42ca9357715ad9f49cb19b3d9c70ed0f5286693da00641df720a2f5f3bdd907c

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
01-08-2024 21:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81ce7f0dfdc919dbaecc9c098ee226b8_JaffaCakes118.html
Size

47KB
MD5

81ce7f0dfdc919dbaecc9c098ee226b8
SHA1

381cfcd373d9aa9861a411c054b3273f5b5cdcb6
SHA256

42ca9357715ad9f49cb19b3d9c70ed0f5286693da00641df720a2f5f3bdd907c
SHA512

4fbd0e9ca060ed91ae6c2de93887e5c11af2dc217f841c158f13146e665dcb7f7b827d2f65aedb75964d68bf02952efb30b4f2c9956e1e2feccafc7f23ca5ee7
SSDEEP

384:tvlIcqtl43NGTHhF8bgPtW9+gTG+ex3PcjYttuozkxJo7UcHnzJzUNFvobR1tARF:PA5yoIcHFgNBobRwZchg4ExLZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428709973"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EAC9EAE1-504D-11EF-B1CF-FA51B03C324C} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2396	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2396	iexplore.exe
2396	iexplore.exe
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE
2636	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2636	2396	iexplore.exe	30
PID 2396 wrote to memory of 2636	2396	iexplore.exe	30
PID 2396 wrote to memory of 2636	2396	iexplore.exe	30
PID 2396 wrote to memory of 2636	2396	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\81ce7f0dfdc919dbaecc9c098ee226b8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2396 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ffed0511540afa885df9c77643ba41b7

SHA1
75d807b961b58da38d1f08ce8351934cdf66a00d

SHA256
1db3e53d30cc24471076abee045d13a357d1dfcaae3e8b58c403c3e93596e7a4

SHA512
d5f32534aaaec6aa0dd8c2add17998573bfe64a5ac22e692a08e7719acfdebb75a3cbf48f4133bae89b1124c652e1c1c9500670cc6b4ab1a7e7eb13a6e7ca26c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d4c99a1fd29a785130db726412b673e

SHA1
5e3b4d42262615fad7196dcc906c0ba650bb3484

SHA256
c0dfa6669983da11306f07f498645344a29ec530a07cc5a0f48499c3e55a82ba

SHA512
2042105d74535f2d9473119b393e60eacd4ea6e0df4ba1bcc055102f34e62d8d012cfe68dc153800267fe7ef0600f142d602bffd871dfd5f31588e2fb84b750a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddab2057fbf82a1d46e3a18c7663d3e2

SHA1
6547910508aeb203742f1423424dad18d1df7fbf

SHA256
3da3fb9ff1381f4186397793609f2e9e2e2f54f978666ff5934e39f1edee7c5f

SHA512
99afe6eac87b21c91e5a8b73cebfa0dd8dd955a5d317db9102ad00cf41b7f3d0196b17d794a7fb6ee83138be611370ca2372439441af658abba88f2f0cdbe075

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99117ca2021e496af71ce2a40d7e71f2

SHA1
927bd1f5d328f397f27f3f95779c0a5e1afe45ab

SHA256
9d65ed3ef38897dfee4ed8a79bf4b9131bca679a8f7cb21c95cc4b4e3311a930

SHA512
a0d2fd8579dea972900994d7107f6f192e9a0e2b9ab89f76553443f07761de5aa4f97e9d76c2099ef09e15bba49ba8664313678e780c82c336a4b6d625b14aae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b49bdbbbf10d77ab246dfc986e4a57a

SHA1
c7a5da9d82377af6dd0f06ab0cc99678e0998639

SHA256
7d4ff23b6b3ac4127a5a91956b80cdc99efb42cc7504a6617e80090928156158

SHA512
40ccddf3c89ac0d2968e1276d217334e8bc2f2383cfe4ed7f7bdf135832d930fc81f3a3c23e2c54d81ea4ca12df3b30fe3c6d3d8f2478fe0cca91b4cd1a69e2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20f8d59331c6bc6ba84233c3c4674f93

SHA1
3e44423577cdbb6bbc58c28ffac0c11f5c3b280c

SHA256
98ffb650ba817fc7db390b4c7e002b0d77fe47a51b1d65671983789f13dbe0d2

SHA512
5d52ac479511e00525708a1067fd06af697aef08b5b4eb6c5166bcf7467adba1cfd8bb8790632460f8dd39baa89a7c74a23e82618a7220535b656406b17973b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9d0c9a8083a0861d5f1dd17b1280050

SHA1
7b6dacf6d59865bbe0582ee308202a121b3375d2

SHA256
7581ec67e261a5c9203ba2efddd6cec372979811d648b9ac4989c9c983df47d6

SHA512
9e7ff2d99d8686201fda53330ac620f689c2d8c4adeb97a579eb16c8f002b73f5d129d2b2003c873459481e99474d2f19f2b667dbad00c45ff3759f8dcdb1cca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1a7d0037935b223a48549ff63cb669c

SHA1
8107df16a1c61088029b756b9e48286ea94dba13

SHA256
9c58529d42e785098d39d1c83a252564b9bffb1772bc12d6407f2a4a12f9d2b9

SHA512
73589e55791ccf152bb2fed97cd3dd698c344dcfb084cf7dbc6c091dd721cdb63f45d802fcefc8a5291c5439d4973df0202d94642dc947e00a241d62a4f4b3ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d30b611fc695fe20dfaee13c9643c136

SHA1
10f9db8364a5b18f2962392dee38bd89ca974821

SHA256
d30f80a37b7e483ddbebea4f851e7757bd3e63be2687cc5ffe16f810ea895ca2

SHA512
b27bae81dd1d294f5a4a3b6e2f68717201f80a2a5031d46965aa3c3831259d3c9cbf50eee8eecb6587df60c08637b3135b16a3232cd483291cddf9ed0934bec7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC2F2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC392.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit