0e2e31dcaddb4b2ed9705fa8f7194bd0ca970914434fc7ae8b536143d5340a98

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 16:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7048cf5355ea212c9d3788a54b2fc01d_JaffaCakes118.html
Size

28KB
MD5

7048cf5355ea212c9d3788a54b2fc01d
SHA1

33cccf06c8dd30299a095ab345eb6952e028aea1
SHA256

0e2e31dcaddb4b2ed9705fa8f7194bd0ca970914434fc7ae8b536143d5340a98
SHA512

5ef49db755f4bee0c3da7d459b34d6f9c8e1872e99759465c85c4b407663d8f76bfe38b64e4675217b42e125705c047bc1ed4d68bfef52f118e1b362d2e06875
SSDEEP

192:uwzAb5n2JIanQjxn5Q/EnQiePNn2L8nQOkEntYCnQTbnpnQ9ebzF5m6NfLqkNQlP:+Q/gL8uphLqxSRE

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{65B56C11-4AA0-11EF-83E1-66D8C57E4E43} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428085690"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2056	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2056	iexplore.exe
2056	iexplore.exe
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE
2740	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2740	2056	iexplore.exe	30
PID 2056 wrote to memory of 2740	2056	iexplore.exe	30
PID 2056 wrote to memory of 2740	2056	iexplore.exe	30
PID 2056 wrote to memory of 2740	2056	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7048cf5355ea212c9d3788a54b2fc01d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2056 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6425f1ed9c167518b6d92538fdb8272b

SHA1
6ffbe87afdce003f3ef55c26dea03931514d5692

SHA256
39033f36f7bdd7b44c538dcf26f75cf5cb8e13f3c7f87337899ab46ceb3d8a0f

SHA512
303245d00ca84cb724df7e7d3aad565f5f7b71b1c2d1b0354ade09cd1ed3f8bad8b05e47202be9da73d669e1f64b30ca58c8bcc36b74498b0a824929ef3cb9c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd75f261e8aa2ff2f0caaad4169007d1

SHA1
52511c949ed140c75b737a2bde799edea91c500e

SHA256
15074d1749c457c4aee65f9b702885047c9c937aa99393efc1db3e80f67f0db9

SHA512
96e1e6acbacccdce3147ef37fe0510e557368052fdaac549c992c75b077fad1b9d311d1e451edea01c6068823f1e8a7752f23328889821752c645b6ea4eb5d92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d62baf91b0e2b55815f94e5fb006c792

SHA1
da7b25881a79870a8498445298f6176e8db99fbd

SHA256
a77d7ae5ef7a853dd1a04aa63803c620d383dc9dcfdd67190d0f6e75f2792439

SHA512
72235824e594d487e2b319cae1f45ebfd0547ffbbe8fc92b09e52c54188bc4adabd5d0a6056d76c56689fb38cec5c963e40d0093253870d5ff6440d409e95f36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd5adf128e3b0a11f30a277f0d2ee07e

SHA1
9c74bd59d67146f4bad89e720e00b3b337b9338f

SHA256
474156c9497ba246cf6bf3bd7fd4475a062c55b5726c68369430f4e9b0f0289e

SHA512
a4247450e1c99dd67bc2f74826d839681f1719c9a77a992e9b984224d3e145f51cdf6d1406af8739fd41d66ac56fafec0744f03d0f87d58c91377bd875354885

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
adb46eb96b4ffbd8c8c6b68e0fc0dd0c

SHA1
c457220325340ae2ff1f6316ce8e41926f6f11c2

SHA256
14985b952bbd5741c034358cdeff2a405661c1766b9e6996e77e9425a1f87fd2

SHA512
1297624e2f4322be13ee00c77747bf6ba977e751c54f8037228005daf81df571134d01ded10390abe1c608a173326c95c3e9fb6dd0902681b2d1c6d535144c70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
692f847b6044f9ba92d428c884d5748b

SHA1
425df0ca5b90d0154b206bb62ac280e741715018

SHA256
140372b58a3ad59ec308499e0d2da6704e2389a8fc0c2104d2e6a9561c560606

SHA512
409d07aedce8f56c20dff67940ce8a016286d1fddcc710d4111dd4690c9ad3fa40adaad575cd42d96b40e6eb1ea5f33d102388f50a0fee01f7928a77c065822b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c4079a14a7739b615af14abd98ef07b

SHA1
e0c43ad3011cfd21d297ea20920a218b2abbdb1c

SHA256
782cdcc8e5e313b6e37db81e75ab3c500722e81616191f354b35445c69a8dbfd

SHA512
dda766a216d727ae2feba2410bc195b03d56d39d64cbdb8bb82139255745d7f2465f96c6c3abc65722bac0ad9e79a2f4b5a10b0107f0b7dae57ff41f18722bd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41b85bc1bb2aad0ee65cbf96c12d1040

SHA1
bc285e3587e7aa376aa0ac5650c40cf69706890f

SHA256
d1255839df328eeb7e5c935ab42b588bc78cf76272dd253672ad64cc776fca80

SHA512
1dcaefe1eee7059e511360487fda06b2426ad86a65d7191ff1d1f164b0c141e58b7fb11c3493515f8cfe4f725b724436630660e68ae416748a412333fc9041eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3d8c7ddc31513a1581fd88657164aee

SHA1
f7d8747e276ff9c308e827bb81781d6d8446cc65

SHA256
55f3f3867496abb3878ad5d97ce6d4d5ef9b4a0a4fcd0ee72b91f36eb7eb6d2e

SHA512
4392703f49c2c8ff29ef0c68c01b5172f8db385680d516f77ff0746a18636d6865a1d6e559b56fc6052918c5680b3b7f3dfde2ae21fc7a10b2721a17d76f5dec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab73FA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar746A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit