a25e7ca9688e56d2a72268d52c3368184fae0f9297a297c5508a894bedf29809

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-10-2024 02:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4557b4f335478f4b5ebfbc921c3436aa_JaffaCakes118.html
Size

11KB
MD5

4557b4f335478f4b5ebfbc921c3436aa
SHA1

7c5572041afdb1551c4410effa9b77859bb44868
SHA256

a25e7ca9688e56d2a72268d52c3368184fae0f9297a297c5508a894bedf29809
SHA512

98cc647a62c68aad2e9f3d60f72929448125dd64f2b2ce2b01302434b76187a11e62733c2ab862573ea14e48d498a971f1498f6ac20d4e42c65f526ad20cd2a5
SSDEEP

192:2ValIsr0r57Mlx+T8v/w1whqJkR1O5uBuLbdU8d:salIcIQlxX/gGO5guLZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FA203F21-8A9B-11EF-A6EB-D60C98DC526F} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435120666"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1304	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1304	iexplore.exe
1304	iexplore.exe
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE
2536	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 2536	1304	iexplore.exe	30
PID 1304 wrote to memory of 2536	1304	iexplore.exe	30
PID 1304 wrote to memory of 2536	1304	iexplore.exe	30
PID 1304 wrote to memory of 2536	1304	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4557b4f335478f4b5ebfbc921c3436aa_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1304 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec060e0fb3404b46a0983ebf4e924677

SHA1
3c4f8de717284c35d05963c27c5668a658bddb8b

SHA256
e4888bca52ecade41df667869d8c578f0ac749917f3facf522994143b07ad19c

SHA512
e07c62376a76a151cf20b24bf9672d8b42334da55303c8abeedca702b1e627c915dfb403f16eeb9b471bdb367c43a324451bc306413866c9f3b4646e5fab0390

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31c9c01c00471b6a636a917188e8da1b

SHA1
a4e62e685ab321deb0a1cdc3155c042321e8c4e4

SHA256
d2bdbf38b2f95625b2d92e63af6ba854e6a45cdee7c6eb26ccdb301415a7de4d

SHA512
e293068c5a2f16873e52ef397578d048de09f1b42596e701d80d1d7d8e62375d50c0ad897310806f89019cf05b3f4d90e5375dd0290dd5f1670be79dc075c4a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce8f8e53e9f326ea30ba8d14d1f9f5bc

SHA1
be0ecc1856b0927b3f1267f705e8115816086f6c

SHA256
13ab5cec5a62e8aad4ea3794a5a71309ec2d7d028cbd7fc9182469bee5068e0c

SHA512
a312e70f6c5fdd615c68ae8f295e113662130e5a8e507ce44694414b352f7d02b833610fb41117ad432339a8fdb40a6e989813d74d57fd2d360dc9473f70da68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4543f63129b3a408b90a9cc0ea963ed

SHA1
7367a1d2016531aa2109c69b3a0c1d2d2d1dbb74

SHA256
7712e9f64b4e64866ea47850a0097110924a654157606580fc2f1430482cd86f

SHA512
b6c36f7b7a26de3fbbd798ad519a32a1a209dd4aa1a6d063f2620b8d7924e7b2777e79c3a07e7b6e5def1f800c751a87a246e03801c3f56689011a6da492ad03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f6e3f5bc1a18d3c1214630dd44cf98e

SHA1
6eab42e4bf3f7a84c3947be240772d5ac361f4bf

SHA256
d433244902a3cf01827960e6ce386224000ac7d046c843d9d8e2649bf03c33e8

SHA512
a087ab93c3e478dfe9b7bb21ca63f5842012df2563160a9ecbebab789c914af9851d1b1bf8daed686cda802d644f74ccca7e15b34d1187e9d9b2f1e6542ada2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc7971d47f3f68d6ce6c5fa3906bfa48

SHA1
40777706736ca1255eaa46e4e894fe6a5a6dcca1

SHA256
fd7c91465d5c40d73c40437f3615c1471a55a086a9b669619d353cdbc5b82723

SHA512
55545e12063b903a78e0fc7c38e3800f1445c5964fde983364c32601338ee9fcb15bda41589c909b6e25c63cd2b3dc37acf8bebdd70f9a0e0d86abe2355fcda5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80d5d5facf67714b25dca2a3db1a18e0

SHA1
8c04b5700a44d51fd442f50df8fd37ccc741d7aa

SHA256
3dcb37f348930956a2431fb95cd70a33f9fb0a886088b62c96da1a273c7b3a3f

SHA512
7d73eb6d9cd71c99961f50aea09ac44d10a9c76047d2668053ea6263cea350b122f619d8ce48fba7863f51be4063b7ecc56c8d4c113884129b807fdcf3d08d32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1da47e328f554603de857ce696de56e

SHA1
ae8129592cb49aaa854767405966585ff7b04c06

SHA256
4ff3c8e12851265a3a6e0f5973921b6d645ddb4549d019baccb514ef70952635

SHA512
e39c6bf395ca5e3c99cac4e4f63df8c584d5561a155d34e04b1a67a65a57eaf674ec215331f293cf5a8fd21f0dcaa7963cc12396fa390ce3ee27aeef2a8188c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa807d1c81443bbfbaa71d76a3010377

SHA1
83e1d68b2f22ec2f8c24f680d00262b1f1d327af

SHA256
fcca576bdb8b9cd3d35b35e9b382e247254b8f46e843091d5aba4da35b009939

SHA512
90f573d58adfaffc729aaa9c7a0e7e79f5f105a3d1cf0aa350c91d580a5e7b3cdd1b3c449755874459df237551a7f81e52961a10996f5545889266f571c957c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab848C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar84FE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit