bb43b6d0b925bee7bfd195b6496eed5bb408cd8e6dbb30586ba6c085c0cab6b9

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 21:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

423f55a58617c3ba13f62c629f6b79f9_JaffaCakes118.html
Size

11KB
MD5

423f55a58617c3ba13f62c629f6b79f9
SHA1

e29233a9567ab2c826f2ca0f080611c4df9425d9
SHA256

bb43b6d0b925bee7bfd195b6496eed5bb408cd8e6dbb30586ba6c085c0cab6b9
SHA512

18921c6c7303f783f5a27bb4e6b25ed42b72098d229b20efe29aef3a688c008c8d0db23f5e6508a01b47be0108717813eec80a9921c0ffe9d1aaca3af532ab28
SSDEEP

192:2ValIsr0r57M4QxaFT8IQ/w1wvqa11AuBuLbdU8d:salIcIQ4QxaNQ/gg1AguLZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435017887"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AC82B491-89AC-11EF-BEB7-46BBF83CD43C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2100	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2100	iexplore.exe
2100	iexplore.exe
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE
2512	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2512	2100	iexplore.exe	30
PID 2100 wrote to memory of 2512	2100	iexplore.exe	30
PID 2100 wrote to memory of 2512	2100	iexplore.exe	30
PID 2100 wrote to memory of 2512	2100	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\423f55a58617c3ba13f62c629f6b79f9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2100 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33bc191808dace74700d33df4a93aa76

SHA1
396918005a47e083215b231d3b7825387dd3acf2

SHA256
4cde7de45f5f238f0e0dd7d4df46af1d1d134fa2327d2d8680dd3e6d1da47260

SHA512
39dbee207f482522a3a3a1006c52a0207ca5316d22bffbc9a84d4f03c404bfcceccdeb8d84a8e6d4012b0a856bce5d7217d2df6e04d7d8864363230169688d57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed5b4a381625d7801a57140626478a85

SHA1
aa67810496a90db1a9a7283199383801824bfd2c

SHA256
a1e07f3a82a4f6f3a2e26bf41e1984b6cbf7c918392721de4aaf416eae96a8e4

SHA512
7133d402ce1f20f82b75d2407bbe310fdc539fd32ac1dcf67324934531d0ed5d3e6608a6d9470a403205a912a6abb82a27fc5d645bdfcd760a4410d195f1e3ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed233f7a6d9120f1f91fc2f92381fa56

SHA1
ae094acbd4be1d23d89345b675db782b6d95eecc

SHA256
abc98c83c173da679c7ceae5987033fb30a22e91206286120200237f295a6dcd

SHA512
3a4c9da2726c125d4efc5b6b30a4f6a1159f5061479394bf21b3ad6c8be1849482f833745696b27da975070c24094e7780a89d91fb7fe3ffef531186dcb78117

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c9ccc7036088730922911afc5e7a3e2

SHA1
527f76dfbbdc747d59811b47bf4f8d58012b820e

SHA256
27ecbd2b4df500c362187b305cec5ef4a921672f5b56b32057cfb8cd3afb8a03

SHA512
fc180c865cc5a37ad0cea5f72be69420021a42e0be7d78bca423df92d39a11337577f704aefe9dc8147cbe6934a550035712960577d7e07d819a0000f0015c0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e6ed8e6c42605f9e5238ea9020cb74b

SHA1
264876efc695cd669c4a3cdc2211c4e1b271c186

SHA256
4b87c2181f24db2d5b86504bed7768daaa68418818bc6260e277e7cb3f31ac23

SHA512
98479f4917fb8d88dfbb9b143dccdd1138585e95a183f073f429d6018445c8802879e89b83e9f334f37b37a4edc561b141d593d06983807992ed7b3b05d9efcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b9361f478b68cb77849e3856e6f567c

SHA1
2878c7477ca93dd2f6451a8fe36ecca1d6582066

SHA256
93bb01ca0c5afb72e09429c4fd84c84f9c45284e78f4249ee24d4d32ba659d83

SHA512
2b9fa1efab8246e0734db28a0a15fa3db046379cdf341bc27f0fa259c76b51e0ef93f66178ffee5819726be0e8668692ebbf70737a0ed97983da30f995bb0bfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9fbc8eb44ac4abdbca69bf2cfebe94f

SHA1
3feef3f9044d2c2ea52b1db31ff7ab674497524b

SHA256
d079c0c9e019a323aca9a8624ccb6339d3d32d525a2ab3032ca339dfbb227d2d

SHA512
b7f2b3be97367b6ffe53b2b5c42b3c2b61e1fffc3b818fd6392717c0fff2a177bfb40c52c0060cebeb05739991ca0ecd040ddf8520c1f889c68d515cf1b7c44c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
220c490f1bbd35a2a78007cd76487f33

SHA1
8c91e147bb42f85bf9fc338f998b5ad3d586e2be

SHA256
6ba4bbcccdd7a45ec82b1b743a4d6144b714832679e487316f5fda4567e2bb27

SHA512
de7c9647ec0f58f325e9fd1d24131e22c80452c363c7c37c268d0767620dcd565b193e25af48a447a1e5fc2e1cb5da041c3a21fad03ab98f21f55caf11675be0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
597435db0433bef77e4b911f192f7166

SHA1
357f5d5b9c91f220a4a65df0cc08d220914e2ef8

SHA256
a977112d7c6b58bd46df373508bada243c72a55a3d5b0dbb4cb20b3e25a838e0

SHA512
a6c91738d68ffefa4dc56527c3a48be8c789f182ada1ba2cd19dc40a504f4e1c78728a3a6bf274c9938c033a0903b2d13dd4aaedc9b51e88d229dfc414a6f2e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA66D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA70E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit