c15b7c971a6112aca3e336162729a52e33dc171e11da91c560d8a3b25e30ae33

Analysis

max time kernel
131s
max time network
133s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 20:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b0c476a91d6116e2a0e3879ad5495a52_JaffaCakes118.html
Size

17KB
MD5

b0c476a91d6116e2a0e3879ad5495a52
SHA1

cb1991caf13bb21f93e9309e3805a83bce3a3ff1
SHA256

c15b7c971a6112aca3e336162729a52e33dc171e11da91c560d8a3b25e30ae33
SHA512

57c7b5310ed9de5253308058f40e8a32c0f6423f99db615eeb534f8e21051078e11f0368a6c0505bd9ce2a9391b9949dc45a725e1c7869bf29c3e16739084351
SSDEEP

384:xhlIcsTrtl4EvR1NGTHrZpJ1YaGDyq/gbJaguLZ:8TvvRbyoglaxLZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EAC13761-5F34-11EF-B36A-FEF21B3B37D6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430348503"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1964	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1964	iexplore.exe
1964	iexplore.exe
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE
2656	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2656	1964	iexplore.exe	30
PID 1964 wrote to memory of 2656	1964	iexplore.exe	30
PID 1964 wrote to memory of 2656	1964	iexplore.exe	30
PID 1964 wrote to memory of 2656	1964	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b0c476a91d6116e2a0e3879ad5495a52_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1964 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b20cf90b55f7b4e18484d60b5638237

SHA1
2d579385453d28875340a7384ec5e5c5ef5bcdf9

SHA256
8e4336f6f45335bcf237013aa0dd5304434de3e72bdcf5e1fa119efa0c72424e

SHA512
afb8466b37e0e24592ecb9392739fa071511af376128605f96239c86e2411641b88e9a28548a605edfc49ace62d26e43420e3f6f2678dc4c38865ed735ed5e89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
942af0984ecdc05af660def3fc9136a1

SHA1
083f146057a84fe81f5cf8907588b0d4a7ff6ec3

SHA256
8a66f841d9a3cfa9a055cb5098ba06db7a452618b9848dfcf6020857e7bef65f

SHA512
5f0ba8091baf6fd71862bb9617c3e2d4c839a58929d67cec7d9587c97539837549ea0b801ca4b8227089cdc258b2066d575581994d1595d3d41aba0dba31cada

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb40cfda0e25f5cc7b2b287c9f4ed6ac

SHA1
3ab9a15e174844d9f0e766474cffbf87aa397a3b

SHA256
e2d709bd6694c1fc9caaab80eb58e81845efdcc69585e4a242e8adc94bee402a

SHA512
5198cd873c384b50680032fc73b31e848b113204983a6a727d3215e82b9976bf627a7bbbe0d12d44a21ce12906bb651ba147a2e62faba9951469e7029672028a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9502c896f0dbfde2852bd5060a748208

SHA1
15110d8bfc6c7c4d7f3e46f30124c216aa1c35c8

SHA256
e513fbe1decb3edf692c6aa707d882ebed79bf3c9c77e5de6ac7f7dde5537117

SHA512
a9eedeb84ff5d67fcdac742e15390e66da1ffe32ce07317e19c0a1291d656111556ead0f7a10bd179c8a5ff2ff868787b3710c0c48670efae0ea33220962c29a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20252dcd913b25bbdabda828b27de18c

SHA1
7dbf780761a50affb0b9e3979991d12699c96c02

SHA256
e3faab2765d091ccee0dea5cdda514fec9ed90b0ef3e5b3314cef5ded6db3ebd

SHA512
f64fa327d1976eeb65bdad5ca623463a1cf0ca78f75e060271622b568f865e78a8ff3bb6fea3d1af49524620bfdbcbccd2511f06d465d329df84cb3bfd0741dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74b8e6d4e28518439478da1e2559b1fd

SHA1
06f277c90bc5aaab9624192cd155bfea5ef57315

SHA256
b74288327f0b8a63ebe888064cc59acdea662e6be8e5cc239d0eb24bb5100b4a

SHA512
f145d64c3957072a581fe0e51e2af73bc528937eb31c5a26d5c1b34d5496f4434c6e9296978b06ab3b53ede9f209950e8c902812073e06c7f436c334df8a8523

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c5aed0b0ff228862d257e5edf998d56

SHA1
2a7700f5b6470624cf6c90f95d98b2f510891311

SHA256
df6883bd25a722e7b5bb37e8230cf74d8a01595458639b7269e1cd11927153a0

SHA512
7b0f293144cfb71c259eb5a62c727d672a2e3e492552f804b18886797475627858f62ec586572fb6c6e15dbc13088edb18f0e342d7bc6ed53559385e687c24be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
127df873df69b30558ab525ede48ca03

SHA1
d683d0b5147d6066ec2e3b09ce589595e4deb052

SHA256
0717647b85ce6672b6e9b31453243a3b22ca06cba04410a731ca9a373e9c2bde

SHA512
9c511630b91432bf8e248eb4e89ebc39bdd888875c5e2c67030bf6dc7f3b9c50f2b803ade54c2c6c96cb16b39353dd0208aa69cba868aa2224fcefb65670ea1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
717816c4080fe81c05a22073363407a8

SHA1
d9b4e7421bce1131c33a43d1e92e0d11a1a9b5ef

SHA256
d01d2bd566d8bf54a3a07e5c843b27f48399e4768d661f0229d22d5e9eec3bac

SHA512
aa7c92976064dfc0783be6b10251cca53e938fdcde6af8e0588182e45f1ee9ba507c7afcfc7f5d829ee39f38a18def52bcf6db4ffc22087bf380cde78f2f221e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC063.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC0E4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit