cde987f1cc3cf82078de20800e8355e48f5c5e1b6607620d2859c7cfca5702ed

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 06:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b267ef2d7c26b0dd641acd0fdb6da699_JaffaCakes118.html
Size

34KB
MD5

b267ef2d7c26b0dd641acd0fdb6da699
SHA1

c339fb6161635143bc1c674899139304701ea042
SHA256

cde987f1cc3cf82078de20800e8355e48f5c5e1b6607620d2859c7cfca5702ed
SHA512

cd3b81df97d0154c98a27d13be2157ef871477ef852e575a3787d7c1063efc3cc453d0aebc4fd4d25118725e049daa086230a77255c63296ff12542061846f7c
SSDEEP

192:uWXbb5nvUFbnQjxn5Q/vnQiemNni9InQOkEntBBnQTbn9nQhXCiARpW+knaZUcFQ:jQ/EeDSsQpY4tHp/dz6LNMON

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430383324"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE4858D1-5F85-11EF-93C1-E2BC28E7E786} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2868	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2868	iexplore.exe
2868	iexplore.exe
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE
2612	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2612	2868	iexplore.exe	30
PID 2868 wrote to memory of 2612	2868	iexplore.exe	30
PID 2868 wrote to memory of 2612	2868	iexplore.exe	30
PID 2868 wrote to memory of 2612	2868	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b267ef2d7c26b0dd641acd0fdb6da699_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2868 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69269e79f124ef4fc7e59462ff6dd0b4

SHA1
dbcb42844f8ee23ceb938f94b83ca7d7ee8b174d

SHA256
696082f884ced4e33f6f1cb7eb59d272a6d505e9cdc04499adc41c3814e08474

SHA512
777c0b8edc9e24b371203170dc740ad47cda59bafdb6134d96970c0fc592f8f64a5374f4f1c80dfc7c2defca853eab1cea0fce24e706a4ba9c5f55accfff25dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c9d78dc88cb3e929b4cf057845ff086

SHA1
a15b7c65a49e0fcc0dd2dc27cca5e42fe6aa1764

SHA256
ae41403a4dc39f59773538501d715799960b95f115b0928f4849b14066341ce8

SHA512
a8a3a2ef5e804e3dc47ec3766f0c1a74a70fea2652b0cf3eb0e36223462380dcbef8f918e49207ba489d82d29f1626a393934ebd12d01de50b84c4b10ffc409f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
223757908f29ddbe3f13660029b23606

SHA1
3e920b76bb4f39acb65e07c4b2a1c39caa3250c8

SHA256
dbbbe9f385faab7e4105c7719de06b0237ca47138681de207f0532097151e211

SHA512
bcd7037bdc3b92aa9ed75641648bcf2594692787569a582b9b3395599bdfeb5b9ed4fde360dea4c394b52856ac1b0267f4b0ae2fe7a3bffeadf342e3f0f0060c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
317094f677dd07e42404366721cc7133

SHA1
820b0c22524fdfc007b38224f58909a15b20b858

SHA256
1b107dd879afa323431aa960aa999697144bf40d688298ac95d2ae053c542adc

SHA512
f09b653b865a202c1c39c817e48acf81652305729b0ff1fdfa0859e01e417874b8494290ae5f7daea49914f48f16449b16daa423f6833a8ae0120fa43f2a2ce7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6dd031fd11fdc53137900a316cad5752

SHA1
710258911f11a42451a6cd7f3dcb91c64a54ac7d

SHA256
6f7b55dfcfcd7a2c8d32de283d19fd6e8a9e5f09a69d0ba5ab6184674e45308d

SHA512
e2c4eb6717b7f959414f0b9e248954287c674f9804fb89a61dbe79bde1d09338523abae0a6e7620b5657c0eae7030cd95cc2f9d50573e50583911df5a8f9ff82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f8b7c36ed3a428456d2055fe7898bd3

SHA1
cb4db5a193ac4b97cc1cd8a01928cfd1178c2abf

SHA256
124b72fd7ecfe729db4179303644fd266ae9189e1aa6c20a02bc0d3f8587b409

SHA512
0d2624a423933a86f13e91dfed85491bf8c4a7f79755a6dbc25bd8f4b6f941c07af1d1e4c904d7d8c32b79022947f526f8b3b438bb1f3e25122235863af2bd72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e261f1ee422e6901cc872718c539220

SHA1
0a7016bd2d47638c4b23c7e2dbc62ae45df09fca

SHA256
2e330f61935757b246676d28ef905d4129903dd0fa79e4bbe23e2b690adf1fac

SHA512
b9466f109ef5fafa8da2a016b6f26dc193e25595623a412ba8f5fd607b4f72c71b3a74afcc02b8c2b12f2e4078fddaa54aa8f3fa119fa42b16234e0ad070366a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2badfe20bb26975d800721eb7f943a7f

SHA1
21dfcf0ab94edd0d147c0720196b284b04f3ca6f

SHA256
51a1e3cc26c34844a24d36aeada544312d28ee94def08254a0b96690dcf45771

SHA512
0ed31c67d22b4d47428ba88b9abc46f42370a2d426e766f95c974f059e577c00f05f68aafd78d1daff5f121c3f1aaa9f54398e1b855f47c3dd4744f6111f166e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
617356730ceaaa9e0498a0e28e6d59ce

SHA1
42ff74afec77a6f5bf02b6aafbd2f46b2a2a5e51

SHA256
99b2c8751605e717cc2298657f8a4145d37c0aa78df46d75f78601232b108a1f

SHA512
047699aaf89847a0acb0c9090fe51a28c34b5e584a4bb4c2ac3272a299effa3cd11e7f935bf7b7fc6f8642eeb71e6e7fea3fb3bb9b835f6c1241ffb2f6e1671f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1D02.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1D75.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit