d29b49d2b54c8fa47e07b2e0eff52678b2d43d9cc0491d5f4b60716eb6327967

Analysis

max time kernel
132s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-10-2024 23:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3762465f9ab13b966592951e70006358_JaffaCakes118.html
Size

85KB
MD5

3762465f9ab13b966592951e70006358
SHA1

f31eb61d97a2f14a06fb74c543baad5680e02ea5
SHA256

d29b49d2b54c8fa47e07b2e0eff52678b2d43d9cc0491d5f4b60716eb6327967
SHA512

d5390ef89b8002fe1a06a5621934b670e847a425b88b9c162023137e5eb3fe8fc2c81b0aa6ac662c9b2cb699a17efd993b6b68c908858cfb72a9747e8f066b00
SSDEEP

1536:w+ipVn1BUNqvLKvr7R/fnVaWCUgSo0mjiMpbqqvmznhKv++nPLB1VF:wBvLKvr7RliiyuznhKv++nTB1P

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B7572101-8829-11EF-A8AB-EA7747D117E6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434851689"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1480	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1480	iexplore.exe
1480	iexplore.exe
2396	IEXPLORE.EXE
2396	IEXPLORE.EXE
2396	IEXPLORE.EXE
2396	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 2396	1480	iexplore.exe	30
PID 1480 wrote to memory of 2396	1480	iexplore.exe	30
PID 1480 wrote to memory of 2396	1480	iexplore.exe	30
PID 1480 wrote to memory of 2396	1480	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3762465f9ab13b966592951e70006358_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1480 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a58e97ceaa59d2860a374e31791f99eb

SHA1
f5cde4aa0c223535f4b07c92e19e6b406df8f3b3

SHA256
85ddb0348ef261810142fabba85347dadeefa912cf59aee037d92248c954b372

SHA512
a77839dec8f83408772848c1b8fdb1cc5cacba7afcd14b281d17688a1bc0ae5c03f9182cc2947e552f00e47af24e4dc5f8807ad487c6aa0d2674919b479e215e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92a6f46ff5aa61ccc421dde4b4187f6e

SHA1
9f4db62691f39b81791d3b3f677201c7b11ce32a

SHA256
0a17a463719b790f90083225e2aebdb02be525ded007f34a2c60fe477b1127ec

SHA512
5361e282e6d4744791b0ab1685cdbe55d161994d9d3c8e54fd83eafd5f1256f0e9ed48f3b85008d4fec56f46e4e277d742f0d6a58c56dbbc637885eb87fa6c0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07f27c5be9795ec25cf0af9f9bcf5868

SHA1
53937429d70163e7c3580396b348f9e1935d44b9

SHA256
bf0ed7fd40fe45bd5df04aed471924771dc117ef1455946c14a960a61e304ee5

SHA512
68894fdfdbd7dc910fc06853ba071b543d2b22458d1be8a63562d75b0f2e247f93d02aea4beabfe9f19b36877adc9c1d09e3024027d354995a435bf7186a985a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f7f7316d2485891396f4db77c4854e0

SHA1
d512c5efd0289d48d2f8a3b7a637a9a1214ed395

SHA256
c5ec176a52b4bd8898ccc874d1fafe01de058938b4245caad31f35845df090fa

SHA512
34074ac5ceb5e98a3638ce0a62df933818ad18e392f4c97614cd1cc9272d81c55da742aaa701f7f6c512a98e9494831a52d43e76b9b23073e1ad7a6f0eedbac3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
132c5196c9a73e3b6551027cc0eedcf3

SHA1
7b8813d4e8c2654b9adea820b4edb28e553a2bb6

SHA256
c5aee34d47d8661973196f16078355248ee37caccf47eca75eb8d6d4d6fbb71d

SHA512
9c796553c521fcd25957a80d3931f0b94c38223a4ebe5d31ff1899d6616ec69dd27f1d451fc1aa6d9d332727521c850908c1f52944eba4e84d421bb8e8d2ef82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0a41de1bdeb5df4a61737c89efef92e

SHA1
3cb7f5856e0e3a299520f006d91f61a509a4d441

SHA256
ba6fa31aa7c9d45dddea33ad8a64bf9265f887fbe3dcab68e0c68ba3c9ac8235

SHA512
92ee066e00ddeb6c4ad48d5f3d81fbf1f3fdcd9f2552c3d0c07cbe92231ead50c37a75ed0ab9e94621d711c5986755ad624b800b3070190ee45fa6034ef7f5e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6abfc90a9fb8ba35ce1602b3f105225

SHA1
aad383d338a1a93e3824e53c30004f471aa08850

SHA256
50982f9e2c709cb5eb511002bb6b46f851941e9c6744db0a64404dd11faa1938

SHA512
09efc90bdd07a8f58ea451f0fb5061472560446fdc7d3af71817c4eccaf928e4939a3ce66cfe32618ae730c42bb24bdc9b879dcc1f969c1b693135ab677ca8c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19c535563c6c46a3a83576b87e03f6eb

SHA1
446c4c03206e454454cc53230aa42c0e189ddc81

SHA256
20d3a5ca8b5a4da100d7b2bab39b7f5afd80ac54c959109e58a945ba15a23d26

SHA512
fbeb716f99b42b3969ed40b113d1d1f6841cdab3f2e38dcc36bed860f3b04f03def21ea1e72e3cd63d24416ffe757df36e4e52c44d97b65386e062172f2cb8f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eaccc61a1c2fbcbbb4572fe6bcc62e91

SHA1
766827a48477e10b0c154cc4ce47d10c4e515418

SHA256
71ee4a92666b412a0ea8d5ec5e481a8ea41f38efc0144f90ae1447ddaed1ca4b

SHA512
80c4984540730ef229ae0e9ee36bbbd1b26a62cd9d49facbb2658590a28fe8adc957a2409d35f08683c00b08dbaec4f5b14f81e0273b802dd651ceb3474890f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC44B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC4AB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit