d39b640d11089bc48597d8d758ab83c4e6d15bc056d080e5985175c0e934f02d

Analysis

max time kernel
134s
max time network
143s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-10-2024 06:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e3786cec96313cc526352e786834e5e_JaffaCakes118.html
Size

141KB
MD5

3e3786cec96313cc526352e786834e5e
SHA1

5c38348ad48ce2ae673d35e5dc9b7f1cca4bef48
SHA256

d39b640d11089bc48597d8d758ab83c4e6d15bc056d080e5985175c0e934f02d
SHA512

57d5cd54b2f8150b23e070d4ebd2ecf7288af28d1ebe1030bc076caa298f81af10ed1d711e1715d89e2dfa7f03eb7bfee5fae2f6969f0985f7494f676562d6de
SSDEEP

1536:S5+oEY0QasBx76vuyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3om:S6X4x7dyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8E19F141-8929-11EF-B729-F2BBDB1F0DCB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434961572"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2668	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2668	iexplore.exe
2668	iexplore.exe
1764	IEXPLORE.EXE
1764	IEXPLORE.EXE
1764	IEXPLORE.EXE
1764	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 1764	2668	iexplore.exe	30
PID 2668 wrote to memory of 1764	2668	iexplore.exe	30
PID 2668 wrote to memory of 1764	2668	iexplore.exe	30
PID 2668 wrote to memory of 1764	2668	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3e3786cec96313cc526352e786834e5e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2668 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc2f95a586e88a441b437c1dc5a1b9dd

SHA1
f2c4abb3a0baa24459b4ea3da3e3bda4acaaed2e

SHA256
624beaaf3cf30291e6c5e4c052bc032055d82a1063d8161765187dc317891efe

SHA512
3a6e83ab086901802b708caaa4645a60d1db53360c2730f49de504fef65e3e6ad317830701029703b16c3bffc75864f9809e181170774b0f812000a0e2b5d049

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f44ee25d5a737f4dcee3adca6fea767

SHA1
da3744e28b522c1b9b889bb3d580197cd1f2daab

SHA256
cdc4b4ec0829d9aa28296fe3f10fe6e29d761ece43142c1372779ef45ff64d1d

SHA512
e0e97892f084d561656ede35d2cdd16ca7c214121f7b17e07f9539eeb9abb395c988069320b0eb1eb4ec4935c71d34de549b7c250201e46a10e7c63a49d8d9fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e71540d79619e76ab37fa4b6ba75fe72

SHA1
d14ca5ab0a45db94fe17de87bd2a2178264e30c6

SHA256
2d68b9f246aa14db6e081687444b2b6bb86426f8d2fcea62d93d7aaa39330ba9

SHA512
d44823a9fedb7b238f49f2dcd23dc2a8b225439b3b8ad0a494f6fc62d2faca8ca74caa2d8b3c8ee17831f200c872e8c05a52d72de2859432b52116ee96ebb4f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2debaf8c02d94f99d74a6a0f688661ea

SHA1
50dfe380e667b695c3a5df6303ae3fe8f33ac59c

SHA256
ce39ed057bb5f7cd1a4fdc632ac38ae4afd08ee49031737b939c716aa433ddea

SHA512
7a86faf802fa6c633260babb3a0be199ec9e4d9c3e3091ac324b9beeee64f676834051d6688f7012319a199c437c3c378614b95a6361d3717f182ba66c187260

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ecd82644fdfa5c3c7712e3951019d977

SHA1
5dc17b11f0546f460bb4f9a1b0078e515a4cf630

SHA256
5abe59667cfadefda4b835b8043ec73f03aa239133add007c38b893b4ade90ba

SHA512
918f2f1d72316e46462dd3dbbf19450df11b705a7572cbc99785164bfe8cce99da573265a391e15222a55cdcbce42f376833ee8a433abc83afd0105b48d66fb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
690949b74e8b1e9e5711f787870cb88e

SHA1
633615300e85feaf0aaa820358b44efaad965621

SHA256
e6ac353d872a5506d81000781590769b73d070de6a575096dbd911cc40a1436b

SHA512
4ece317425e2717ddbf31f4351ab00fe2e5b0b808a8908a1d15625d1104bc7bbe57938135059bb24055fd7963887f595637b66912752b1e8fe0978a3be913c8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b1e34c6e5d0e33f9103ab30d0e69426

SHA1
76e0eaebfeaf8bd98786d46aa122f060c7dbc7c0

SHA256
395b19b4afb8271f97e8a2047498716c009858bb2f44a4ad049140b88a1d62e3

SHA512
0b89e0d4cc04d9f23fd29d842c7506bf09c4a9142b42b90f844d7351246695883d423272b54f2139d714445367045a06c5522111a762e0ca0b980b6a533a742c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7db03c13a5171d01f0c39363777ad9e0

SHA1
be82d6b7db08432646f1fafdfffc16aed9f18297

SHA256
e9838cb7d6d6f69e0e8d00ee69a2206235b06ca370df6be782e8d556b0ccdde7

SHA512
ece55de23a9f26136d7d6cd68b1b3220c8b8bfd4f4e7dc846f46eda5b2d5798822497c8e733778becb5800ba32d7df13c42538bd3ff4d574facdddd4581ddfab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c41a2bc9d36831352746bf87c93e1dbc

SHA1
094870c83211be46190c5e93eefe77a140d4ae48

SHA256
fa30bac105e5dd9234b4d5fd5c8c95a3b98d022dd2127f7ea4af0550ca5f483c

SHA512
a2b890c1d32280764ec48a63f87e547e1269d2b51bc0c1043b277b7b52a9c67a46bb1378f30b118df1a3d4c441cac5a651a77db5569d76b749ca71101b80cdb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA44D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA4DC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit