e505a7412c9d88fb2078fe8ad80af58e3cb3466d2d732e74ff93327b2fbecead

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13-10-2024 06:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e57bd4be53e1511d8dd9be65323cfdf_JaffaCakes118.html
Size

19KB
MD5

3e57bd4be53e1511d8dd9be65323cfdf
SHA1

cdc212b44a66a9e9199f79d3325a9f31cdb0be14
SHA256

e505a7412c9d88fb2078fe8ad80af58e3cb3466d2d732e74ff93327b2fbecead
SHA512

477c867e86f3b14f19dbf6ea77cabc3438f7b91c7949d39320c3792a237a61bacef1a1747ceb1094097158800d9f2f2595e723969787c0a5c6e8964dbb5d24c5
SSDEEP

384:sd4/uKMfcx6Ul/l2FDkP7X4A+Qn2Z3Sln5eWSRz:uIBMfcxRpl2FDsT4A+QnAK51Sx

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7B0AD5C1-892D-11EF-BCE0-DECC44E0FF92} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434963258"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2172	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2172	iexplore.exe
2172	iexplore.exe
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2860	2172	iexplore.exe	30
PID 2172 wrote to memory of 2860	2172	iexplore.exe	30
PID 2172 wrote to memory of 2860	2172	iexplore.exe	30
PID 2172 wrote to memory of 2860	2172	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3e57bd4be53e1511d8dd9be65323cfdf_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2172 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34a65f1796b4c09c3e3e7d3993a499ba

SHA1
6a5d2d710ac24c7610ef1a5b86af8585ff4d2086

SHA256
5476f080b0291d06d2460b24de16970ae1124e3f0a995f762082748d25798782

SHA512
4cc28ca88203fcc0d8d506a9a1b89867915baa43c025853b7fa1d12198d46c7f58d7804ce195cfb0e2f224428c6ccff41daee032d1e4e8ff2558cea6350e75bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f74cbaf7c884b41d3e453996d9f4751c

SHA1
53fed33940c06644b4edbe1c415a6d236bf702cc

SHA256
cdf24689d04b6559741fddb63435c0ed80a20f5124c65d1478fb538cfc97597a

SHA512
07b4798271a97c99fc3ef7028fd8fe4dae4ab1121cce30112da524a5b60af66397cabe51d4d6134fe4585bdc29cd85f91a916a3e9e0b6d3499ac04872a2c6f72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
678a74a1092ec1828845eac93781ba53

SHA1
7afd4f3078799c58f5ded763c881d6d592b3a526

SHA256
4d349f8d362dbd6c6bd4c4acbe378b9e0ea920edccfbfd1318192d09497dde14

SHA512
82b24ba35485242151e51dedbf2de62e16fc1b989da7e366d8a50b8b421ef639eacf9236a4cf2718e4d9ecd62c232a412cea7eb9efa3bc96daaf819479df5949

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c13ed7e6973d56378d06d2c8769ee524

SHA1
f5f2793c9d1bee912d24a3ecb3ea6481ed7696a6

SHA256
bc2d6e068b88d768773866b436b402a11b6d70ea35a67d4eb611e6086e9541af

SHA512
f6ce238ae2b78bbf2d6743999090735b4e7b755376ffca6f0005b5b6a1474cd7c613a678d43c8fc4809b3318f5acefe972d484b2340548b7d0b5f2511143def7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7840e29a0d03518f357a4418e5191030

SHA1
2256d9d5e84d010e20db6a0d020170ec06dd7d51

SHA256
dc16e4dc9cedbc4ef8817d9c005b2272bc00c883a012a601beeef22480775753

SHA512
4fe82d891602665a95283ad1eb24c62963cc04d7ffa4ddb595926e0e84c91a0bed870805f90526d91fb6eeb4f9b0cfa579ba2e5fc5bad2011033202a7e9c4445

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa670291df11134e82aa561ba09e618d

SHA1
4d45e5836b6e8b9be9b29ea403576afa2104017c

SHA256
83272beda3f77eb3602cef83621de59c3c32c16b14b4e7762f6401bd67218a26

SHA512
fa8459313c90d48f53f0acee54435d739609d7bb3cbbba12914225fe133f99818d46a781aac606fc1a7f742de7332773ffebe689c27732f50ee6f69303ddec8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dcf62593cb8d4a6bd2e8a9db4be02f46

SHA1
92d102065dd41ab4ad4328aeb0cc508477343972

SHA256
73b00280248667a8e7ac401ad7d0bcbd1a89f56b8d87daf309346bd74c6d7e6b

SHA512
d949037cde11d66737a2e8c587403198238fbb0692b78fbb97e87439e8440c8f634b67f7f4c12ed37502d018ed7247f505a7e1157e73a273cb705f94ea8add59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7c00645c8968e71c222ee9376d537f2

SHA1
8b5e805b670cfcf4875d0afad5f85339fceeb1a0

SHA256
927fa520606a16d7605e04dc9f4d54e73bcf9653139bafe76cc4eace6902a438

SHA512
b38b2d5cddc30acf30c965d7538dd09cf56991fc37bd40be69c506e5e6b619353875de21d0ccb6a58fb10d503dc081072438b64b93cab57a33f80c5b3250334c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9182c0242b30c548b1371ee0cc511081

SHA1
2da0d6f83abca3d0be9bd872398269b79fe6899b

SHA256
ab669e4567e45c26ad4d2dd064b28c976b80e50cd5bb00fbaaf4f1da3e7a5420

SHA512
caa09bc04fd403b831fe54af5f51958f934e13c83c9ef06a75e1966868c383c729cd09c2b4d8c21132ed2f179aec268195b00c59b1a586c7993deaeb915848a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBCCC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBD5B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit