6d97dd750d89f98f7732d98630008e20d97e8e398f3b5f99831d4f873fece45e

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14-08-2024 17:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96ec714d60d6c87b741cbf7b876eb2a6_JaffaCakes118.html
Size

41KB
MD5

96ec714d60d6c87b741cbf7b876eb2a6
SHA1

488cf65a2a8e66870835eb0e5ab60fbf6dff719e
SHA256

6d97dd750d89f98f7732d98630008e20d97e8e398f3b5f99831d4f873fece45e
SHA512

a93d9be3c3fb4455e5e36efbbd079e5e8f7c86294b4fe7ea98ade41d9bb8313a32ca1ec95eae127de51ca6f2c008ba983852681db621273c3d991198950cb20e
SSDEEP

192:uw71b5neB4pnQjxn5Q/snQieHNnfnQOkEntginQTbnBnQmSLxbYiaouPejQ9zdP9:+Q/sUxkilaS0E2Cd2Hj6ben2RAAEGD8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D628DD51-5A5F-11EF-BB68-FA57F1690589} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429817184"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2164	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2164	iexplore.exe
2164	iexplore.exe
1304	IEXPLORE.EXE
1304	IEXPLORE.EXE
1304	IEXPLORE.EXE
1304	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 1304	2164	iexplore.exe	29
PID 2164 wrote to memory of 1304	2164	iexplore.exe	29
PID 2164 wrote to memory of 1304	2164	iexplore.exe	29
PID 2164 wrote to memory of 1304	2164	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\96ec714d60d6c87b741cbf7b876eb2a6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2164 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4983c7c89ce78ea449800bddef4a91aa

SHA1
afd6f2be2cb951f963ce0ba3c657a741051ce92a

SHA256
76896d31b6e0a904459132b4fe92ba8362a63285ae655d575e5fe0b022da397e

SHA512
0f880e688f43f10bdf49dd6108688532597e32ea0eecb0e573f87e4e44794447e167b93f68a8baaf5ed1b57acb30c679bfc58904d556ff60055d674d4dc5595c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a64c0826d99fc5922d4f4bc2d2043180

SHA1
80fdb2401bacda2d6fc3e6d6a1aa7d1dd4dd4cf5

SHA256
825b173a0f7f41f6b35aedb3ac3af53588c9701371b21326f09b8c6d6852fcb7

SHA512
8fdc875f8dcf5e522cf429264ec76b36926943636a80760c7a4657c70adfd6b24f0abf355ae93808c9c491c800022d2520ca30b0b138a48ae6209e26b97afacd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2fd711496a54bfa61af8f1ef7de8ff43

SHA1
90e3f319309dabaa967d8520fe4d16da01411b51

SHA256
e451a4a07031e3f9b3e0ddbadd1ceaee15413bfa41277c39db7df8dadfa654fe

SHA512
cad812626efb198c1e7fad2b2e0795417e5c84e2430c04abdcc8282a324be08d79dbaca05a57cf1d17921e96d9f13d83d31611e488e8b645f6428cd8e90773f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18290c78650bf2c2e7e123d6b43eb92a

SHA1
d6f89bf5330d1d07a378c61b279f5acb7ba17c9c

SHA256
12f1cd2a29729ab68acd68cd44adf666d0e11aed1d174c869d320360fd9dea5a

SHA512
60bec78f139b1a5f9f7e410a4109f295ba661456ad2bb052f8575cd0de2f5684bfbf6cb1e802c34a2a03876cdfc3793499c3c83c6d05a728fc5c1b6b4fd49fb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3910e81d17ff079bce6eee1358f4153a

SHA1
e0a4d6b1299f5232f735e9ecb57b268b03cef6d0

SHA256
6c17b238aa6a2133aef2be11bf558815114c4d61f2d89b0bc37a36bcce5b1c97

SHA512
dfadda675cc0c1a1d456ff396bd3e0e8a93436cda0018e3810ad068879555c9bab97e3b71c527b8079ce1f91defd423dfbd6eff4898c9a073994fdc5c138d792

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab2545d6f1e6ef558aea7e9f52994440

SHA1
f97301697ac8e1ea987f70bc1e5c987c37b2d54f

SHA256
113d0dd0b0a7f13697489e35d1891c1c09bd39949263967e66079f0691754546

SHA512
750c52283d3bf36d85e2cab606b53b56e88e2d119631e793e4c7549a15af9d7ca437da490d025dcf42d72dcafb207429c1075b8c071831ad1b1ec530ffe6c73b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6ea461d8a886d51be0eaeeb892a1f9d

SHA1
28480937b68f3e20d446815b7d9a6482de7182fc

SHA256
9e9c7ed73530963b7fd0b430632b6c0052ba36a8dd09d4787fc914eb3a5282f3

SHA512
db3b46ebc1cd92edf9326e4b62569f859cc614236c2ebae79a1d338ee1a2e42da036c96e3efa1ceb12465e88607bb2ea91b5a2392bd734f01650194c528bdb81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf7def48fedc9b5cd8c0b5294aa3a873

SHA1
0279424e50f2c59e5da94bfb9756b2a3156c11f1

SHA256
7895847701a9af0e2e79610e9b13f107ad6c0acc15d8d40353e623477d0a1f5b

SHA512
124207377de5e295f672ff60a13fe59a11fc1fe659a31b07453de4de8aae16f37a3316ccfbf31a3c7033cf99ae26f4bd05148b3fe21d62b43665c7861e8ce3c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
201d9f4f57854328dfcea608f21ddb68

SHA1
fc3c89dd4ab7b83dacab67b120a116e7da2965f9

SHA256
ad32f3bc979d9077f49d0be0ddcc63fda00abb58dc50214d782b0c5399cf8850

SHA512
06e28d8cea2c8325fb9f56f319bf1d58ada94ea08741d1a3851fa11626ffabfa50a977768e767bf999d569e0b149b055350d3231bb18f3e7ed2718b5ea536119

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab45C7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar46A6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit