967db95e346f2bd88bec6c17448e79a5d75e7435abef5aa46668fe2390234049

Analysis

max time kernel
150s
max time network
139s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 00:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

37a5cb7b111e66d6101f9b8f4e51afbb_JaffaCakes118.html
Size

142KB
MD5

37a5cb7b111e66d6101f9b8f4e51afbb
SHA1

31338c41128c491c4abbc8dcba1ad83420cb2552
SHA256

967db95e346f2bd88bec6c17448e79a5d75e7435abef5aa46668fe2390234049
SHA512

e582c781d847bfd1f856811c41057c25b5810debcf1d3f4a4504c734f52f284c0ea89b0c1b5523f0c7e407542fb92ddc1f2a7aa02e52dc0f92f78acaebc61508
SSDEEP

3072:SZKAAVTx7dyfkMY+BES09JXAnyrZalI+YQ:SZN8x7osMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DF5361A1-8833-11EF-8CD3-5EE01BAFE073} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434856051"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2100	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2100	iexplore.exe
2100	iexplore.exe
2096	IEXPLORE.EXE
2096	IEXPLORE.EXE
2096	IEXPLORE.EXE
2096	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2096	2100	iexplore.exe	30
PID 2100 wrote to memory of 2096	2100	iexplore.exe	30
PID 2100 wrote to memory of 2096	2100	iexplore.exe	30
PID 2100 wrote to memory of 2096	2100	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\37a5cb7b111e66d6101f9b8f4e51afbb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2100 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
071fb1621b5d297530b4e1f0a7e9a9ad

SHA1
72cab65b36b48a57ba748b5433628c0d407cb9e3

SHA256
99281c01b4eb9a899deba496b5ac104cdcbeb9072c8b2573d9c462337c7bf86f

SHA512
b41d3c62980382550de87042e873cc2f4a40c71e152a1651ac6186580f541aba0e0ff31f782c159cc2ebad5eb3c99cb96a365aaf88a6405cc9c951fa42c88056

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c198145ca585e0b1467c9f361cfa4dd

SHA1
35414cf993144f346ccbfae0c3f0cd57c4987e68

SHA256
37c5c7cea40b6724b4d30b3642d2eb79cf8d67d19f2897c88f5a91b936bc85e9

SHA512
2734c23b8a7cbb3430db2cdba275a6933fb76ccd94e2029f1dc5d89f2c730bfbc997a30f32242c4d90f7c482c885a444e275b472a1789c5811d98f57785204cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e1df731c5023c4d0e2dcdfaa1b422c46

SHA1
8d9e63684c4bc42d86721e5e2accc3a9b811d399

SHA256
a2ad349695c8bc0875c40fa179ab3a1e1df4c6cfe7e179bd1072bcb46382a6f0

SHA512
7b287ac0bf9b395bac583373975710ab908b0d97b16ea7ca191e3762e5dfb4dbf03dc36a3f171b9615aba0554481d0682df4a05920f670d89209d2cabf55800a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f7657c2515a693c3f34c5e18c19f4ab

SHA1
037157b84f282013436db9935ffd799be23d76e6

SHA256
a2dd7f83c6f235960dd3c24b248c7a0059d6a18a6bbc49439c717531c2e8978e

SHA512
17321093e613f9b4e8cd500514c58abe2fcd976323dddd3b26955e748ae633c2f90a146cffd13409bfa31f7a0ddae831e85146f158151c63c67b78124be5de6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9319c925aff0fa5bb912e6367b1e5c6b

SHA1
52ea2fe99496fa1b0686e787efa5cfa18b85f677

SHA256
ada236c2dedfc8b1fc3aa8de3439293c98f487703d4b8c80b7e5a6753267afce

SHA512
f3d93dd1a35c71e42129ef3447ff5a9c3b446f118109945fff464be21cab6c20a4204fa591155b1003b6c65981957cae8a22146964923aed5c56101992dceac2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05515b521223a65538ce7118ed33aeed

SHA1
5d76828e1d27b51bcadd9a039c1ae98e68fceb9c

SHA256
73139830b155c98216821e9e244632321d8cd391fdb9e672db1238d5c90ac938

SHA512
273388d5bc86fefe9776395108adfd6dfc510bef71afc7b8bf44146ccf49961879b4a145ac694f20cd4a317e922bad86c5583c063645f73abc2a0a5c119e50f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff69f978565cd7e00756a09d75b9142c

SHA1
bdc6a1abbd1df6bded096577749c4dd1f4e69f20

SHA256
53a8f7fb9881f62c419540102e6960c46731173b6e17d742e2afbaccb349d288

SHA512
d48d211293b4ee8e5033449d34ee203ae7884d3f55eaaa711bd857653102ca2b6ac84de43b0428d0ca628b6bffbf7b9f85e7e446c4221aafbcef69552e6810c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9b52c4e28ecd833b9e7c668cfd8a47a

SHA1
6458b471770c3160e22bf32e7673110114a8b9bd

SHA256
7a5f97a03905ae1d27bc016849b1a0acb00f5c8edd7eba720f8541e129aead0b

SHA512
ebf35cc4b85a55a5db6b18ae3b8af3f08d79ee34ef057f1b0287a018653f28bf09d46ba34b6f5a143b71854a5523b09b9345fd1273ff0e0990c40618bb9cb5ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6847dd947ddd77cf19b619fe45555ca7

SHA1
703e6c4e35711a1267e48e8d772e9010ebffe539

SHA256
e9b1eb3f631888e4cd8a65176d9b95a2c84aa97c410a03d37738e7b744f85424

SHA512
167e80cc5c5874f8259284f7bfbe62c5b77e98bbe959b5f8ec5d9bcd3eb1543a18aae8a99b7651a956ea317f23ffa287ff7a4f7f8fb2829ddc427b25ce1a0adb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab86DE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar873E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit