61ba5c21dcdbb3b70dd31e72b9f3c6fe64224b632e6c45bfc747661abb7388bd

Analysis

max time kernel
130s
max time network
142s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 00:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

764dd256a5b8c18749c8817d7209e590_JaffaCakes118.html
Size

23KB
MD5

764dd256a5b8c18749c8817d7209e590
SHA1

e71ab0fbc54183e6a25264a22946c46e24489913
SHA256

61ba5c21dcdbb3b70dd31e72b9f3c6fe64224b632e6c45bfc747661abb7388bd
SHA512

1262cd1fc2e3e516d84debb4e6dc5492a29e2539eb8159da36b75238e6058ff4ea89f2fce8d7c8f2cfcfdb39eef2173f4867d30e8df560c48681418d680071f7
SSDEEP

384:Eb+bObvbR8fb0bAbEbCbmbObcbybtblb6bcbybXQ/hbfbCbGb0bjbhb4bUNbRlbj:EKijl8fb08o+CSQeRRW4Og7WKY3lsAN7

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428310442"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B05834C1-4CAB-11EF-AB8C-CE9644F3BBBD} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1984	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1984	iexplore.exe
1984	iexplore.exe
2116	IEXPLORE.EXE
2116	IEXPLORE.EXE
2116	IEXPLORE.EXE
2116	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2116	1984	iexplore.exe	30
PID 1984 wrote to memory of 2116	1984	iexplore.exe	30
PID 1984 wrote to memory of 2116	1984	iexplore.exe	30
PID 1984 wrote to memory of 2116	1984	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\764dd256a5b8c18749c8817d7209e590_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1984 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b0a7da912a7f3880a09df06bcd616e6

SHA1
827acf311db08ea578cc6738d6462c5aadd9aea7

SHA256
1daffed83ccb811ef6798701c625cfe3d8b9b67b80e5305bdbb21f2a74dfa64a

SHA512
0a95db477ae803cb51b5510c4377f4765ef782c68b43cc418fce48ca4662b9f29bef56c067c4e3403aa9a3dcebe7f295ce70144e2449b5fa8fc388e0e3690619

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e47c6e17526b72e173c38983caab299e

SHA1
1990db1f266426365f7bb75936651181ff1a3088

SHA256
720e19f7c9e63d25aede3eaef74ddb03764309a166b4b97002395be1771ac0a2

SHA512
de7287e220006e9fe10542ffe39649780b5845ff6201c5d9e31a6705162730a009780804f81125c931d350c6e097e45d77b80df74794f61294a733219f66f1c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21658c15c2cedf6c8130e8028b631720

SHA1
ee97e34bb87b861d14944202b943a876bf1b53f1

SHA256
cfbcb2c1e1640d8e368fa01a5f7a526fe7751c20a98570b5688d8345e071d2cd

SHA512
f20bb674d1473dbfb1da0bea61df049478cbb9fcfe480e6fe501ea5511f6625aa45b2047517a971936a4fa58adb93d48177b833a1fe547e3200768877a447ad5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a849df824d9df013bdb4dd96eced5e65

SHA1
d685d8c54108bf59148792f9daa3e5a56e6eb4c3

SHA256
9686257f9f407d80c8233bfd3438450c45bd820cf158a9feaa2dd256da5a09f7

SHA512
c51420f8566187d9d254e41e84531a09fcb62548912b57df7b47a43e0eeaa5869b8711dab5a1bb189e235b0d71233b2e1bcce1a90fe0c8855159a120c527ffce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6fc995742e903cf179810a29aa85714

SHA1
db7e546c46617090dde757c7d77f41a83f1b6705

SHA256
42678d0d6be42a5b1cceaf49deade1c71a2911f7bdfcec5138a9fe4427879415

SHA512
926b3d5c69932043a933be6e55271c6f2d18a69f80514649a26e5036c6382d1a85976ee33aab39435bb5ff7e0351f887ed90ef7ad963786e1d2f2b550a440ce3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9e36fc90f7711afa5f6c6174d6c0fe9

SHA1
3cc9ff455c8c6213d666c52907064eddb6a5930f

SHA256
a5d689d657990c58427f315903ce4d84d4141360a162c1627fd04388fb65113a

SHA512
54210d563fe8ac32493c52183e4c47b19dac79ae4f10e25c8d0ace8c7111f925fb89c8feefe1ccde85f1dabb8cc1dc66da621755079d4879652e457d901fd2ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18f9252d9d897e0da1de798927dac896

SHA1
c7856d4a0a9ec49be3e63edb274639a2ef6d54b9

SHA256
6c7d1f665b4ad4ffaffb487871394d78f6454df180902142cad3747e71e77c4a

SHA512
68fba259ff7450f09555129848dc6ba1b3abfdc806ed8deba57e47f616c7d6e1fd38f850f4da5a986bab3cc7d789d1d6735aaa274be5892467ca52b9fb7d7db7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
515775fe281946da1deef393d7ba8929

SHA1
86fb7d88e3695716d0f680ef27eedc682a1cfef6

SHA256
8b8b22b0884cf39fc9e5ee3bae367f662af8a79a8088d93c9aa04b1951e53efd

SHA512
cd680ec02e5c6cf43d2adf52334c71606301c94129dd2716f72b41f17d8f9a29b68c7639ca91f9d583403a5837d90d769c5b18c4d21c7e386c2a4d94e6087d7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab850A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar857A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit