2cfd4bb88a664ed7402602d1df9758f441f052be4ee68a6b8ae777fae291b9dd

Analysis

max time kernel
130s
max time network
144s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 07:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7321c37fdf938cd915e47b1771ca6b3c_JaffaCakes118.html
Size

42KB
MD5

7321c37fdf938cd915e47b1771ca6b3c
SHA1

e02b96999f4aa351952c9dd67f1b2da3a68cf531
SHA256

2cfd4bb88a664ed7402602d1df9758f441f052be4ee68a6b8ae777fae291b9dd
SHA512

4d2822620192e7f13a23bfe9ae13b8045f7a08f814969f269bff06f354f4463e1c80dae0acd9950b86da56546f84ea36e0f52aaef3191d39514faa8f2c7bf9a7
SSDEEP

768:SZyYWzCCAPDnOuONSQmsB3NPeBPmxph9lB3fGqqK+qDVAIZSy3h3ApTVSs2QlsL9:SZyYwwK1SQmk3NmBPmHh933fGqz+qmV0

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428141178"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{968DF381-4B21-11EF-838C-C20DC8CB8E9E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2108	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2108	iexplore.exe
2108	iexplore.exe
1960	IEXPLORE.EXE
1960	IEXPLORE.EXE
1960	IEXPLORE.EXE
1960	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 1960	2108	iexplore.exe	30
PID 2108 wrote to memory of 1960	2108	iexplore.exe	30
PID 2108 wrote to memory of 1960	2108	iexplore.exe	30
PID 2108 wrote to memory of 1960	2108	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7321c37fdf938cd915e47b1771ca6b3c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7940278f903325ef04c06a70c745e365

SHA1
c85ef56d4125073c135882477e6c9a47e760f1dc

SHA256
ed290664d67a6391c599da57e8dc3a7f00a3b1735ec4bf4e66a93ddc19e4a3fa

SHA512
2440595b80f8014f77f735143932a1a585e11c4b45363d4dea78cd2f1ccdc8c0bc9cda70a06b970cc2e5bdcf6621724ed0eb9d24cb42622a8f2ed5b48b21dea7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11357935e06708a75558b924a11bae44

SHA1
99aacee613881a5d05a92b940f718f426cb2df49

SHA256
8826cc28d1f051b658f963a15a4d0b9a9756b51d2412a1ed50264cc99fb24822

SHA512
c33f24bc4f2dcc717e9aa35dc80231d3caf6dd3fae487cf7ce5a6bb4e96fb53990e4b8b9236fec3802c6d501b4e6773f94a924488f99b81d0a4f58988d936994

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27ada5fa5fbef906ce97ee8b96f07cfc

SHA1
cfe271308dd503bf3492131101a6bcacba0347ac

SHA256
dca14419e249caa3ced5dd0e45bd2916f48500b4ab926d03eb439b50d1c4d08a

SHA512
812d54f0f8f166ba47b06b29ea44d6e66275664f8990fc79de11c87363a32611e58f8f4b4f93ebcb0b8884d3d7e42ddc2ee4950b693ca2c9eb32935367059862

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d6dacd7e09fade3a6a9c8b4f9eb516a

SHA1
b4ed3e535f042d210d99b16b8f75e402bceafbee

SHA256
107e0e13d5704ddc94db665ccac365d4e565892e75d10b0549e10d8bbf5ba632

SHA512
7bb10a8fe36ff658b5626a56fe5cdd833657f7a7f9c530af112017f05bc14dea81b528c30bd83fa1336cde914b68e5f360d25f69e5d9295bf4e6254a331b4fa0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a53976cd6b9740948e709de569cc977

SHA1
39c2cc2e9b897a0f4350910854db052905cfb934

SHA256
f20d3d4bb7931d846a259c1effd85b16a02bdebb07e90f1ef692ddf5fbd97937

SHA512
03045243d375d2efe8bdab9b0a28ecf0ca9c478c71d25a2ca3eb63e4eeb9664f87cd0d8beaa13bb5131562071e9f15b559abb272a8c0acd0f1e28ea58f0f919d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
219319a0d00097bbac1150f635f2b4fb

SHA1
90bf9b34f21f6295981c0777cfeadd9b4f3efa03

SHA256
6cb8c9d7a1a2565b22b6f499b4848a6e81e1bc1671ea8b8decaec34977f3f6b4

SHA512
a2ebe051c57a8a1c5b4cdaa15d25691107518bd7d55bf58c8e78374f6e39d18ca5f549b5ee8af5fa767008e1eef2bd335f65ea41ca141a27053ac30907155e04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51b97384d13b03cfc0c92bbba104090b

SHA1
71dc172656d5f92fe3e43cdbeb8e7ce2d64ee979

SHA256
843235c47d8e1d597d9a26c27398b0b8512f363fb2f7aa97195ba1459d7668cd

SHA512
02c8ce6699d4cba4180ac0a4404c9726915ae84efc56d375960bc6dd94e790c4b7f50475893d7e1be5038ba8225a684c0bc8718fb647479679285835f8ed987a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9aa9edb3277de8393109905416f191a7

SHA1
be4d457b05eb447a1f5854c6f3f96132ac4ce33b

SHA256
a1bde28be41a9b880a25dc81fa2597deb080743dc01395df25920635c6de3963

SHA512
e63d21fc440be145c972d9f335276650f5fde41fa7137cef74beaa5d88872c7203cff1d8a70023177d38f96e81704f5119b8e48798c178e65f872ea058e27178

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42bb104298cee7b19b93da0b89d4d6ee

SHA1
158a2a8e4fa0dfcf82800e3d1cad6683628c9806

SHA256
b089f1fa5d415a27fb9345117eb4391385db8c4956fa96e7eaf2783b12d80257

SHA512
1fd437e3068a663c97772595c87a29486d29d4de9a50245aa04a1155102fb59ef7f7cc2b5b249998448ad6b15f021aec838dec48e26eb08f47fa04ed318b376c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab96C4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9764.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit