4315019cff6552f8854ef7587394dfd26c31549785dd14d2cc7392219d34e57e

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 02:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d38bd22c217bc8468f3a609c355810c_JaffaCakes118.html
Size

85KB
MD5

3d38bd22c217bc8468f3a609c355810c
SHA1

c2d04d9a09793d94734246f21a52a9bc6bf5d3e1
SHA256

4315019cff6552f8854ef7587394dfd26c31549785dd14d2cc7392219d34e57e
SHA512

b0f4794d8fa67416ea5a04bad8e9a763b140ce544afa8a9f818ccdb1dfd138ae7dc8b278e313c60b47a94a1c195ac5d91afd941ce6443eea6f88ddc5e7b36a0f
SSDEEP

1536:w+ipVn1BUNqvLKvr7R/5nVYWCU6So0mjiMpbqqvmznhKv++nPLB1VZ:wBvLKvr7R/WiyuznhKv++nTB17

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{22757751-8908-11EF-9FF1-E28DDE128E91} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434947218"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1476	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1476	iexplore.exe
1476	iexplore.exe
1640	IEXPLORE.EXE
1640	IEXPLORE.EXE
1640	IEXPLORE.EXE
1640	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 1640	1476	iexplore.exe	30
PID 1476 wrote to memory of 1640	1476	iexplore.exe	30
PID 1476 wrote to memory of 1640	1476	iexplore.exe	30
PID 1476 wrote to memory of 1640	1476	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3d38bd22c217bc8468f3a609c355810c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1476 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
774008c52dc179cea33b8c29b492f909

SHA1
d762a9a11f567e846d66c381994edeb2d7754445

SHA256
50ceec6e056a7831eac42285ed57541a40b6a697064f9f19d19afff0d0e39f97

SHA512
35e6c54e90862569663c596ab89b5f139854a28e67a56d0b0e6ee284d3273da9d9f6b5990364a3d100917d5505a3772da4a7e3a3425ec5c062579839739d1ae6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
398905fc353d76738f4681bc8f3b776f

SHA1
077bb64c956befcce6e762e12c9c8a3a35969796

SHA256
2161e38fc83acf727fbfba567fc275d975b059066d6a0aaf62c76ec98e50a2ef

SHA512
33a9997eec47a516dc533daa0c98f6c4012907d5f7dcd1459ae4d245451e4ddb80979bc1ed509d52ddbdfe120c51d813f806c631b05bf6459c83c606fd1f778b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1a1a09712553ecab4c88f7e267ce037

SHA1
378218c0126971a99bd9110229729b683e1431a8

SHA256
915deb327bbe3b958c9bcde152833cbf79a6d73aafb6dcf99f769a083fbe0cb5

SHA512
a5dfd86c8b29f06cc96906a7f70941f221cc9cc08f951a6bbf24f98d143ac62eb93b0babdab9d8992356f37b336b7039e9f2b0b07f78237bcc44e5f385c530d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a895c3636e3a226e8f1df47337305c6a

SHA1
46eddd16768600f72c391a341fb92b698145a8d4

SHA256
157ed438790530be56d67e478e2fc21ede28996ca06a75592182af0943adaf40

SHA512
388ab380e99ec75a18a497b7fd5b6cc4949187c338ab7d2dd26e11c40476f995745863e63761b7a036efa79250372af5345007438b5dca0fe4f1816ed5fe2aa4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
595448f77762cf0a4560dcaf20cb5435

SHA1
a7913f4071c5a2a3b610a094d2246a5025da11b7

SHA256
11ff7ead51ff276d0df1dde4ef2639123a830a96559b251ccab8a924fda97a67

SHA512
65b6b4f0430e3a92b5dca7647e234244146912714a47b6265072081902072910ce5902421dde3d4ef44df25e831c166d8620816b99aee20eaad59a01cab09a3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6aa32f4419f61918bfc179164f01f6e9

SHA1
2cc6ab7b1ded44448b483ba3e52c4f6f6fe0705b

SHA256
54619b218cc0fe155897f4a6658196a11ab35286bf325c45563650dcceffa761

SHA512
09106907f7e72d1b2548972ad5eb492443980b5f683d3f8a808783ef9e892d60ceca966bf2130162909af2fef564aa621816377172adb991cc05b19a9ce1fe7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b9bda76c4a4886e140dff3f620a8fcf

SHA1
74c1272659a08707fa893d92301ac11458289180

SHA256
712acd4c0e61ad9d46938b17ef9436b57c17a97a133e6e54a4e37fdf8ceee2f0

SHA512
14b698400d5a28803ef65f6fc541902b83842a1a5621ef3c69a99a7acea0198166d9e9e8a5c38b6dce55a2f2586fa709faa94f9ddbd2d923419ee4038c8b974b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f3e1d41946590e41de1f4db1519d522

SHA1
e9578c6c9a17f502da9e92537f50be1e2309f3f5

SHA256
c1b666a8f28e0ee2974e7c4878c9a3659f429044c693c13458c3962fd57f9e01

SHA512
305bc8fac25e90dca1b134896d8ea3f851d5475eca7aa9ed3f04f53cd5f6110a0ce41ed2973aef88e5f3d6d5a99a8e477596ec541f5f8362e1dc7c4f9cd3343f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07e2aa8c2187847039b1d6ba2ef9c279

SHA1
5bd6bb8ffc6af5755673dc9bdb817a603449a38e

SHA256
c6a6ac0eac51b5f457f05329381d9974b4702ea73ca6fd5eb83e9b86a72cb2fb

SHA512
7c67e65f5b4297da7ca4440515311f63a18cd86f6510fae37d5a61260149c2e64608cf092c6d8c777e4693424b7c4116b2bc451fdb4b7467d51bb678edc9cd2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab61B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6D9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit