a9e57df4354b39ae5e05580fbe73d333fd47f3b4446a7f81d7c0ba50eb77b4b3

Analysis

max time kernel
119s
max time network
144s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 09:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2ed71eb73c7d9d597565bac17dd9b61b_JaffaCakes118.html
Size

12KB
MD5

2ed71eb73c7d9d597565bac17dd9b61b
SHA1

de551e4e3133cf06b28e5e37136cae4238df4af6
SHA256

a9e57df4354b39ae5e05580fbe73d333fd47f3b4446a7f81d7c0ba50eb77b4b3
SHA512

98380c65b620366e568182a92551d631e083e8eeb10687d3b7ca968586fa2bb9534583ab3dc59529254653ef55b014f7b40c2964b21f124b257a8ca6befb39ad
SSDEEP

384:sclIcx3VXjSx/gYcBTZDnBcyZW0kaguLZ:LWg7NoaxLZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434674561"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4E5097B1-868D-11EF-9257-F6C828CC4EA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2388	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2388	iexplore.exe
2388	iexplore.exe
2396	IEXPLORE.EXE
2396	IEXPLORE.EXE
2396	IEXPLORE.EXE
2396	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2396	2388	iexplore.exe	30
PID 2388 wrote to memory of 2396	2388	iexplore.exe	30
PID 2388 wrote to memory of 2396	2388	iexplore.exe	30
PID 2388 wrote to memory of 2396	2388	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2ed71eb73c7d9d597565bac17dd9b61b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2388 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54663932170c3b735ad0463672f88741

SHA1
cda60841fc12d5f7420d141a871584faa2b02553

SHA256
0c7f7ea5977951e15f922ced2af1be3970b998f269d6664119c1d719051d5cd0

SHA512
9ca90ec28cc52d8f7c30e07fe052e187f0f6c6624287a197eb333dda13fde385da98136f652c6c7e36553620ce5ad041eee4d009849fadd59c77208712f42bb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f90d18978ff94460dba241ed1a8ce27

SHA1
3615689067b58fdaea77bc2fb3de120995d86f04

SHA256
8ec60db34487aca868fda356055ec5961801dab083de34c943c2b349903fece2

SHA512
41a556afa648bccdbc8227b9ffa5be13ac8c5a3abd00cc9accc620446a0f71dd892efcb438deab17a405e62a311c2d2d9ab48b2297e18ae4e4995b4262bd0cb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be2dacb66526d2474234a5548b302cc8

SHA1
10ebd985ee426f3a521724708c40dcf514195cc8

SHA256
df6bd47eaa24563e66dcdb701d9b36d6a7d6e29861ba63c83caa95608dc69513

SHA512
1aa7896774a5a43e1a67530c7caeaa54d55c5fa29085a4bcc7c71d96f287ce4c0c4ebcb2949f5fdc7182f72a4f3c38e46f29d20073d652e9580df7a8b36e6fcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc81e38a8dd0c8c67366486a79f6ecf0

SHA1
fb13b5531c949a1396a973a337500f1a5d2bddca

SHA256
825a48e9447ee0307d4f603cd28304e925c9e0d8a1b22afcfa559216066cf35e

SHA512
b5261a769257d0bfb8bb2503aed383ea218d52d245f68d4447dc8d5095c7214d0effff493438d9bda984fbd1ec2395c026eea20baa155c0144ab5298e9d11cda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48d81d0d58d984539d656bb9c672bb20

SHA1
828fa97e8c88a938494a04979ec5e83bb0b0e6f3

SHA256
790649f2894d463b3da8f5ff61294d7853a6f83d0cfa296edfe384b1203d450b

SHA512
382579a37ef02e39b2512343d972de8261ad329079f6dc4af06f02a3dba13853d1588471d4424a7b2934033782789f700a343d59b01f98ddb9f20389a82c8617

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af33d773419fee94f3e270f1f88142b3

SHA1
6b6d4b8dbdaa3e767b6e5112b435e7f703d8f4e4

SHA256
df008344dcc814a825f93bfbc513c05375a5ae15eaf852b70f258e18a8506aad

SHA512
e9c031150f5297d42a0ff5416e67bacf57e5ca828d2c4447461a9a712fdc2b66cfdb5e6f8e725665b8017b71db6506387f9e173c01d7116ea8a578c9deacf01a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14eb37a84154b32d8bf2f59106c556a4

SHA1
ccbef30e331829ee8a885cfdfa3c2078a7b8f9b5

SHA256
c89601ce793a9b9f2782e4650880dac12d2f75c8e0fd640f82009d0921deea8f

SHA512
08012a71e3321b5a6c6956ed07a060fbb1016cd5544548c2202add4207aef01c1d17e63d334f87288e59e5744a1f872d4cb1224e675a345cb033c5acdd857014

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97f6ee061a0a2aa69838056dd0108c0f

SHA1
daf7264c3820c23a09b698696f308c73af68c580

SHA256
2529dcf44303ff1bcc2796493f6cb4cc130424e11873d0cf1599a8fb93b6b882

SHA512
4038a938bbc3b8677cf2275a99a3ddd35abe09ad815ddf518e7d0910a87dee452714e95c81b3890ddde1cb9cefef156a69bcc0a3183cb62cfe214f2bbfc1eb13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc5f0e19a358120b1a2a16860677f5c6

SHA1
817e2f58a19b450ee68dab4fa93fc421af64bc0d

SHA256
f66ca41361c2c5305264d60b89468f0e4efc9738cd7bf637d375f8cda03c8ae4

SHA512
180a913550fc90018208c27f0458f931cd731691ff877348dd2e5fcde71b86564016e94588b03d712857687e8c09bae7c63f12d8d228fcd710b8894c76191db6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC66C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC71B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit