dd725573ec68ee7a2129a702323f4678b6946f02373c931a0c466c14c56ee9be

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
01-08-2024 22:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

820476d52caa57e25e5625914f7685a9_JaffaCakes118.html
Size

42KB
MD5

820476d52caa57e25e5625914f7685a9
SHA1

41c187daa284ba7a81c7bf1b50b011d85456aebf
SHA256

dd725573ec68ee7a2129a702323f4678b6946f02373c931a0c466c14c56ee9be
SHA512

5ffb0670f6e778a3f0c8bb42e211329165cfe442eede628340b31182dd3773aa45d93e7344cb142f63db19b17ef2160801c5b42634577ea28d3f4020af1140e1
SSDEEP

384:fQ/BhxpdDdeQanbJXWndWw+YwsLuoRKwfMvwrXPeGJxI:vGJamuUW

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4CD07F21-5057-11EF-8EE4-CE397B957442} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428714003"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1744	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1744	iexplore.exe
1744	iexplore.exe
1832	IEXPLORE.EXE
1832	IEXPLORE.EXE
1832	IEXPLORE.EXE
1832	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 1832	1744	iexplore.exe	30
PID 1744 wrote to memory of 1832	1744	iexplore.exe	30
PID 1744 wrote to memory of 1832	1744	iexplore.exe	30
PID 1744 wrote to memory of 1832	1744	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\820476d52caa57e25e5625914f7685a9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1744 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5f886516e9afecc754a0fa8088b0a53

SHA1
502ad48fe429fdff28de099e02f2a182462a576a

SHA256
f4a72aa06445363aa6fcf9432a648855d3a78a9b98e36764a6846644b28fd293

SHA512
538ac2901a8e7e7c43c44d9f02045bac4d2a83e8c51decca626e89377bae5eea0889f6a43710fdcca0115ac4c8b91396c25c88d834d30753a4c613c32a4714fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41037f2b17e194d3986c607caa9ef4a2

SHA1
f79ba768cab5c21c2b01756463067edca940bd6e

SHA256
2f9a3710d63ecbd4fae95e946b86e887c0c6c1b576292a81db0eac7cdba6592b

SHA512
4909a740d42764480273ce108c49cb15587eae205d35d5012a79b3a257164935ca424b3e93e97486fb1b87e2754e536b08b92129d796e66a1da17cbd0ead2b25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e87a717bcf511e51179513dfbe31c4f5

SHA1
b8e464a845dd13345e8aba79cf1a6a9cea012ce8

SHA256
c72c4c216022022ce5e2d34338e5ed7b0074da8a650fb739139ca42b916f99f6

SHA512
59def3d03a0a1dcd35ce9e0bd6af6a1e32ba70c660979b9104ca4d4fff36ea1098fc65a5f70a51ee42598b22ae607db5bfae3f24404634a4380807032cd88984

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8902979c595cab551519aa6a9823f1cf

SHA1
bc84f08af2ed21825e501652735fc105aa9c2ebf

SHA256
f8bd1e5bc4ab015b69c17a5f0c368f2b4dd5daf055d6b99527880131db70706a

SHA512
d8b4168811d33f939286e9191cfc1f3192260c80fd76a172f8566d6a8faf71144ae965a810a784c2405f7382dff2a31f870e91baae2c2e9132dbb6f330b536a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b136d722fa10e6bf7d500cba44ff19a9

SHA1
eef8c2032c359d835ae602a795a4d5fe96d0546c

SHA256
de6364c39eb003cae10398af4ed0e6b55eb8c857e7183471858950b075d75a4b

SHA512
471c2a13c3c6dba269cc60cebea1311f4515471d024f2d0b28e782a4b85a563e1d6ce7cb4da777a829dc1ab99e54dc1bdd75868d961b79803c64ba30e9c137f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bfe2a57d637f1c15b3c4b25f4c6fc000

SHA1
e3211aade2cf17d04487b0675e20c1ee2d9fd0c8

SHA256
e747c0ef64566f3e2b8fc91f583484f39fcb38cb4b3faa06193c57a750bb9deb

SHA512
28567578d8eaf812051715110e5b0ced7e8b82251603574decf025178e66baa916913516e5ce4da337964005ce2673111e897dd31504340661fbab5ae743af96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7073402dbaae0317af65b74dcf57289

SHA1
77e115b8f48ba887520392254bd5f740865d3412

SHA256
a8dccb0b99d91ce49da16946049b08d34e09119f020a1d6aeb4e41983fd17ede

SHA512
32a311c636042be370efddfb054b966618ab7252ef4ebd599147b04248419b63b58cd148c6b00647c237ef57726d82fb10b9fea39cc823b4d4b481df1d25a1ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
621e93345c53eaacc6c41a70ddb037a4

SHA1
6657a1ee1816293389f18a1b8f56b653f7c2a9da

SHA256
593f8880b1e630f5a2e9560ffefc830900b1ee5557151383a239535599357401

SHA512
9e90ebe6b8a0664dfa87bdd2cf6706bf2eff600fec8059d556744bb6952ea4a82db6a144fd02de32a1d5dc9574536b1ae253d588d96872321ed2ebde6d20909a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
071fa71d6c7c07d3d4c8563b16c0dce6

SHA1
61265e7ce3116ebee923b733e9375987ec4afae1

SHA256
3931b01704fcc105ff498416c5bf75a9535c2ec4623a14abc54f6f4cb2963514

SHA512
9c50010413aacc4f89bffef1978e8eddb46b39edb3703a31ffe5c0de98b472f86e0ebd423ef5dfcf2387da6ba779211751137b7525e7c5d8f060a1a2628fb48d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab80D5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8184.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit