7431284b417d1ea93d1ad2a3047eb4e5c3984ac6acf8bbedee623f6085c42a8f

Analysis

max time kernel
118s
max time network
136s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-10-2024 01:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54d23e630e425e64c6ec85740697093e_JaffaCakes118.html
Size

11KB
MD5

54d23e630e425e64c6ec85740697093e
SHA1

2af7cb29b05e4c7c1a87ac334c4236f4d032d316
SHA256

7431284b417d1ea93d1ad2a3047eb4e5c3984ac6acf8bbedee623f6085c42a8f
SHA512

11406538e5ecf2cf6adaac88d6990453244c2b947e31598efaf35fe87598a5298f24d721c795d00d1fe105dd14947567bdb75afcf62b14046ae9a943e278fa8e
SSDEEP

192:2ValIsr0r57M4MxapT8IM/w1wvqVkt1kHauBuLbdU8d:salIcIQ4MxaBM/g8WaguLZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{563C80D1-8CF3-11EF-B4B0-E62D5E492327} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435378097"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2148	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2148	iexplore.exe
2148	iexplore.exe
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE
2940	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2940	2148	iexplore.exe	31
PID 2148 wrote to memory of 2940	2148	iexplore.exe	31
PID 2148 wrote to memory of 2940	2148	iexplore.exe	31
PID 2148 wrote to memory of 2940	2148	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\54d23e630e425e64c6ec85740697093e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
576fcebb9ebd56fc4db8c5a795f72485

SHA1
4a666ba55df18343dfac7bdf582fc7546c56eaa9

SHA256
0b69ca9539fe37f9134d9e1672fca5c43d8ff153ea036ff9586f37f497fe65c7

SHA512
cdf12df031931f5657412b9f43c0d68c6ae4edae5dc08819f9a36a043b0a4b380e21d7e8ba23597720ea4daff2b93c3efec73f3079717bda904c139bbc6dd5df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ac212224254e499f8f3f2370aced51d

SHA1
0c906704116edfaf826f6f25377e4ef9077898ca

SHA256
bc972d2019ef7ce657c604c12c58422eafb59d8af8db3b32b9f2238edeca925f

SHA512
1a085df5bac499afad25ca9072305e9e409593d7d0e1ecea53fa555a46b53abef055c97e6211ef651819f04701ccddf4e6952ed548835c91b1d99dd33c8e6eba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4ed28890702c5936b60021eaaf7074c

SHA1
f1ca1ff0ecb38a0f6e251834790edc11236fe87a

SHA256
b15789969ea3eb31e6640c11df51e4ddd689df26bf0e38437238cf9b9712de34

SHA512
4a234cbd8381ad2547471b1aa1620a9ec8c3d3317ddeed895a818e54e39123fdfe9f115e4baa719e105d666efdcf20e1f8504c87b627ba8bd14660ffda0d714a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef1bda36808016783f678d8bee25a2ce

SHA1
d26ac68995ebb8b47c7f5405da79742ee7778bfd

SHA256
37bb155fb1b728e1b6a0a4a0718d69e4317ebab51583683ea8154e204d4950f5

SHA512
53aac8eb14cd6e6280e403e457d5e0785945aab68032ca5e450e6ab591a99961114b2247ccc03f7989d242b7b27f86fc4bffcb1d7412fe72c556429908fc335e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5eaa58fed5d79cad4ed299e386bd0e66

SHA1
cc0a22daf5bd50ae2e1b45933d6dc725953dba9f

SHA256
1507c7022c9704a09f5e79eb56fbfc6c4bcf1bbb13f5549b42c7dc9fd458570f

SHA512
d733ca2fbd573b2fcfa1ab5e82d80cdd3e0c1ff87cdaddcce9b0c49c29ed60cd84146aaeef13e7e5294eb53943b7e4a261f1d7c273c17f69fc01c26bd9f69da6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d54d4aaac81f03398c2b21f12771dc1

SHA1
23d8f6bd6518d14f359a0ee63297b2bfb4b43219

SHA256
9c7bcd325a5605e77f7446f194141df49986e5a0c762d7671211a512aa8b55bc

SHA512
268a6f0cd94e4b638fe9570d69cb65d728a2d2ed8c847dec02a0e8d90ff29238939a256a3b64d138d2d73967c1424ed86497efbb31cbd2d75cf3541fb0ba4050

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
710d5d282af41cc4a8d1dc60250150d8

SHA1
0102a1f290eae4c03abaa01e8387b5385d585dbc

SHA256
f4efa3f69ad3b7c44e969c4bbe4ba7de9c9eebadb9de22423c7ca4a026cc3d45

SHA512
37ee1addb4ed14571321d4e9993e0734f2348fe34d35624c03d1c048460f027d20dcdc096de6915a1fcaa4605e4fadf7d4c1d9d27c3fbfaa080b264e3d6b167b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dcbaf33d880789acb89d066f7b4e7f51

SHA1
0e8251102fa612a110522836da368756ebc7c5c2

SHA256
2006b073441486dea91c69dc8b6278cce54cb18368583a69c8855238cb48f6ba

SHA512
b72d8dda88d7f47f5be91737fdaeef3ff5d4a9afc8bc58d9934400a40604cf38ecd3c3b91eb80515ab2840b8776b0d0cd3ecec62c88be4ee8c2dee3bc26ef23a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f6699628c6fddaeb7c5894cfcf259b3

SHA1
d37e87feb1d843ae9a526ac7ec5bce091a80584a

SHA256
d767e2e75c3b6e3bbc4c676936b539b198ec1d724fffd82102818e28ec0be8cc

SHA512
5466ffc1238d4f6b79db7e23800b9334825c6845734ad89c7b98f5b590232e597c118354339f2ad272c28442450e2bd651b40cfc458533caced3be57a9bcd3e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDC6C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDD0B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit