2b8586eeb2cfa577b1bdf772809e5f9ccb569f75a71d13cac959b878e92d4089

Analysis

max time kernel
132s
max time network
142s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 13:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74455cf8ec3f9731c31bf7da77c55720_JaffaCakes118.html
Size

28KB
MD5

74455cf8ec3f9731c31bf7da77c55720
SHA1

21627c64feef93c40185f1ba4e7e3bb68ea1e15e
SHA256

2b8586eeb2cfa577b1bdf772809e5f9ccb569f75a71d13cac959b878e92d4089
SHA512

c9db9cd68eaa3e473d835427ebb494dfa58945365ccb6c10b4a5056ffdf0e8b1aa728e89e72024f7a7d7baf9206c0eb50a3f6ca31b4ba8b9114d4f0ee28b4b17
SSDEEP

192:uwD8b5n6lMunQjxn5Q/snQieHNnnnQOkEntEenQTbnNnQ9e/Tm63fbK0JQl7MBnb:iQ/7a1vbKRSb

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1EDBD351-4B5F-11EF-AC6D-CE9644F3BBBD} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428167606"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2500	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2500	iexplore.exe
2500	iexplore.exe
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2392	2500	iexplore.exe	30
PID 2500 wrote to memory of 2392	2500	iexplore.exe	30
PID 2500 wrote to memory of 2392	2500	iexplore.exe	30
PID 2500 wrote to memory of 2392	2500	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\74455cf8ec3f9731c31bf7da77c55720_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2500 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
356aa00f59704f7a0f04014abecf6ab7

SHA1
2646a3d7bf93b3238780ff4fab06f02e823c7e05

SHA256
88692f740ad1e1d0bf0a2df8c2ef73ae50c152cf171fc4e09e63e4b6811d9be2

SHA512
c4628aa4ca31c2e19e2b2f10d7c5823513875883376de6852fbe77fca7d0575ed66b744db85766901412025e6aa90d38e715fbf858dbd68292f296632616a637

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d88465f0c0f10e79044ba55fa7a2a2a6

SHA1
9426f6807cb9c7bbcc6dac7fdff7ec8f5290ef8a

SHA256
5c5331329299e883e41df81d17296ac2c37ae15ec885ea3705cf62f0f9ef388c

SHA512
721b98be61d128baa89b8235b08d3dc628050f2aba25bbf1a4a586ad79fc7ad084824419c6306d284aae3c8f1955fb81fad478481d909e08cc51f2f4fcb82d54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e1afc4d2dd5b7b60b61a1f31a7fde90

SHA1
1a32bc182d80018b6ec5a691807d81ce2abe91e9

SHA256
6ba600308d27c1c515b2a534470c40045e2ba9375c31d5a12e6095aee8dc7888

SHA512
36dde9ecb76efd8faec58d05f868305f5ccf954642fa2ec6e18597c31a4f6b218306e4ffb53591c311351210da3a3c0c42520b71b095231a07f481f0a4b1c637

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f654353b320894777bde20dcd58cd7e

SHA1
a6ea90b01c83363c8995ebbc3a3c314d66bd9a81

SHA256
c0c29d592f0a236ad9f4ba749d737acd70fb62fff5cdc23440dded22706c1f1e

SHA512
8f6a92bff0be62bcb6eb1f2c8ca2b3a136ac9831e9c3a6cc351655429062c468befb471c8a4088ee30b7ad663b588d6e70817b6961e84c0b790a1a96026497c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e529a8701eceb2f74461c594efc4016

SHA1
512963d3177ae086d7b8719afd41b0788ee5683e

SHA256
e68dab7bd7a4b7468277ca0bbadd958e0e2a1558c88781e999cb9e318c3e33ee

SHA512
e9449d80bccc709e9aec32aef6fd08541e642a14dbe3041925eafccf3074f7b2ca4c88e41f41d86787048e5af89c4ef77452d2fcd504087f9abe54f54680d8d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1c768c8f8fa91d5b15f666dfcac2d85

SHA1
8b374116ec33130931c6e3996ca049a4fe09ed16

SHA256
a3da147b8b0333f7c9f1db124d7109827435b5c2cdd25ac6d69848ca145ccc7d

SHA512
e2418a77d4e5b0ff7f37311697c1e1a1f3739663074d9b822a2b2d22d42c08f77645e3e15e5bd578389ed423288ec7287d9642ac5d9eb7244da3f047b382cbc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54f220a677ba2708016643ba73c75518

SHA1
91b32212840a2dfb076d2f286aa1ddacf920acce

SHA256
a4f21b13c03078244594621280cbd5b60f4e4fa5fb409d5f8d874a5b0df5a42f

SHA512
0d2d565ae696fa6d98db548bac189ecb4b36506ea0f69b6886907b5b2a4bd384c99908f1afe2890233404fc8c414b580b00e9b7d3b83019b339f76e99096d16e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9d307026beff3ce700b04046429adec

SHA1
bbf1f0e48c25484b736c878054e069fececa75b9

SHA256
3602abf8a926657af40b0f04db7265be239b069b8556f7d941e1f8e26a31c919

SHA512
cca1ffc99fe91a036f180f7807d74113f83b06cc661761c3a7e0745ac6e14ce7401d6b24889234582e18b0a15842349cdf9e889360d3ffdfc6c8ca42aca6eb8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63a3f0508d3b98c69a580af22cd0cea6

SHA1
f52e724a916aaf18643695bf517f1a2698f8597e

SHA256
c6fd124e2b4b681d71f136da09eb52e15d1f8fc0a6421efb181e58b440af5cb1

SHA512
9c46c64e4234949090d97aad2e9581a7a97131be9419f4d92d63fd6cacc576930ea8f0c42d071136bd12b7a3c5acfd7ad16cdf7038353da1176ed36124fc37a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCC06.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCC97.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit