62bb2b72e61dcbdbddbf06a6a26b10a44e4c1c50046ac397eeb4c3dd907e9a64

Analysis

max time kernel
144s
max time network
148s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 20:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68b8d431d926447ab7941df57402ea6f_JaffaCakes118.html
Size

361KB
MD5

68b8d431d926447ab7941df57402ea6f
SHA1

db5dbc7e64af273ecd4962a48ad4d4efa00a00e8
SHA256

62bb2b72e61dcbdbddbf06a6a26b10a44e4c1c50046ac397eeb4c3dd907e9a64
SHA512

3f768e15b0e78eb68001e1530afc64ddc62328c7481cf15f08444435da690b2a6cb04122af62965d5df0ce56d145587edb594bcda83a7716508ba09954e6a60d
SSDEEP

6144:SOWsMYod+X3oI+YAfsMYod+X3oI+YgsMYod+X3oI+YQ:h05d+X3W5d+X3Y5d+X3+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427926807"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{78127EC1-492E-11EF-A1F7-DA486F9A72E4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2756	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2756	iexplore.exe
2756	iexplore.exe
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE
2560	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2560	2756	iexplore.exe	31
PID 2756 wrote to memory of 2560	2756	iexplore.exe	31
PID 2756 wrote to memory of 2560	2756	iexplore.exe	31
PID 2756 wrote to memory of 2560	2756	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\68b8d431d926447ab7941df57402ea6f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2756 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88ea9a8bee74ad1d7f0a6f32bf31da2c

SHA1
c1ad166a06b442462dc77151f4735e03df266867

SHA256
82dec28d9d4a6d16e031716ab4da14d9bd811477445df78f4395ae3eaebe701c

SHA512
6ea4e73b0c245e9cf27a84ba41f2d1efeb621d3602c2ba5d25bc430e44d5dbf69abcce5fc75b291eb608d122cc76c220c45aa84c9dcf18d6b5c405cda71808e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd94d6c36e84988e65f6386eda3f6fc5

SHA1
4a899985320be3928be2657b26bd5addb4370b7b

SHA256
5444a45857399e673265e5c84dc1ec5aa5785b46ee19210ac6679938e9942207

SHA512
a18043585eda97db6846984cdc05df6cbe1b32c73b10514880d5e81602bf339ae81e4f01555e5484368da5ed2f160a49b9576b28fa145e2d77289d980795d7d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c115cf2538bb2030dfab2d6591412dca

SHA1
0b0a550bc92b8b8560af6f1f5ddde1877ce85946

SHA256
efbb93f288ee3d1395f3f622cac5252fef220c097bce14fd4b3a4f1819c404d7

SHA512
03a0d4419e0086d45c55e63dfdfdb324d780472080e616f383733842eac706b939004b9bebb5219fb1212d1ab2cdf34ce638ae24a1a737e9970d59dfb3d5df65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21e984c4fa0cfe672f8f8aa31eacd14d

SHA1
079cdfad68776f4c2ded0ce93f0e489235c672cd

SHA256
1cc3ef927842ed0649d975777db5b3b516f9d76acb38f2e2f6b76307c6709f4a

SHA512
cb1a30d93f046e653af38c731de79d38a9677c228bee81ec7ba9a55abee0ad098a235c09126ed6f2de4c3f2c3efba4e114bc96c3b85d63b5c95a090b38768ea4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
048fafc01d1a2a6c0074e37d0b636371

SHA1
e7a7ba81ae5c5c950fa19d5512cf2fac69e84a45

SHA256
302f6c22fd4bc72ceeadb4dbe593785ff95eeaa2f531b3122beb4e07eaac0e39

SHA512
dca72eba605f74b3a8b00e43823d154ef2e675efc14078af9027e1d8d1e09d5e4823f5b062f379a3e1d839bd9a7b1eef746ae4cc37fd0a40576c7f4170918347

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8b40bed51aa0afa96769ff2c0846247

SHA1
b3491f9a68b65b4131b0c4d7a9b666b1a5276ca3

SHA256
7be5073a5297f288281e26aa872d6010681bdad22ef2651763ff611bb1a7aa2e

SHA512
2b0a14e932303c3537abc63330d5f63301e3736ef340b2e4370c5f03c0b9c2941d62159422ec6c81cc6734eebe8e0192dfa30eb0cae9782eb3de9deb6d77787e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0881a8d2c5dc1f9c2b6a92499cb7c20d

SHA1
ea89ac6b9295ca3cb620a96d0316ebfa10376959

SHA256
5e187d5b7edd1b36bbbd550acfe93e2e02b55338fdc5b94a8dedca50aa50c4bb

SHA512
b1ef7cadf0453677e9c6adc660b85699f57e3a0c31c59adaf57409b358d767319ab955a3a313869288e06927596f72fcef3df42810976aeda9bf7a6583877886

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4373656b7bd2cf11e40d4a76aba6eda1

SHA1
7275981b781e4ba6ae7e14d423f09bdd3e18a469

SHA256
de3241520bd8731e29c1523102a96a25fabf42ec75354ecaa09a5f29c4129cdc

SHA512
36074963b57f3ec9b12f8067203a6c9d894a821808b5eb88ebb5c2744da02f47e09b4f44b5d25db1c971a9e76f2fa967c65e1f02dd5eb27eb6aae399be649633

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4af05af19c02029a08cd50419f94c0cd

SHA1
735752de1b06760d037ba2b3deb2a52ac2f14082

SHA256
cf1a6ccb25cae4f99d072346f92e371c4e3738b160af1a09de433a154fbc95cb

SHA512
727fbbfc516105568b28acf11a6fa4a7b4a465265a502fc61a67bb4b8d56c7d4a13782c5051b7bc930ac84c6b60f150fd1d2aa5504863bf3f73c18b8010eb0a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE8EA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE94D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit