f272e60a3facadcabbcca9983cc79847b47c6f4f6939584cdcee637bfc351bcb

Analysis

max time kernel
132s
max time network
143s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17/10/2024, 22:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5422fe096e3b31b7bfe5bd74ccdbf034_JaffaCakes118.html
Size

85KB
MD5

5422fe096e3b31b7bfe5bd74ccdbf034
SHA1

99e22cc795aa551b3d13f05d38fd35f8c2230da4
SHA256

f272e60a3facadcabbcca9983cc79847b47c6f4f6939584cdcee637bfc351bcb
SHA512

aad3546af56aecb15bef6f062a4c05eef7cc4b346d8e1e27a5d0273e5c8344c11b4e3d9ab62cd9e1a1ec863805aa0a077db8720bb1766f6baedc8722e453f1d0
SSDEEP

1536:L+ipVn1BUNqvLKvr7R/anVXWCUZSo0mjiMpbqqvmznhKv++nPLB1VZ:LBvLKvr7RWQiyuznhKv++nTB1f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{474F3351-8CDB-11EF-837F-E61828AB23DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435367757"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1720	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1720	iexplore.exe
1720	iexplore.exe
308	IEXPLORE.EXE
308	IEXPLORE.EXE
308	IEXPLORE.EXE
308	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 308	1720	iexplore.exe	31
PID 1720 wrote to memory of 308	1720	iexplore.exe	31
PID 1720 wrote to memory of 308	1720	iexplore.exe	31
PID 1720 wrote to memory of 308	1720	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5422fe096e3b31b7bfe5bd74ccdbf034_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1720 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc4808e0122b09b021415afd750b28c6

SHA1
dc170135cb2433527379474a8a8a460bd21664fb

SHA256
147d45065b0ba42b586d7793af68320e3928757eab327aa42f4804954f968755

SHA512
f8aab1e8e0bf57d0c615230860906a17862ae6f1fbd4914ee1f81913d400af0b33a0ee030cd24c31c3f62dae25d61891d7fe023add644c0674df2fa06ea129e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
683d27256ac541466fbecf6c4a57c91f

SHA1
085f80f474addcdf62e7c741bb856480256edb37

SHA256
4865b0f45df02b88b7880f6b41d5ed3133a577841d4fe41dad6163356c1f0adf

SHA512
18fd3ca1b97a4b130e2800d36720dfc9a9ab949b1dc0cd8c2de52bec237b814cf8bd3f2a5ccacc80bb84620040a865547a3a71387c6ba51700a3ecf7095ea2e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad35ebee8005274829c83b3e20d426bc

SHA1
64aaad6c93661ff490fa6021958cec0985f2eccd

SHA256
cf51f35dddeb4a1ddc78856244a4677e5fdcae1449b62722eefe4e5e0ccc0762

SHA512
ed6ed2356f92115c491a4332feace880ba040f9f7166db164b70406983b25b0a89a852ed50b08f80689b963107b7e7ea0bce379a74adb6ec872b84871d678445

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f8fbaed9e4a68741466ccfe2b0eafde

SHA1
b3d84883c1f66f4b0e2b26c88c84e10b64b41e3d

SHA256
7f05c265753399836ca1ec688c7f33ebb34617887d8ba5b8c72797304ae80687

SHA512
0a7398fd0c9427ae65ab2cce1c5bd56933a1ad199c21066a871e1a344a4c9d24dc588998b2d46d89619f1b7b443ef3afeb1024f5d934bc3dbc33b5d1c7c77f2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
184beb10718be82197b52fd992a37ec3

SHA1
1495fea882f1a947ca1df2e97557f7432d8d440b

SHA256
bf3f44bda550dfc7e0956411e42c95473240c56d77147286db50ac907cbe0f6b

SHA512
df43c39b78a39b8c74e05a19bf9f723a3b3ea65de0db39f2798b31d07f9613739f24696849fcd163ca882c4e89e8248bf9d18e49fc5b709f99b69eb3f5a8ba6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50ba11dc6e87c136d86433b5caf416dc

SHA1
a891a2c84bc4be4a2e98bfc7074b6028f5b63c07

SHA256
0ba8d8f3ddd6fdac1494f52b8be338a746ed4c65bd42601cec7229f73531c86e

SHA512
2eb3b72e8a5834c8ca15a91d0f393b3d86462accf809eb8454477134cf320eed7b31f3f6625da888dae3bc3b38ee3b812d39c80536c8d09a8f384bec8c09d96f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
241fcd0f6d7a336768a35412714791eb

SHA1
5c64787d2f35c15f932d59c1dd8d19104b7a1765

SHA256
1117d7ca792bfb0dd7ec8eef8070cfe7639eb86c1e946726bbbccb7144b18b32

SHA512
3642c4005115ac7c9a2e11ee0c7d9aad41d231c703f2ab2f2e7071f220274a8b4bdbdf104c20681943454a81b3ac73228eb33784c6f3a47fea52f05cb78a96c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9aa1c0e65fab85b55cc9975299bd6608

SHA1
b6df368cc5de9894f4ecf5456f886deb2ab50cbf

SHA256
be2de513d7ed47a72d9eb74235252f8640ada855590d4868f3470dfad7d80a6a

SHA512
cc28d467b91ce210628c67272dddadd17d60aef0b5c763f70cadd11f47411a63d0f4382b60a6fc0644e56ba5555a4c77e5f6a20df3b489227aabc89480213825

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40dc36dadf9914dce3243ce4e66d86a5

SHA1
775174bc4ed22f09e96823bb2b114c97d2302b6e

SHA256
eeeef62c41f6c963427df5bb64dd8bc42a7c0560084e0520404eaf4dd4b8dabb

SHA512
c88ee10f90abfc501e6acc4a01b7f604c8e0447ef5be62a9c1719d277e910b22f2c6f180208ec3f0987ea25b5053bd056dcf326740b79b812cd2520ab58339b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE8FA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE94B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit