b56b4c4adbca195d66f94b19d2f3f7e161e2dace85478c5a6ea2d4468f4da496

Analysis

max time kernel
121s
max time network
133s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 19:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b95efc701eb443a13c650c2768447b8_JaffaCakes118.html
Size

11KB
MD5

3b95efc701eb443a13c650c2768447b8
SHA1

1bde1b6a5443191b740d532f62dfcc250669922c
SHA256

b56b4c4adbca195d66f94b19d2f3f7e161e2dace85478c5a6ea2d4468f4da496
SHA512

c6bd55cc89365368151969f76d7c646817c523bce522e7b8f6c07a3291c8f86e179e137cd29819bfe67cd29373f05fa845cdeccf7b04eb389e54d954ebbc77ae
SSDEEP

192:2ValIsr0r57M4nxauT8Ix/w1wvqa18LOXuBuLbdU8d:salIcIQ4nxaAx/gg8LOXguLZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{50453711-88CC-11EF-95F7-72BC2935A1B8} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434921525"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2636	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2636	iexplore.exe
2636	iexplore.exe
2624	IEXPLORE.EXE
2624	IEXPLORE.EXE
2624	IEXPLORE.EXE
2624	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 2624	2636	iexplore.exe	30
PID 2636 wrote to memory of 2624	2636	iexplore.exe	30
PID 2636 wrote to memory of 2624	2636	iexplore.exe	30
PID 2636 wrote to memory of 2624	2636	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3b95efc701eb443a13c650c2768447b8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2636 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78c322526ed6bdf902d0582f280385d4

SHA1
951308731600dd399797a7512bd17bce76e708d8

SHA256
d48b91c4f48d6e6e0726311abb3cc52c4a8421350c5202305b9203dd9d751f64

SHA512
d2cef1ae78ba869f687294866a67110392f48a4a27280aa059da33fdfbe8a32c7b1d2568984feece7690f24f6d94561c666c25d01ba7df5e12df11afc4118980

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e272f6000662e7896c3701645891829a

SHA1
d5942ea4038fe0b811fc591abe15c878b9961b17

SHA256
89eff774aaafe1b7b68665cb788dc98b975d2b9bc971843515ee2ac197469531

SHA512
e2cc78d69b964188f45845af555e69d648029a724cfed108adda02f12e24d3775d026f46396820a38d022d1c276390dafc42beaa961d237c1f4ebc2edb962213

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d14bcf4617974c7e30037ea8000769e6

SHA1
a984581fad5874497f1addb5a2db047b383fa01d

SHA256
6550900330381b5fc9c9dc67047e143977433eb1292dade4d35d9b32b1bd922a

SHA512
c311c7873f83b2bd4ec635d9b7bccf6b73854b896a178b40cdf8a1f50ec592629e3fafeabe65ecbb11c3525e4c7d5b744ae09996ca623a7bd6b4f45f4be22cbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10fc6169a1b8f29e5f27a708d18dea2a

SHA1
2454c6c2419722e2fc8bff6938ac2349450f5044

SHA256
561c5358ab892ebbaae8938f0256f2b22a37c7ba82b42c7140286a17d118e563

SHA512
beade50b4f40c4e6522106ed922f94a262d67820d3716663c0c50dd7e4a586e0ba6ab25f228dc8db861be728bde5e521305d3671313e8df2e9eca0567e2051bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1879b1030d69be316ac6e0e10a3ea963

SHA1
34e12fdbec2249404587723bad4aeb6f348294da

SHA256
f949ddd4d47e61c0e719e8368c0efe38ba15136495a26150c45555112afdcfac

SHA512
13e8467e2c16eede2547ea92fe22352363a2ece67fd56384c578379c9e4f1ddb2e24f7b2c09290c1c2ad392029ebe411057162171d9a19d74b58929f62f6c585

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad50dea7c913661420e5777f7a4cf01b

SHA1
6dca5dc9b4d8ad66c43328d06d96e25987f689fe

SHA256
c90ff6c8c4916de3c6dc7d64fac65484eeebb94f9c0d48884e3da5461eb928f1

SHA512
f167fb3277d9a35787eb256b4bde10bf898bd3ea6a26f3719e256944de63120127009ffec8d960f3b05fbe1f07a4207d54268bf34be2cc47e9780faa1f33cc85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4af19eee66bd6e172d55f25f9cd2ed8e

SHA1
e18803276fa40f25a2ec56cd492a3cda53d0a81c

SHA256
72f55adba675fdb91a40a709c4db5f079de97d2289f618a9ea2236df629aa5a2

SHA512
8a038e84f8984df33d4bdd2c29a047d7d74bc8bc7ba8f31468db9cd464f491be442652a4ff1850d8294f2ee9d7212d1f589738e98f8298735ac48798759aae98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a38c023efaf950e13482368de98a7a92

SHA1
b67c5b1d949699e4850f58db48abd18ffc6a188b

SHA256
ddee2c3960579be3024d26e4eb419d55c708b211c46f1d7b5e1c048207c87f06

SHA512
01063522320d32c8db8b2d82b8dc78cc259694ed2dd312a18fef0fa503fe21f1a847afa24244e52ca41d5402a43f57755d59e4bbd95768284c9fb5f16c64f43c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94401a5d8bf04f3cee373d1ed9e4deb7

SHA1
bd1a428ab1612dc1dbd486a30b88cbb1ebe92ea6

SHA256
2323517eaaef16c12673750f9777a0e57aba1aa2f0d07aee828d76c2cde6219b

SHA512
65f6a63be2f4598db15a59d050d1b87e2e22bdb6a20caed848b0685a46fa167a4f8847199c180e1669ecee3fc0214adf7baac98a0fd5f8420cd65bda7d012cb6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB423.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB4C4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit