0304f8fa44da05f0506db06d81124dbd958d24e4ffd0f2a8303e4be6eacf2362

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 02:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a92de190c2f9d58e6dd469b2d981f08f_JaffaCakes118.html
Size

37KB
MD5

a92de190c2f9d58e6dd469b2d981f08f
SHA1

842cdc183fb55803b1561d9210d3ff2a2596e6f5
SHA256

0304f8fa44da05f0506db06d81124dbd958d24e4ffd0f2a8303e4be6eacf2362
SHA512

4ac76733606bf204426b0d4f877899d35c0b62ca3260247aff28ea66410a984802084bf887b29a1188de7084a3e8a1e28801e0be96a16d4a5ca591e5ecaa0952
SSDEEP

384:JQ/6t60J6voo+4HCuX/k8TXSRxDwMFlIIO6:zwvoOSRxDwMFCIT

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9F85C6E1-5DD0-11EF-913A-D61F2295B977} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430195476"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2820	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2820	iexplore.exe
2820	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2748	2820	iexplore.exe	30
PID 2820 wrote to memory of 2748	2820	iexplore.exe	30
PID 2820 wrote to memory of 2748	2820	iexplore.exe	30
PID 2820 wrote to memory of 2748	2820	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a92de190c2f9d58e6dd469b2d981f08f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2820 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
741eef167ad025affb4f836d87aaf4cd

SHA1
67b661489301a15b65fb737f6b06f2e2be072c7c

SHA256
25eced19c57244e955a41bfb43729bacfa4c59539a8ddc93a9e202f32492bbd5

SHA512
d1fec4b64cd89395b904620d0ad6a2fda052d337031989d9e825696262820f6b4f6c6a615ced5e62defb84e65cc360f76bd8b3e82a02b0e18fc4f5e11535204b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f9f61515bf2e69dffbef250123020e0

SHA1
1192728cce21fabc9f77c3a89faf81d1e1dffee2

SHA256
f7d3ec282e90b69cf0c039803bea801b0ce2e7bc825cf53e7bcccac89a7cff39

SHA512
347be46bcb241b8ebc8c639d0a05d67ce86b642aa91de9038756af54d67ca46f7e296a84035ee01d81e26547cd4a638e52545d99d6718e6ecbd85e5a5c49a926

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fcbcc79ab86053f68573172b5920eeaf

SHA1
a4b0903cd340ff725a8fe270ecccfdd78e54c0a9

SHA256
b0f2377eef707d87d3da39c6a0e9ec8592c403156cf2653aed32de230520c4d5

SHA512
6a282cb1b301606f33db6bf29744f26e195925efdade67fc790857f85d8baab009b40e6d3a4b6e732d831fa23a81b6b08ed67ccc41683a9f8e4691f0cd81593a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33affab8977a2cd7ef0fc8d0979ab5d1

SHA1
684f3d998b6cbfd024b77bb8112ee297361b085a

SHA256
cbbd06cb28458e76befc12a78982cfb1a9fe7678f837f0aded0bb2a11cab2f0d

SHA512
f9feb105cb81ce9c113586b6f7c968de29441540c0f10679114631bbb4f19550464a09ef5b28b9f41f514b9afa995be6a42a30ff6c4b74996fdd984b4dd2ef32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ccc548a7711d8e058e46f1152440bbd0

SHA1
2a0bc32f6a5e4ed6b63e74dd9012cd2603596367

SHA256
6397677c366c6edacdfad564e164e1f19a0d149b2897717859d39b714f8ddd30

SHA512
adc4079e25b0d64d0b21f0583a78884ffc9f47a0446141decbc52e2bab76e4f74d9810240b9cef74b9685a24b5d64025e90ffb544eb93f2a6ff61a0201c6b650

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f60207454a459dda49540df0c6b277ca

SHA1
8a7c809873ea7cdb58c485ba7071a489a0cc47a0

SHA256
c1d175661620ad522df0731df666a41592053c79658fe2a7615c302ff189d9be

SHA512
5d484fa626bf7a4ad3a61aac5b9af1376b40eb8762089d951e751ef3fff2d7c734f32c98fcec14be1dece0cb548788e07b19af979b70d5c6b308709e5383849c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a12fd55854c90825710b2161947f049

SHA1
46b1d15b37de5a0353c00a98bd7f3078c1425a80

SHA256
0c365482165cbb55e0356d0254383c7a5d4ecc3ae4b9f407f74b4e97cfb6409b

SHA512
c62de5c6380b87ddb5c805dc8bcea1ad1ee4df4414dfb708bc53f5d66f968c6b6437d992e8d3b6dc7d6f8557ce32868f60b248e4192a3a43d66177cf9d3f5343

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
251a002629484e8f48c74a6b844d673b

SHA1
de06a58738e5d509610276b3b2beae150738c684

SHA256
7a0c5ff79747da7d392c6f62892b00225704213383a725d214d12c311c370a45

SHA512
2ad1ea3214177dda39776b56163a68c55201908a4ad08af1f24c26ade81590b40af10550f178b66bf4c97e79092b101454eb5f8f01301cc0dc2b7adab4da1853

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f42e8d34b6caac1bd6163f22244e3d7

SHA1
8256c90ac2f30b13f78d705da901a57d228c4c16

SHA256
97682b9fe4ab7410dea563b20a5065d1c45dfe21910a4027b10698db6ec9c36a

SHA512
8994d5c9d1f46517c6bbb4f48396d03e9d54691443bffe8c0453c32da842b524e7478819c4ee849546db050f4a6ebc74a3b2b6613c4984cb0336cad9ffd74bec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6653.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6702.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit