ef8cf17761450ad0b817b29971949cff2b4e363df03ec9b7ebe5e859aaba7267

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13-10-2024 17:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4111fa2f5a24abe64a3de8790fdeb4f8_JaffaCakes118.html
Size

19KB
MD5

4111fa2f5a24abe64a3de8790fdeb4f8
SHA1

418c99daadac5798eab8e88ba7176e052c8aac85
SHA256

ef8cf17761450ad0b817b29971949cff2b4e363df03ec9b7ebe5e859aaba7267
SHA512

f56705a5c7d08968b8e855c835b943ec7b6beea5ecde4c3996ba97d9a97ac4fb20f5bd25fb290a49af5f98fd25be36fc52c74c194edcfd921571d44e9ec272c2
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIE4EzUnjBhk+82qDB8:SIMd0I5nvHVsvktxDB8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E2F140E1-8985-11EF-9AE5-CA26F3F7E98A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435001228"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1748	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1748	iexplore.exe
1748	iexplore.exe
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 2664	1748	iexplore.exe	30
PID 1748 wrote to memory of 2664	1748	iexplore.exe	30
PID 1748 wrote to memory of 2664	1748	iexplore.exe	30
PID 1748 wrote to memory of 2664	1748	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4111fa2f5a24abe64a3de8790fdeb4f8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1748 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e711e256a63eda3eb5aab79b90ba2a5

SHA1
1645c13ad365715f7ed0b6c155ef4b549bb25365

SHA256
3d7fb339d9f5f4a46a7101b821eb53fcdf6a4da622477430821d0d94681e18c2

SHA512
6700ea930e633a8b7b050731f91cabd808ed495130711cfc29aa47c398d274f8c474a772490a39fc08087cc5d53cdb483f22e9a3e7e3d7b376c1cd27c27cb81b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b103e3c62166d770358d10cd81d13049

SHA1
eb5b643c83d1dd8d744555ff8bb1eeba83003b1c

SHA256
5a5ec5f264d3e98f918715d66276b95e29e0ba371778dbf76387ff6a947588fb

SHA512
79b286c38a71d5c9f5e0f798028bae47b9d6f865d0dd9dd9b0464707e2d5a86f7622b72a851a263e3196683b808b92d3660f5e8165f5091c2aa881186d32ae33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3afe19bb0f9a66e7f98f280827e839b6

SHA1
372aa44ea13c7d48c432612c2c4cfdc3e44927f1

SHA256
fc797cae0100dffc06f192164d93604e1cf56d264ea2ecdee92c23df43c39c97

SHA512
c3fe5e1951d604928517fc4ac7dce5f226b141644a825569eeb79755af14435e915ac265b1a2646d3b183055683c0b6a1fc3e4646500643d769b160f3bd75f1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9206ae254b2355584ee0ce97a2f8bf2

SHA1
4866a44981b426f4d1bd60ca379549b69254fc31

SHA256
82ce07da76f4a969fd6d88d5c16953d6608b9ff02cb2c38355f079bfbb93828f

SHA512
3dc7475ce9fa2e94ef7e46f5204ef2944c2dafdc13f7978c0f4699135279978d70fb3907a3a0a7932b42169ceec0b5a69219e82e720e73eaa79242631e075ca7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e96a7d86637d4695c4c6c3c8afb7b0ff

SHA1
0947b11fb2abef593711c4ca82ef19050e04e611

SHA256
307b3ef556ae675afbeadc8d4c6193b8e7de95dee471675f4edbe1751050ac8d

SHA512
a2b1ec3ef01a855a466e2eea756814e65ef851c433bc605c8da214eb1af9dd1307bf4a1dd46db26f2e71b295fa916898fc9fe6f810f7bfc0e769571d7d004baf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7df3c48c3f7bd2cd19ef07df867ae43

SHA1
114b2a3718bc389c90e4cf303b7c3eefa330cd99

SHA256
7c1619fde1fff4cd10dff2c58da111155eec1a759a82517ada9eb866bd824b75

SHA512
5141aaf0e345f42fec4782e327ef5d4be17e88bbc4cfd0f167454c5ba29d69b507b3ebb443035fd6771e9201f1deb03beb4c279713db89c0ee5053a55f61a569

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ecd7151c540f734a0b67f9ef33fd147

SHA1
706919d3d87ab8123791817a5751e8c971720f80

SHA256
e154ed92d243eee76a8dccd1c64188aa7a2103c727424fdadcbf96bb0bfca4d8

SHA512
735640f012ad006f6ff35bce6b6eb76a2955af327c8e908c56298a34e6b6aa23f28bcfd6a6611dcba45ee60758a3b8223688607f147b7c2b790355fa49180d60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea266eeb7688fb94e0806e0187d73fca

SHA1
d4fd4903b0f13835a1a769a37a44e7af47cfed8a

SHA256
13bf8323944ca69fa97810ce9f45f148bebf0d3e54b743821933f91323c2d9f3

SHA512
1dcc0a6855da0e27eb45ab947216f486d296f872b3de7c1a27d73dfed2f78b1e2370f1279ae9d1c5d822f923a4d77a97c2ac4ff3c62e438109ec83ab64950194

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8af2506c50749da41348f7ee416b70d

SHA1
1f0a484087e7d33b3cb4534fd8062c3089c6be3c

SHA256
dac6b2960952e56ad876db2771adccd72bf1d383ee3ac0da877f80ce5a9ce503

SHA512
0e7d93c1e240ad993fbf2e45b13607a049adea6c5f6609e3de92f70a09f405a2539e43bd6da19295ac2d141788a7216e04133daddd5f27b64358b42083b94c72

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB73E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB7DF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit