353f7ff1c19beeba4074cf8e971fb79b12f070be3ab3279c9110ef25a8ae961e

Analysis

max time kernel
132s
max time network
142s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-08-2024 16:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

abc68766c3791645e338c8c1331afe57_JaffaCakes118.html
Size

278KB
MD5

abc68766c3791645e338c8c1331afe57
SHA1

12c1b84492cc613c9fa3a68ee71271bd23e1b562
SHA256

353f7ff1c19beeba4074cf8e971fb79b12f070be3ab3279c9110ef25a8ae961e
SHA512

32d0b69089777d657fb7d09cb7b5302a4b4dfd2ed029a489bb1b3d274e0f8233c870e5950f1263c03a4d55d5f0bfc86c77c4fda444c7a5764034d3bcda65e36e
SSDEEP

3072:3EnMYBmQrhB9CyHxX7Be7iAvtLPbAwuBNKifXTJ/:uMVIz9VxLY7iAVLTBQJl/

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430247546"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DBA98C01-5E49-11EF-95E0-F67F0CB12BFA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2356	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2356	iexplore.exe
2356	iexplore.exe
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE
2108	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2108	2356	iexplore.exe	30
PID 2356 wrote to memory of 2108	2356	iexplore.exe	30
PID 2356 wrote to memory of 2108	2356	iexplore.exe	30
PID 2356 wrote to memory of 2108	2356	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\abc68766c3791645e338c8c1331afe57_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2356 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
e98ca755e30d5a0fb99f58746661e836

SHA1
9c59c21d7bbbbec288c927defc4f22ec2ef69d9e

SHA256
392596b212b7ad52d7cc08b1b022f754c8ad38094b3bde1a6c9189317580abf6

SHA512
218b1b3f5564d0dee9b9b9898bd04f75c70ec2a9a8bb44c22d22af1693a68fef42107a9a06dae1cb22f925a3dc6122a8e1a63eb371dffa35641900a79e13e4c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f565fc8983f7cba390f3473bed420747

SHA1
2b36080af069ca4909e20dbb4e2a3eb34fb8f0fe

SHA256
3498af6e70760c7f9c7aead600c78f7fed03a4b42983975c5d9ef6a2b247adac

SHA512
9b4cc21ef553eed90eb5a925e32d0b00d6c3b5095e628fa660fca70d06f41a2751cdaa0031b1dfa190342090073bd7c771cc71f31829659c4ee9ee2e1ea7b151

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0cf14dad2c75dce3ed4b89a2a7e6f014

SHA1
ed4b038e36a9b2a3af093866dbf82fbe03b10c7c

SHA256
c736ebbc2c30a74c1dee3064cd561b442bfeb1bb0c45e7e7ac3e8f3e842fa9a4

SHA512
beede41f55284f68ad606a4eb5c911544b0769c5a0d392f4f4a2f03a50c234885223a66837e632f244856b713fda8087b915535127e050c966969f72f58aaf80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c7c5f90549f0cb01afb044015e203c1a

SHA1
2853c1e6c3a9bac889dcb772061723e67bea28e5

SHA256
e964b49899c605fdc06630033115322bf35865c31a9dd76ba16a2551724c65c9

SHA512
20f4ce0bf425fc566c0f685e329b3e3cbd1b074533e2c27a0b55920ee15f3d64d4f48f8f8a0e1a2bdea62b936e9164b9db11640f52750f33c585ff1be7167b05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6acc100f44bfdf436258d03d5a5246ab

SHA1
26814dc69dbf42b36a85fb28f61f5e2847f63757

SHA256
cbdd3bcc7dfd7c845586d06f0cf90c0506d1a49a58202368f5bb2134b8d06e96

SHA512
8136e88624c3ca22cce08fdc54259f6e55667d0bdb4e802d615a2fd31c33fe44724e345789675b2ab873b49b2543501b73426739aecc67dc88cb056c3b038b88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88cc653393bf4543a4539d3fa2c1c21a

SHA1
cd7bd1ed9ecd97e0ca702a65056d31553e0e94e7

SHA256
d8a0bfa96134123814fa5d36ed04c1440e04668c1711554444da334d249828ee

SHA512
7ad3883b3fb7e278b47ae583d9b87f4b914c6c0cac541a0921a35e196534f32ada5c9876b444bdc8344a7c3c71d8eecc48dc6db333bec5dbff7ce21eb288e41d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44fbc067dd1887980e9aff9d64015475

SHA1
78ab6ad63046f6c9f0ca969a8de392e9138a9b4f

SHA256
0758a7c6f3fa3ee8af8043d8eb53fc26301cd657802f42917b241eed64468f62

SHA512
3d42313221eed218a74810ef07ea6185e8bd99cc1ff3ffb901610ea16fa5fe99c7e053e3c21c9bf05b861be8277f8234c3c9299cd52e10c23dd06bcd9cd8e9b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3b8ee0692828caa5be3ef9c0e9d386f

SHA1
9b349aef3cc07c9e274703983e03c2e5ca5a34bc

SHA256
530de4ff5036a5f2936d22155cd943f3a7b25e7c21771d4435fe699f7248b50b

SHA512
826d31b1935da86535f11722b8970462db7d1855456dcd78c8efe6ad70823a8d39910ffcb29ad7fd93b4184dfbff54adf2c053ead49971b38f571f5841c4c32a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbe0e56ec83dd4b82cdd8ecf1afbd323

SHA1
6a4810dc9bd968e3953ec637279114aad6c4b60f

SHA256
e2e47caee2b913beeebceb0bbb97397ee2c5569c8787951a0f1dc4c241ef287d

SHA512
b35b774185b7577c4c00840ebeb60c1cdc14497ce4a4f1dae4224e26e0cd0d401edf78590972cb8b8c8769b6b82fe8a70c38ae2ca6dd21339b7771a122ab2c08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63aa58bf56b98dc97faec65c125d2147

SHA1
eb926156bcf83819f7252ded1a20110e527d2fe0

SHA256
2cb8da40bbea498d0fa94bfe8b582e9dbe77b6e464668786986fab74f7a4b781

SHA512
aa0171b2d292aa8368242193771fde4339a820cf3b95871c83b9e6f0162d24caf133b214d6bf5f1d7dcfb3fc3f19fece7dfe4c013ebb5fe4d783f7b3a915fe8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
891ce07e19cd56c602d521f75fd974c4

SHA1
f4d7a2e0aaf437fc0aef5a0046a7f8a87bd4bb3f

SHA256
a1893ce6f6cf8b90bf4bb2ef4084d58babee27ae56f6903835d91a6fe761b036

SHA512
56748814d999da8b80fe2575e60605369297f228e9e571fb12b1766d734aba3758394f272dc0eb1cc213ae1bb6f3be296b9dabb8bbe7a3d84dfaf7de875df57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9BA5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9BA6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit