61a38a4fb1c7f752ec5723374a06954ab02ccd420885dfe98d6f1e3704b2feae

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 18:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b48726c7de8a0921528cd8bfe63f16ba_JaffaCakes118.html
Size

37KB
MD5

b48726c7de8a0921528cd8bfe63f16ba
SHA1

3ceb8b740d624da2cc50e9da418d4ff2853e3d4b
SHA256

61a38a4fb1c7f752ec5723374a06954ab02ccd420885dfe98d6f1e3704b2feae
SHA512

b044ad33e511ac1fec2c6974d72c314b4f403fb4d96ae8a2fd974a65714de5d10f05dcf5b3484c62fae7696820bec016e31db3ac5667db1649dd1f124831f1b2
SSDEEP

384:1Q/SPNGzLmZCv+2H6uV/OOhXKkCnz96tOh:wLmZC5KkCnR6tQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430426311"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{13EB52F1-5FEA-11EF-988C-4E66A3E0FBF8} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2180	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2180	iexplore.exe
2180	iexplore.exe
1568	IEXPLORE.EXE
1568	IEXPLORE.EXE
1568	IEXPLORE.EXE
1568	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 1568	2180	iexplore.exe	30
PID 2180 wrote to memory of 1568	2180	iexplore.exe	30
PID 2180 wrote to memory of 1568	2180	iexplore.exe	30
PID 2180 wrote to memory of 1568	2180	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b48726c7de8a0921528cd8bfe63f16ba_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2180 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
088f69ea4c2a48dd032d831d2f6c3b9d

SHA1
ae5fcc0ffdc65fc25e0e5e68a40ef70be615f6ed

SHA256
3d4677565fcd03e3ae8c457e5e49f0e800bc6438a2c30344e5ea81a4a3f1ad85

SHA512
cda6dbbf669845252131de00701045e1ecb120d10579a31fba5acec2b09eacf54c4132948c9538f6ef24f42b8edeedfdeca8bddef3620f3de4d3eb71f676bef2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4b09e880d96387cfe21182041126088

SHA1
8b6c767bc6679d313c6100ec097d93c30f763e91

SHA256
5a77992cd3151cece1b4a5a5904553c168d795dad68e4cfacfcb89df34ca57f6

SHA512
bc6694f1a79fdf9a9346690439206e3efdfa2862dfa3a97e753c50ddfbccc5abeb02d0ac8e31529cfef64b8e850a3b6d49304579bfb4ffde6899d8861bb5ce89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ce64230783cd4e61befd55f29f57326

SHA1
9baa8f3d6da151fda30b42901f5a5d8fc83a9f33

SHA256
223cf65588c9e569226147570fb4adb067153e2b34661eefd5e71299d9ea6965

SHA512
b7ae7a3c926b96f81f1de24a4bf30e77b1020430d746536b06f07294ed1419d1c8bee06251e79d192a2270fcf585118c9b7a027f033ca63f9554ebfa973e9cf4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1222f7647070a3b1fc5a9b60fc167563

SHA1
5f9e33e53ded05050c605b533d35f865ce79df28

SHA256
aa084db282122a70a298f2c787f32814d5df2ae62b17ded002587e4c0dbe5c06

SHA512
ced62a2eb62c142b61e66bff80cfa7cce8cd45e411046ca54772fe9d32eeb370f8ca4a6473240d8e70b6e762cd114200f879fb91a2b030cbcc2a362c0001ea17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b93201445897958ff8994d283fadcdf1

SHA1
853779d5cdde307902317d0215ec21b2fcf2d22e

SHA256
dda5ba9872e34c3d314ced550d51b5db89c3501066ec474011cc4734f759525e

SHA512
f2f408f94a0d463505265f23db7960391cbbf437c5e70db51cd287a633cfdf2d34514fea6e845bfe963d3014ac990bd5ad294a8f41346dcdd49b16c87c50d980

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9492c5f25895edf511d6d9772723167

SHA1
87ae34399e7fe7778ce57aa0266ccc0c82445e23

SHA256
d7794e2492c883c79e1d55f12a6418803d587444b4df2678b166779e2e0c2600

SHA512
07346ad3b6864b03db953c70c7b309998e190fd51256f3c3b0517823313f7d2c77612b9051345545d834bcba6fc8b408cb30d64f1d693d3fbb001b06395894f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef5ae7123543437c7dd1d27e27467b31

SHA1
2ed7d73c8c47c1444033e5dd32877b48b1383150

SHA256
4f4a74eddf0b3ff151afb507ab46cf9eae518ebb94c5c24624b545b709f8c056

SHA512
c460bfd1e80288f811f6ff06558f605e760e68d985c0873b0457491b2c92760f68dd7572def1c5fd2064926326da47930fb22c8e7e873a9f5295b9dc8cc2e366

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b26a5a6b47ddaa136b6aa36744f27a83

SHA1
57391ea0fc63cc57c5eb5760ebc98f90fdad01a5

SHA256
b6d8fb60d4e756ba8848fca04c3d9914962759651db1f68912ddce2eb4be1f3e

SHA512
b5dc349bceaf9dea39fcc8e140a53fce27e9046b78a82da28c3351af5fb2f234b6f0e3ae686459ed6c8194c49483573069724523a0a113c9078afd7060c799f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd29a4170f0488258722bc79d04d8093

SHA1
0141c04b6fd24fe7a78e3501670ec7c865d26848

SHA256
51bbb1656483db4b1ca8d87c92e0de80d24aa32a2d4ec3287c525f23ba363567

SHA512
fdfb611c1b957f7979da00b0117dce86b5cb543c65ee35d4b638b933941a21dc8d6484c05508e70c24de423f95e4ceda5839b3121e54e0a0d319f8d5b86fd636

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4cc4c7a4f9fb6499c6543fdbf9256c29

SHA1
698977265e62c444aba6b9440a5263fe4139d438

SHA256
829125b323be4fdb580c3a1ba0c4149c61a0315eb4a4a281ada5fee51c668a03

SHA512
d421faef13da40f67b392fc5f9d940cb3d773462134f604fad305d244548f2aadfcd5be648807e3059853705871cfaa89904d75c2085614c1263594717f3f809

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab215.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2C4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit