b4fcd6c9b55cbbe98504e7ec7eebe644b226cfd330007df88e3ddfc20c95b7be

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 04:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2ab7e53d27ee9d56803d270651e9a2ee_JaffaCakes118.html
Size

12KB
MD5

2ab7e53d27ee9d56803d270651e9a2ee
SHA1

ed441e4cbf46145a7b3d61e89f8bad2dd930e278
SHA256

b4fcd6c9b55cbbe98504e7ec7eebe644b226cfd330007df88e3ddfc20c95b7be
SHA512

9cc8db125f16d3ca965ef9e20797bc153c1c5b9924c2e8cc657e9523998979c36c08d9b6902e3a801df776fba0fe7a9b9c31b4ae86395763161cf542b4f52712
SSDEEP

192:2VmlIsr0KXyJHVCoN5Yp8k/w1wvqyOBNZ9nL+EXg011AuBuLbdU8d:smlIcMVNjYD/gcOBNZ9nL+EXg01AguLZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434642881"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8B76D3B1-8643-11EF-A207-6A2ECC9B5790} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1992	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1992	iexplore.exe
1992	iexplore.exe
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2100	1992	iexplore.exe	30
PID 1992 wrote to memory of 2100	1992	iexplore.exe	30
PID 1992 wrote to memory of 2100	1992	iexplore.exe	30
PID 1992 wrote to memory of 2100	1992	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2ab7e53d27ee9d56803d270651e9a2ee_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1992 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
949f44f6f3caa154b433a65d1ffc05dd

SHA1
77f4ce24b038e4ad32157b3d025706ceb95b2918

SHA256
da79015ecebf42982f674d2ce295892dcc304d5bfd52075d8dd8be5599ff6523

SHA512
cc03344aa1f2ab1eee10ab1296b48fec4a126c6d4e692b3daf52a4cf61e5c298e9b79b7303e534c6cd9740c25658a959f83f2e74cfec3b7e09940246b686e9f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7e1b180068d7f138f4f450ce868f585

SHA1
c77ce14395488a5ab544143a6c307d0d5f3e7987

SHA256
df70b74ba450bb24724c9cc70b32408d45838443563c02b3ef8eb3ba46db4458

SHA512
cce13753c9972dd2ba0ee97e0fb57e4bc0e93c35c2c94a73c87bbaf4912e98b1d43fb2c548869a8985c09a3643b03015a348d3ba1a1df1c25d7f139743f49668

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
956e5f9626e6439f0d7d5c8c90f65b6f

SHA1
754e6fdd1386af99aa90cab03d12cccd98675a31

SHA256
fbbe0c290f8e5a3433cbd76127f268b7c68adb9bbe93932d593c6b28815d7642

SHA512
7b3d1a42357fd493578b3328b313bed5efdcc466d1d7e6be6cbdff0a3ad356ffbc1b7a57c3cf0701a96a9cf5ac487c242d88d94bebd2f301581add7749c98a2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf5829db85c102321790dabd8ffda153

SHA1
2f0a0ad7ad0180b05eeaac4e9d846bce02d5ed9a

SHA256
bd69674a5dfc8387ac37a9bc103b90f59ddeaa8da419aed32abaebce4af50e15

SHA512
6c7a91f3ea133e2f5e86e92a8644e89fe25048ccbe168103ba9863290e741f3fa75f9dc3980e89b8a3dd925498e9d027761adccc30e7d9e67f0a3a42f6392946

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed8801eecc2b9c2653432a9ff1f8d941

SHA1
8a8cb8e287bbc9ed19f5ab37c3f0836b062cb328

SHA256
e8f13e6b6517e1adf53bf11788d5412f8bba69554b80060a3e786884183919d4

SHA512
907092143d5e39c57181b0fb8ae160a9aaa7432b9b6afe8c7783247bdf0ebf69f255c38265bdcad384585af5b440227980c9d62ffdb9b3b0b45989da5d807830

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7509e98b527851f12e21be83803b16e8

SHA1
a01c58e4b486e87d68b1eb18f26a4289b611ecf2

SHA256
5b410da11d654189d6ea5dad5b1471ccd1e14083a46ef7142a189ffe15469dc5

SHA512
3a7adc3f1eb7888759e9ec4e1af10a141d9df44e27d2731c355106e3ea7ad150b1938b64c83400bdbea8446408667ad72aaaa4daa240c9d1b86589f6f197fc9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41e9ec6867bd5b33234f989d8e41f3c0

SHA1
bd09ddc9e3802e8c70e25780cbcb2be642b9bc6c

SHA256
fca3df864ca6ea10777a7fc8f525b98f1dbc3bca905160059109ac3011a25f94

SHA512
fd4d969b83b224d92856984e100060bce79f5b76a864ded832fc9ead040041ab45905b70ffafa3b6cd493d442aee2a09babf7088df0aee015826ab9f7a422f14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40e59c9071090a179aebbe8c108aef3d

SHA1
4c6bab6b2d91d3682c05b187baaaebb2c3fddac7

SHA256
aa82c2416cac83ec6d4c7169e34881b8669da905a731f68ae389805db6dc28f5

SHA512
a49f01d0a268ccad0716f969d4db8835e84724d461644fe61ccf0681792216c2eed9f7f7af19243df14dab4c85345dd81a31dcb69a16fb7c8f21b7d593fa6ba6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
800d30e0a3e7b64d1820a00c56dcf56d

SHA1
0a04d261503a3f01b419130690da45e99b0b78a9

SHA256
67a2f3972c288030de7d1892e57feab5c12ab000542a3e0fba26b2749e754b4b

SHA512
44d7843d6786bea0e5fb1b2dc9d022e7ae420909a01963e2c0f7faf7bb5df7a3d31d5d9426549a843fa3db35382fd5e1618f5ea5d307b2b64daab66ce1010d31

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBA8A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBB49.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit