591e9f1f555f6a3a68308388b9ae8e

SHA512
c973036aa520d550c3b275908167c3c4cc8231bcf5f3aa5477057a8c753d06fe6af12f8d91eb0f687e78189f21bbcf06ded69c2f17f81f06a0e6523abadcc7b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc04d98fbfdb8c35283ba0bb2c49c4d4

SHA1
996a12a2a15a5ae8843fc772ca69f5dfb5727161

SHA256
77844d79d0a6df11dd19045487b46407a64e52a067ed9da7c9fc453c1fb93342

SHA512
2dd93662cdc77a565653c1ff1ebcfe76715202e9272757e159fb58cf81b15f2f58094c39034fd6d11d6c87f5c65156aa2ae19c268e4eff1176b68052c1ed5306

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f88e6a6a85abfd67f3e5765e75b04988

SHA1
12f8a244cef2b745e0523bb601360a32a30f8502

SHA256
7ae793fdec6500c4e7c71d76befd3218ef3753a8b1416b988b30ce0936fa454e

SHA512
8e591b341aef0fdd95e03e0b4be0b59ed260aea9beecc7a4d0c7d27dbf33d1484b83cd3cc33481eb1b8ebe6fede40c71e5e1a7bee28ba474be647b22a1f52230

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
088d6b8d3a238d3f3b7f527fb62a976c

SHA1
adc0cd78fcba03940cf081bdf88ac1a3c06f3c7b

SHA256
60a2371c8d43cdb6da32c0b9680fc71d4d5ec9cc197753631b28d3c721071102

SHA512
47a6c113d2a7feeba936692ac31b40190a0a155e1d595435d77c3534f28427d2a66ce4d00e64d4261d1eb42e5a26c914f51776bcbba93d3cc2a3c3f757a92fc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ac518ebe8047e44698a1956bd40f9a9

SHA1
1195b01f254e04b4b02b00c914e843e6335a5d60

SHA256
ad13ee1905409a24c374c575621b3523070600752183d2d35f08a06bba105db6

SHA512
097d92ee98d8f347891ffbdb11240786a1583176b4449e3d19201649d3ebb6d1aef883b753f6891c686afd9a7b8d66db6f255b91d9fb6c4e2325a2cd5d75eaec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bdaa616da48d13d0b2a5baa85c3751cc

SHA1
12abe6ef0aa419b8c95f6983494be051444f146f

SHA256
2b21f26e2a983c22090f16cb2999094a7c285c69c6c4756aa2f5d3d0a1149f12

SHA512
f54cd14e41ab69a1916cf5d10f82ad9b7c0b14d8d1a03df00153531f43ce04a04820dd2a9e5747d1f98d39997ce64c6764b1e88b7bed85fb5ea5c9be3c0a9d27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fdd09394feb7a5a38e63ef315614d35d

SHA1
e461d055aaa8cfe113dfd773a8ebf4cb2cb91f19

SHA256
e30480a49a27a5f3d999f85f56179a2227773c2357027c51abd78d1f8debcb66

SHA512
64930bbd0c8adb8c2c94522f056ba35518074178a4c4566e349b021ecc001496de864584ac58892a104d79f3e7bc3b87693519477566a94b0ec0553871ab270c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf250ce44506718c62eaaac36494ffb2

SHA1
7454284172d815f8f7dc0a2b4e8c540ed96f4526

SHA256
7cf7c6fcbd9ab3b242baa692ffc1d1aab6913523cc7c23ef331d479c8fcd919e

SHA512
5c11e081675233d285fcdd543fc7e2e30dc30cb6407754e18ba83cac8b06fc0a8ac5f9dda9ae665919c9d3dbb298e7b151be0290248aa9924457e244b509ac3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb68eb3cb838f3ee0077961891282ac4

SHA1
7e977d06a46592c41c77f2dd74d5b5ac349b650f

SHA256
9744a5a452a662027930c634906e7dcbd4b7cf8d5433372194068b53e184e688

SHA512
6bcda22acc9f5a0ed15d41f96123365914d1d52dd68e0d85e1c6c7e4d80fef85e9e3a24ddba08cfcf5b13d0b8dbc96a5940f42c78985ae472a7127c4be7f0e36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b916abf12eb7069fbcb2d2b167f31a74

SHA1
199ced37cd72c15b8636345a2b4d8c334a51dad9

SHA256
5860d720b1bd48275fdaeae6d56c505d020820d491d4de7f5866aadd8d9ba369

SHA512
2e50fa78ab2a8456dc7aa5a194cc0c3fd437dd4574249f2ed244f670debaee956eaf6c72787a23fda0d3ec4e796fc5c4d8f56f9af38b20fc359c9887d08c4b6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2ABA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2ACD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit