770381824a4b5a88a1b32e44ec26ef4ff7e653178ca63f30b6184e1a4d4c74e1

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 15:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab8949da1c36ba2547da3ad8991a9f32_JaffaCakes118.html
Size

42KB
MD5

ab8949da1c36ba2547da3ad8991a9f32
SHA1

d98b9eba86e69068957a3354fede2452fb62e91d
SHA256

770381824a4b5a88a1b32e44ec26ef4ff7e653178ca63f30b6184e1a4d4c74e1
SHA512

2dd5f0632568977e86960926c670fe4af350ae698861ccc14f8edec45fcc4205399ec4838059eb9c0c7d20bde88076078b379c3f7a69856a205c6edd4a2b8429
SSDEEP

192:uwfib5nv0V7nQjxn5Q/rnQieiNnAnQOkEnt5JnQTbnhnQmSmxy7iaZ9PljQEzHPl:oQ/NRxsisbh01dFIiOjPbzy53D/QrD5

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DA264861-5E3E-11EF-A4F8-F6F033B50202} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430242819"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2548	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2548	iexplore.exe
2548	iexplore.exe
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2696	2548	iexplore.exe	29
PID 2548 wrote to memory of 2696	2548	iexplore.exe	29
PID 2548 wrote to memory of 2696	2548	iexplore.exe	29
PID 2548 wrote to memory of 2696	2548	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ab8949da1c36ba2547da3ad8991a9f32_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2548 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ba05f0ff2965a19e41d38e95cd6705a

SHA1
6286bbe4c53d5502e41d75bae43f18be6029280f

SHA256
a21060b6c23bc0feae30ce981966c67db38274a4fd4ad96168eff1085f4f7e6b

SHA512
94ceb37dbe0f96c97a7e125c1c5674914018d3ad1aac256e9750a646df439a33312837774accc007d0eb649734613aa81216617e35eec97162422f91edb14e65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d8bc573132be385214f3ef61b8030ea

SHA1
4ee06b667f8a1f481dfee2384715fb24a139ab6c

SHA256
e03e7a5a404a1ae8620da75fe88b1f89c98363bbad305d4c2413dbf217e50fa3

SHA512
685799e3636ba1c2ede9a4110ae00c80727ec1bcbaa8daed9c372fd764dceb7fa061356e0995e3cc3527ab4d2515597be0efaa28188f9bee61f099b7d254791a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
410a8b290e967cd8318593d4338853f1

SHA1
603d61d77f446774f783e45b62d7a594a0900e96

SHA256
faba6948d046862335866e60cb5f41c31fc5f0958784bb4b00c30e36b2a2715d

SHA512
fa8c5715eec0f0c9e90c733bb43868fcc15e0ec9065be333e15b793563bf350976ce071464e15f71cd7d0106e98feebff49af9bf89302b89c9b8f0a7bc410d65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0571bebcf1434ed3f3ddd9764c5a468

SHA1
aa21c3d757da859efcf4eafab31f1f26386b93e6

SHA256
144b8982ca505871544feca7d810760d7846a55bbe897d55992c71aaa9f9beb4

SHA512
e83d11ec7dccf83cd8af5a1bb80ca5d1836ec1d7317f99255f0c09a10beed55b27358d9c4c1ab3dea958d3fabd07764cecc59cb78eadfcaa5ea9aebe6c10e373

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0379deda982e19efa679e00c8af78a2

SHA1
d1037411019890cf7765bcffb86c1028a7c4061c

SHA256
6517c1d957d68abee5fef8f8dd3fda7f2ca8d9c54f33f50470681d4cc7c18aed

SHA512
158156f8cf80966a0f35bd081722a9f9373e63711524ca9f2923ae776358b6ebb246c7df33b5eff3ac752a4127262a5a76b965954e28cf44202699fd1b01fa28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea3e22f72440ed9e849378e57ef5365c

SHA1
d30182eab4eb512683dfaf85ee458fc127eeb686

SHA256
1f9dc6ff5086f14177a46900686b6713ada8736a5fc1fc107d658c80408b01e4

SHA512
6f530fc5563651c28fb60597f3cbca46a73ac5b1ec1ebccb8b468ec0d83c9baa4d8a6aa323a8d5680c5f0307a2c150e0771b468c91f45ecc93bec5aa1a5770a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2ea052093d127379a1ae995e5d04492

SHA1
2b2becde189d34939685671d994fc23d1224b5c1

SHA256
900ca0227a4c3ec3832cffb31a27ddaeaf519239a3c63f6ac0094e4a6a324542

SHA512
bb947b7fcb8cc85624bf5058f489ec61c1806764d5c59377bb6d89d69d657b714eee2f94e57f4a74287b04a6ae9b00d70c97246a1ecb7cb0bc205853f7113e5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c498f47cd2266a3668805c4427c57860

SHA1
d2d5512990a52c732017e43430c004472adb9aed

SHA256
9d0e4729311d1f06674d8a3a66e0eebb626e1c83eb8ce39d1c6c79b7b9f7494f

SHA512
eca4f014cbdf1e9f809a016166cf831d9d81a81d9255c79f3df4cd5017afdd5d20a1a95d4b3c66b6a6f4157ea4ef1099ceded8a43e6e4fe7bbcab2fdad10c3e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c87e60d060663d01f3f081202700085

SHA1
27dc84d8249bb201b3d19d78b170fcf18ae0e4a0

SHA256
30298294ab2453bc9f263253fd648dd0d1fbefaaea49e8b00279c78dbc838732

SHA512
a59270499a132d05c0252d3b2786c33bdc4ab71b52b9b1dd7c31ecfb34df27993bb7ddac1af4d48c7c1f2ebabed1d0c53c057f2368857c75a341a6e51b33848c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDFA6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE027.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit