e7cb2f5b7a7b83a1a8e640d1bac311a91b7c53862a9f03fe08fa59f8f47b9662

Analysis

max time kernel
132s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-10-2024 10:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

173a1fb7f8733b92753bc265991fc2e8_JaffaCakes118.html
Size

85KB
MD5

173a1fb7f8733b92753bc265991fc2e8
SHA1

09dc64d3aadcb1493c58c2d5869a36b08dc36d01
SHA256

e7cb2f5b7a7b83a1a8e640d1bac311a91b7c53862a9f03fe08fa59f8f47b9662
SHA512

e64d62fdd800ec2ebb5c72e0a02e75a6e3e9763ff72edf0a2444846f5d369c9e01c68447c26b2c880b81f17253744eab18cb1a11a50d411250ce08e86c0d02a7
SSDEEP

1536:d+ipVn1BUNqvLKvr7R/8nVFWCUTSo0mjiMpbqqvmznhKv++nPLB1V8:dBvLKvr7RA8iyuznhKv++nTB1q

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434284348"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C52AA641-8300-11EF-8320-E61828AB23DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2544	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2544	iexplore.exe
2544	iexplore.exe
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 2112	2544	iexplore.exe	30
PID 2544 wrote to memory of 2112	2544	iexplore.exe	30
PID 2544 wrote to memory of 2112	2544	iexplore.exe	30
PID 2544 wrote to memory of 2112	2544	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\173a1fb7f8733b92753bc265991fc2e8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2544 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7c33a9816553984df831976b56e2f8a

SHA1
a08a93c65810541ff7095a625499a76526e9d618

SHA256
792c8f1f771784cd27922331db47ae18836f76020a1e5f7513b16e5abc038fd2

SHA512
e778cb042890fcdc24c7569fce786961e999f1f2bdad00034d3eba9d0375f9c1e6ad021724036a29bd10485cbe45af43b1b3ebe8fce5306d7cd4029f3bd6625a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26b4182faa220cd6673af9b135092821

SHA1
9c9ecc60506b431c047b347e5ca3337d1c9b23a6

SHA256
b698adc89ca9032d5ae873460493a0b5267913d24e3f66f2ecde931f276995c1

SHA512
4104328397ec028fe83fb943010ac5168bccaa6e8a06558272dafc0951929d13d413274e20d0b8787d9a611d3158af016c12899d95d1b7734c16257b6af9942a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b73b31c303b2030cc1c686d7625aabb

SHA1
21dd7908405e744bf3ce6a89df30a89037828b36

SHA256
17f75ed5fab215eaa0b0dad08757d8262fca9ea0f379b12870f2cdf2d3444653

SHA512
6e5e7b4fb7f18fab3a955d68508ca0eb555dc68dedd79cad3853f2e710a284c6fbac1672833c6615c21d7e709bb36cad389d652312c4c86b875e84e5bf901b11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d921811612a983f4c356d8d718bf667

SHA1
e766ba9c010216af0f63d1906c5dd8e313dfb7fe

SHA256
c4421fc0a69a89122229f7e2b4d1d4c2b7fc699551a1721cc2ee39520346c75a

SHA512
07763f1835e3becc7bb6f7f66a7b607f2e6b95e62493287d87b4b22989d2591eb3c8a208f17c451d793ba7abbf98af7b8442b6fe37a8948644ca39e4e577af31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a2ec0025ccbd56b5745539dbe5199a8

SHA1
587a4fb10123642a689600df273ba5cde3d65ed2

SHA256
70eefd5748830174c47f1184c7b58e839b2f3cbdb3727ef2cd7b912f5e050525

SHA512
bf1a222ae85f9eccf653800452176ef779fd8df633159a752aafebe2ba98dbea2c1d4774d9cd3c673686533c32c60f491c6a3e0063c90b43ae80d8aff6e0f521

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfd4b44770869888b86a7c140bc5ebe9

SHA1
772c28b475c47b7f12e59b48ac450eb8603f9479

SHA256
73c8370d69b802d51988262780d61ae074ad73cb8b8a46e7241809be6944398c

SHA512
208bac813f9bf2ce9d3f7b12961bd0ef32ef6a0b846e93f5b38246dd615e40b32f80a9743c5f1f63b8312eb6e8583bc9b22f4434563403bb170f4933c2ebd617

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
525591462e41bf216de65bb89dde02f2

SHA1
f75fa57f222449c41a3c0dbcef2e79e870264f6b

SHA256
ded7d630e7f1cbaf4fc30f2d2d34650300dc09daa1508776627f054368ebbfb6

SHA512
2dd1fd1a775b1f96ee0075a4c460b9930dc94a91bba2be80c4600b86cc3b7bc39a7f47e08f5a64fae48b31f29cdbb756b93177e670cd3661e4348a4eba183961

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f29cc836a0e3a380e483948234736def

SHA1
455f805f84602bce4dc9d463d34e339e3369bea6

SHA256
9f04741797d1e5347f82e997720491f61329c05769660922bdfdc430d32457bb

SHA512
5d2e3dc8e1ca7b5fc7bc14c8def7c830c544b728267f31da9ea9260e127aaf48ffbed606ca7f6452c321374891b8ac3ffca04e4a549a14081586d8fb208d0869

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a253fbfeec634ca29cb56510cc781cc

SHA1
5b28da3d1dbef992ad152cec4bc582cbaf4aeaf3

SHA256
6b57a4791a29328e2b3688dcdd116ebefb3b1e0d4392c4335899360bb20b47b4

SHA512
ef60199c5917f4ed3004593be3b0871596146c517f0fb1df1131001b9019873d7d72a40b7c10ef527d4c4ab20370414a7a504040f7170790c4cad62fb30512da

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB108.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB1A8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit