7289e823c5b94a3d13db3773dfb4b2e294dbd59b49431950543db2386ad62ca8

Analysis

max time kernel
119s
max time network
139s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/10/2024, 23:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

376dd290a6459dccee6fd9bff4a060a0_JaffaCakes118.html
Size

11KB
MD5

376dd290a6459dccee6fd9bff4a060a0
SHA1

b502bb41bb4e2e6c8b2c7fe45902dd51a84dfdce
SHA256

7289e823c5b94a3d13db3773dfb4b2e294dbd59b49431950543db2386ad62ca8
SHA512

a978818eb556c9738253a2ba0b3d370e2b4c89bda0fd64fda2c4c135890db907256dfe0e086eecb27cba7b9cf0a016a06cc3959132e93e845dfeb55a1c18dcc9
SSDEEP

192:2VclIsr03c98k/w1wvqLkZlB7Wn6vBKmd01Psw8uBuLbdU8d:sclIcuc//gulB7Wn6vBKmd0Psw8guLZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6E0D1891-882B-11EF-98F1-4A174794FC88} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434852426"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1684	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1684	iexplore.exe
1684	iexplore.exe
1052	IEXPLORE.EXE
1052	IEXPLORE.EXE
1052	IEXPLORE.EXE
1052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1052	1684	iexplore.exe	28
PID 1684 wrote to memory of 1052	1684	iexplore.exe	28
PID 1684 wrote to memory of 1052	1684	iexplore.exe	28
PID 1684 wrote to memory of 1052	1684	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\376dd290a6459dccee6fd9bff4a060a0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1684 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d042ae9961a159d6b4b90506dcc74c9

SHA1
e2978a77128f8802d17729e0fab043b1c023705d

SHA256
2fe573fb984aa187d791dab6dfba989b247759392ace4bb6c4666ff842c0b145

SHA512
171058e36dc475bcfeebc1b8906b2312a208dc92a476867865441f1ce0eb82ed1eb89156b671f0ca60b3148e6f50c53536ccab03f222a4127e152be2c33bc52b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35b9127853166548b6bd21b2937a6458

SHA1
f05b31fc67b2f1a21a3bf7e20560c0c6ffb44f9e

SHA256
2de01868378bfed7826e0c1f207a6738b0ae0eaf6cb54875fa813a4a08775fb0

SHA512
58b8ef12d74233a4fe7fae48534a1e9129028e695d669b40a7368cb332784447f6ef4a00d727c525594fc69a1920bd22935fcd6402d92b5ebb8a24c6bb4dc958

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b614700461760ebf49da1d2242c0506

SHA1
6392776dbd6793a40e7dcda82d89cd4d9725e409

SHA256
4f2d5be6be58072def7621e0b3eca3a397c25dffc3e4dc9005c08894a9797ffc

SHA512
22ba737f040edea773124f3818a9b1a93f9b8e454933b632fbec2ed9decc833495804a1b141ae94f80307114e2747ab40adaf31b2f78f182defa65a41a0779d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e96c6afb7a11f19b7cd870e90d3c1288

SHA1
d5d9078b97a4ffbbf42423eb497b71e5cde61be9

SHA256
35fbf7e32f72bbc556a2ff5e96695b171f9a9e45866353ae885021d834f85109

SHA512
ffdcb1d7f52ae2b2ad158431dca91d682a657036589897bf15845ca312029a5110cc37cc80be877784c64f0186b956ddbff80ae1cd62681c3ec0c77be68ee231

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83f2b3fa3aa1014c449510cf83bde4a0

SHA1
b862d5ab67b120c90bf09608d9a838b5ce5474b5

SHA256
f6d39e7d6d66e8c2c5514b02530c0fea7bd6eb0a06db15a38c9557c0dd08d2f7

SHA512
7d39dd711b88160128ffe99d3429238e348a20a6a603ee0d0b11f8cb54630c6c0cb0cc38400fd8de708ef36445c874e66d04cd61a89f686d88f00933e3c22923

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ed7a2acd76459235b3091ae51a3ea6c

SHA1
c36e0321585e8f272049f460f735c506114f1bb6

SHA256
65404230b5fa7b4e81670808b9cf0fe78928b0dd8d1260a542466bf0ca41058c

SHA512
ffc5263ae12f703c1b35d8a7e879234a232b1338723bc41eba887b71dc7a760ac9b276bf70ac6cabaabb1c83c40f326a4f287032d07b6e068e9365a758dfbf82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5288ace4641dd812530ff5439726890a

SHA1
a934c47654262948770cf9e5523c59c4dd219aa6

SHA256
0d22d8c46dc157f567956a04c2522d496cbc730a4e1b10c506d284f642bafc7f

SHA512
198f68d4d2dc3c27f236d24abf649a39f3dbc6ce1685da11beadb0f05ff4bffd87580a8f2cd1d7bd817f587ec07125d52ce866716e664349516654e520287c72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c0c2c3e32374d6d62449117024fe0b6

SHA1
bc1aef8e4a409f0f3817a347550feee20817c3d2

SHA256
8f099146c67102a78b37b13d35eea0558890cfe67490090d2a07981f76df2428

SHA512
04298e380e629b3afd057557591871b1051011eb0c3c88a5aa15b26ca521f3ee0b19d3dec73965c1784065bb906c54357a1a62e094358a9362ee8b4e9343f94d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
655e4a7d926a369f0dc057afb704aac1

SHA1
f0081bf0992e06e88ccbdfd3f5e7968fa07d4325

SHA256
172db13a8e5bf86fb167c35aecd486b2ead00419affef6386b6ed60e5e02d326

SHA512
5a70f29bf64469a3cd807acc40355393b62cb747be2be6eca264cc2788261c425377d8cdb361aac34168dcfd0ca7c4644e583b0843a7ec51652ef12c20e44261

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab54E6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5575.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit