6955542ab606aee5c6204117bd4a752b4abf242b6ad3805567b9f2d9fa2fe76b

Analysis

max time kernel
120s
max time network
132s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/10/2024, 20:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

250e9e9c58292dac607c35d5669b68df_JaffaCakes118.html
Size

23KB
MD5

250e9e9c58292dac607c35d5669b68df
SHA1

cfc4eb67f6ccd4ad7e02b396256e8a07e015dcd1
SHA256

6955542ab606aee5c6204117bd4a752b4abf242b6ad3805567b9f2d9fa2fe76b
SHA512

c047f150c8fcd087b042ecbd716ca43b9979f87de8c80ffb920f21cdf3afeb1d5dedc49361635cdd39f2413265f3b159b6373846b3748733b6c5a42a75c0b423
SSDEEP

384:z7lIcKtZ4zMGTH9JM+ny/yFk++gHxeeEtF9WDoTG4Q/yyGzO/gb5LOXguLZ:BBDg7kglExLZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FF45FFF1-85E4-11EF-AB7C-F2BBDB1F0DCB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434602275"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2512	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2512	iexplore.exe
2512	iexplore.exe
2328	IEXPLORE.EXE
2328	IEXPLORE.EXE
2328	IEXPLORE.EXE
2328	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2328	2512	iexplore.exe	30
PID 2512 wrote to memory of 2328	2512	iexplore.exe	30
PID 2512 wrote to memory of 2328	2512	iexplore.exe	30
PID 2512 wrote to memory of 2328	2512	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\250e9e9c58292dac607c35d5669b68df_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2512 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e80c73f3089b25c255ef7cf63811a547

SHA1
81f4aafb53d3af6b8808a587e574f6ceb8881342

SHA256
76903bf872af8a3bf4003e6e9f90e8a8a657d602df0ffce59bd638dc2e4f4307

SHA512
306eed26108a97d50b7b4a895bfff1587a028e387707892c6ca35d0c6ea08f5c160d3bc095d687a655528841f1754536c36674a66a9d2c90141dff961010112b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c7b1e51f00b7a1a130f6abd7714443fd

SHA1
d0a5ab64543a51eea4246303da226ab4025cbea8

SHA256
06dc174b3ba2b024c7e2917905d03cdd0ee733fd7b314b926d8c83d826a360c9

SHA512
0624af120c6a89b28a6d3063eca72d1327642dbc119cf5c98d107289aabf4e0d04fa514dca515342ccf782d6af7e5947da42f1132fe376da04bc023455243a52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b48ba3a7d65389f139c0ca862822d086

SHA1
f924414c7f10040d3db2305305cfbdbc48cb0c1b

SHA256
16116401437705f1904f65a0823f1a0f29ea99eb5c60d097eebd38ecf6d5df99

SHA512
3b4f7eb0740cb7762da3f3bcc2251b2b535f726e2b08fcebe6706a84cbe39ebe7c55caa57006e2479198d35511d3b345350eefb7758fa0e88583b6715d18438d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77269788cfb385136341bf3647f8eccc

SHA1
51a6ac4e3f7f1c2fba04c931d92fd3df9d259ae7

SHA256
ac18790bc60f1bb925ce568d02ce1247ba204aecc22f170a5d015f3f5bf78a79

SHA512
e938801ba4df6be8a0ac96fed01ab6a78b6ded99c7beb0676a0835456e077e2133fefe06fabcd9d566698a7a6f3780f791b450c356758a2b14f21d08fb4fdb9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86595cffffe5f7b28d863cd00a13e1b2

SHA1
a96c453b10a01bc8d86b797c4cc097fd67f00ed6

SHA256
582a6c1f2176f2d5aa2815a7d341dfd414f9da93bb963ffb509167ffa6fe9f36

SHA512
0b6d294ef630ae3ac5a58e57addd703a690e4edbf86286d3c6f417aafaff9e77cb544249cdce5a92ffe0d141290348234a3f36f4931ba97e4b20af5cf4ab377a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
642ac1bf04a3b4739b0a37cf03003781

SHA1
22cdc32e9f0b767b995c0e50e47440ca15b6d2d9

SHA256
f3bbbebbe8aea132072fcfc277bbd7266efd81c4d30861bcd5de8600c087da83

SHA512
8e789ddf94c57070a2ff097373882470abd5bc6ef7e304e62b87a608b84ab626aa385fd809affa44ec9f2a9955805777cd1adfe7a400e44ca923dabf78ae2f09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99098e45d3c6d8addf55ea47bbe19923

SHA1
76717afdbabe3e0df5e03acde4b8c74e409a58ce

SHA256
9c83712564f17b5b79938df252e8abfbae628f80a404b6118151d40f595d24b2

SHA512
2d08a910cf6f9ff2e32ad6a7491d5eb8793e13968d3eb7187a719830bec0ddf6d1564045682efd4278bae0e0782abb5a4131fbb7632136d7de2cb5bca9aba995

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
755ce76faf7edce5f95eea5b6001aa81

SHA1
1d0bb4f187b225761976122e22c76cfe01943f7c

SHA256
814c64aa01bd0eb87f7901bc23939469b26824b75c301384f890771f2d658352

SHA512
661b60e37b27af5615906d8aae4a7329d0530f499beadf7b785410a359886eda03c6f1cfa42041b23d726b22bc16a57089a3383c613691d6c1e3268436be50fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB924.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB984.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit