ae9a26bcf6f25c4917f19a59ef9edbafcc631eb9e9026b7aa3870a4f7e90d0e5

Analysis

max time kernel
148s
max time network
136s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 17:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

435c57d552cb2ae5ec7e3ccb96b48f01_JaffaCakes118.html
Size

18KB
MD5

435c57d552cb2ae5ec7e3ccb96b48f01
SHA1

66e75493847eb050384c895de57948e25ac11660
SHA256

ae9a26bcf6f25c4917f19a59ef9edbafcc631eb9e9026b7aa3870a4f7e90d0e5
SHA512

76c1acd1cd44edcd91a53667f8f670435bab48d547bc161be155eac49a8730a4e6dae6c133e2ba46ba8549f1f962d4b1eb4964b7f9600b509cd5aff321400136
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIZ4vzUnjBhhL82qDB8:SIMd0I5nvHVsvhwxDB8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435088972"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2E7D0F91-8A52-11EF-B557-C20DC8CB8E9E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2196	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2196	iexplore.exe
2196	iexplore.exe
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE
2788	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 2788	2196	iexplore.exe	30
PID 2196 wrote to memory of 2788	2196	iexplore.exe	30
PID 2196 wrote to memory of 2788	2196	iexplore.exe	30
PID 2196 wrote to memory of 2788	2196	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\435c57d552cb2ae5ec7e3ccb96b48f01_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2196 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd885f175e45a6f8d4c04e9c446adfd6

SHA1
77cf52abdf05bfbb0526631b87617f65a2e8b2e6

SHA256
da993abcdd9a6928aeab048738782e9e5ab58c3774537266bd543c08ddf290d3

SHA512
6e3480b753a0fc35790725d5eb5824917085b0463f406eb4c8d05a4ec0cd0adced5710fc9b3c2f1606599c2a2d23372774598deafd389d617fe85bedaa44f22d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1bab181e339dab29a91028f7afd297c0

SHA1
d827ecbd310c6fda516eb28958824738ce5fad63

SHA256
e11d6264e18627edd4e8ef402b4e01f15ba0633004bbb0305002a2f0fe2123fd

SHA512
3d8dbc9242f417f7ae38091b21a3f14a563b072a03e5833453c6684cddf5fed41310bbaafc90e8087b88c8268d02b0a24186e6b5e381db3173ee9356575cbf91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70b5aac69e93228daf9e814edc05388f

SHA1
ebc204e68b471602f767fa313c583699bfc49cb7

SHA256
eb93c9a241d00457c57db36d03789cffd9a2791f2d46451bf7075fba33d3acba

SHA512
964ef31c1ee7b1f091e0557f74ea337f67e61bdb497afe72975adc9a6fe3f37e38ba3a29de85bff12c7c311cf2c27c740ab67154b4a593ddc9bf440508b3c5cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b33177377e2a3af692b923fe1e404536

SHA1
1d096606491a8860e3dfa6589011bbf4927d7775

SHA256
148cecc4b3b09d2a46dfc18667539a43c3b2eacd3fe464cafa477d5ce8942bcf

SHA512
65c08251b29ba1d9f406870cf9ffa69ff5c465ceddd3561e1987f82eecbeab2ea4e99ae7a6a5a6ac8eddabdcf28248fc2e8c2fdaceb848db60c7c6d438d7fd2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5fe4ea212548e40cca28f0cbecb1602

SHA1
db7965e266ddfdd68ce478bb8d4b58f31abe5dac

SHA256
365625632ba294151537855f6569fc97cfeb3ef6fc5bc0792778aa32934bdb52

SHA512
ae5a7523911a1d061047c8e1a6e04c8351092586117e206537f2eb140865818d1f4d1911001a712c308c0f5dc010931e83f26bce92028c8711bbda689e31b265

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d541c32cec32e24756d4ebf89574b339

SHA1
00d7f323494f7eede921d7be6dcf63c1bc9ba531

SHA256
62d58fcd1ab65569d11ffe234a911272029f9f38296a4b2630d9191380dfc844

SHA512
c04393ce5991b8860f2e46689e0d4ce290a9512656e168272fe53e02caeccbb5891aeb22f7ffe2f04d65068ac26ef2c3bc433d7af6363bad54c673358cf1e95e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8fb478ddef093d17ad7e6888f4352de2

SHA1
6e07cb1e73a74cd493aad7caeb0b95af05d89ecc

SHA256
f232249768173b1514e026348bf8c3662c8cd82e4cce2081b9ab74c3dd43cadb

SHA512
ec239c151fd6ec85d1a5497e5378d123e7b9466ec6f7b534661944acf540b87ed660f69e44b0c969df77cfbccc7af5b3fbb288238b892d65885f0533326498ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47fe590f0f8a44895bdee9e20f211eab

SHA1
241a06e046366b0be292ce9f38621fa4d93f4602

SHA256
5b7b622f39500d40a277f4b440042cba2d7c9de2a79014e7987238c72152a23d

SHA512
86532ad89633f1356299f5c27b5393b2a04083dc9087fb86de8b9227455ce48dce16752b6e4eea14958c3a6a60b40aaaf30449aa45a563c7962c6aa340c119a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3899d2b3384460bb331b79301b9f088

SHA1
e1333a1eca205262849b48e208c3f83762291839

SHA256
2e5db14796f34a1dbfe77f2be395c46534951f92da214e7f797f7032a697dc10

SHA512
c6e9c4efd26e2126075e9967a87212d6d8e41a9f35e41841b2999b576d14ad67e116d90cad9daa675e256ae695c5b76fe1ac31d8551423184390cdf8c3e5bf8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
112d85eadb5f2b5d20da2fb5ac73eb89

SHA1
c0f179c1ac3f29fc1af9bc7cecad92e52d1def6a

SHA256
f9751d85ffbeb64a2fb870974c066264f20dda009e1b69ce3ae2697d1014c39e

SHA512
0f9ddc30f080870e98fe6450679e21a286d90e6ec2bdb6e34cdae0ee02711912fa6a024b3148cf77a005771b0e10fc091ed8caf896d48281b8f9d0c34e146527

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1193b1c97f199358c7ededdbf2a556ba

SHA1
42e468572bec359800e1142cb75f70291316f89d

SHA256
b46ddd06e925c62ad3aad1c573a39a3aa1936335bdfaa5cfed319aa8c6d0a146

SHA512
8dacca9428ecc88ef7534f452424cbe4402f72c96cec04e2574ef7c299b6c6c3d7eb7ba84733e37fd45f7d4a9a0d979adb8eb365ea8ec0bae92ae9827e1ffaf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab343C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar34DB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit