73fe3573b5848acd7c696fd8a9759c3860b5e13cde675e1e497a2d0f1a782fd7

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
09-10-2024 02:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2917dd682f4866061cf10518d5805380_JaffaCakes118.html
Size

101KB
MD5

2917dd682f4866061cf10518d5805380
SHA1

2fd79e1221b9ed47405cdb771da16f09a4d0cf46
SHA256

73fe3573b5848acd7c696fd8a9759c3860b5e13cde675e1e497a2d0f1a782fd7
SHA512

b8788357c8c551d509d7a6ab86c6e007907a97787e953ec595f756315a339e9e4ccce7c1def5065b60c4c1d92947b97fbaeaea31f704c00e70a87f9b9143fb30
SSDEEP

3072:SfI34AobzIwbBac7LwJ6pSWhnkaX0TZEVtHx6ca/pAI:S0dpAI

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434630689"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2913F8E1-8627-11EF-A4C8-72E661693B4A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3004	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3004	iexplore.exe
3004	iexplore.exe
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2124	3004	iexplore.exe	30
PID 3004 wrote to memory of 2124	3004	iexplore.exe	30
PID 3004 wrote to memory of 2124	3004	iexplore.exe	30
PID 3004 wrote to memory of 2124	3004	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2917dd682f4866061cf10518d5805380_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3004 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e6517d1736e811bc3089624a295d69b

SHA1
d602587ad865182c130ebb7fe0b1831f7ba3afbe

SHA256
7e3cd4963debd14be6279d3b50b65fadddabb1bf1e6ba2e149128db648fbecff

SHA512
39e6989e342100c408f22433651f2ab598589eee48b9ed9ec6fce501d3f6b387897eca5c81ab002247b8ea51f97f136dbe75b55f44cc568bcaf7fb316360a2fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4bad85d0e27b2f7307d004c680590437

SHA1
4a044a1c3b32a0a13b203aae46db8b2a5c0c0916

SHA256
95e17bfed8d4140669b14102852eb0d4798390e27f6940d723ad5ce15ac21c33

SHA512
b96d7bb47611b10e5f78442fcfe78f425e19082cc404762d47576e1ed35d7f7e07e0b0f8d5648b3e426bf1a9e344f15c17b89da872f21a784ac671b4dfc369d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a743da0da0e0f015c64f0f12b3857b6

SHA1
8d3a773062f6bda1e275b86120b69ed4593fccd8

SHA256
e99bacac65916c1eeb707510008ccebe9672aebc7719e54a2ff3f15934dceb67

SHA512
dc9773ba0f0ad1b9e08ee109695ffa5f61b616c6509ffe2899a2d052ca2af667d2c1e901497fb3dd2f289e729509ef9c78a4ed008a3df9555a78a615d4b1521c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f6d5b70bfee29c12a6bdd5363d7ce41

SHA1
cd05d643449e135309ce722eef888cbd7e720703

SHA256
3b021d8e507cfb6a5ef8521df00686ddb682f271768e0f337f79b58c3313af17

SHA512
a9caca24a3d6169ac980c45c1c8b92197d2508a1a842952a38948177a8b2c62418454a3caf38dc3e9adb292fdc55b2b30086500ca7a931599306aa189e819ad0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
330aa0fe68199e6561460bb4c2111bf5

SHA1
449da4960e4fd33dddec001441697bf2200c2298

SHA256
763fb6fcb2cb456a35379d99df4fdc81ff81c63d91a819809648bd1e8939445c

SHA512
0fef8f07f707a8b25f254918d1fa49e1aa55e18b43053f08e4ae75b186c5c5202b1fc2d3894f2a3e04106d0b9bb9a7d5c5f5a2af2e4c65772f53fbfab1753b90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e15a4b249028ef855de9b0c528f8f736

SHA1
59c1a91a8f32778a758d2f9e0d9762cf0225937e

SHA256
415ce85a4d8fd4805a6a5c8036debc3bff6a642f7d9e8b56770b4a51f9d8232b

SHA512
a31ed64e0da4c8ed6cccebbd128ec3ea6e3867ab336c1c864d739895d8f4ac17af121e2a3d826bd2d1b6f0393d905f668664606d7dd4978e5673d451d8f72b71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e89e364ffac64c21f138bf0eda3b4e06

SHA1
39c7dbe83e4d6f2ff9497f975ec6dc77f96d701b

SHA256
5aaacae5b588a50512d7f19c81fc88300e6392ce27ab864c6835f3eb192dc429

SHA512
e185cc8c169b0a5a7661a5f5d17720dd4798ec2573b71ad6aea7289ff3b17788dfd68a12e66eed008ceedead70c6f4b440a1fdd36968ff80ff6a0e7643a7c13c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a64b276f6ba5d3813040345dc2a94c2

SHA1
651e4e59c0464e8fe2bbe2817464d0a70663f775

SHA256
fecf71cd5fd583f47c473fa1e6750ed7f5926f150c973451e4a07c5c8b3a552b

SHA512
cd384bb363f0f92605fb536de1fdc7ccfd572abfce802193f75a502d993edfbd32a3db002587880066ae52b0af50423654f7ba43c5c4ea451a7bce7e69e7689e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6b9fe8e11f7d6c4200c8399768560f6

SHA1
23744e15aa8b4fc47626b0db615631e54ec8df99

SHA256
e538c4a888809eeddf779bbf1b29f2b4cc40147547707e095212c838c5bc641d

SHA512
fb9329a4b54f881449d2fb9ef595f8dd47cd34816a9328bdbd29f4551d60267fde2a02f2aeb67d982a336c901b355f85e5afe9fedccfd3e918148f4fed4eeaa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB73F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB7A1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit