5ae2943a1e0bf5982db7286c3ecff47ebeb93e2d2ecc00c9e660b3f0a6827563

Analysis

max time kernel
132s
max time network
147s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 20:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8fcd9e99e3bbf86fe9cc9a26723ab20_JaffaCakes118.html
Size

32KB
MD5

b8fcd9e99e3bbf86fe9cc9a26723ab20
SHA1

7884d3514506c81b4362123e3b1ba98ff7a9dbf1
SHA256

5ae2943a1e0bf5982db7286c3ecff47ebeb93e2d2ecc00c9e660b3f0a6827563
SHA512

8a6458d1482cfa588a91aca466b651b81db8bb6b60af737a5a3c13997fb8bedca3b6d7d1edae9c7f90c98ff1bb208822b46c3c36aa05badda884bfb53b8db74c
SSDEEP

192:VWCk3GDG7GSFGNGeWqGUpGtqhyjlb5n4DS2nQjxn5Q/inQieBNnxOnQOkEnt2gnK:ACk3GDG7GaGNG9qG8GtHQ/PIWSIEQ/jD

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430519418"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DB68F751-60C2-11EF-AB71-E6140BA5C80C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1412	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1412	iexplore.exe
1412	iexplore.exe
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 2968	1412	iexplore.exe	31
PID 1412 wrote to memory of 2968	1412	iexplore.exe	31
PID 1412 wrote to memory of 2968	1412	iexplore.exe	31
PID 1412 wrote to memory of 2968	1412	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b8fcd9e99e3bbf86fe9cc9a26723ab20_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1412 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bdb914276400cce86d647e5f4367483e

SHA1
786be762d977f60271d170f54708f7a880bde2a2

SHA256
39fd4e0e8807ba48dc80809988420bc685da3ee9262b5f396905cec513fd53f9

SHA512
73847fc9aeeb223b72807953a6be9272ec74bc7a96eb0568a560102772069bf8b79c35ca2d6c1d6dc96715236a698e29247ad980ee11ff1ef69a235972bd7c02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ce922028f794b9346b3ba36abdcff4b

SHA1
81ab7d703c72cb3f28b654210d431a29dc1a14b6

SHA256
0a59721baa26aac1a654970318b8ab8b02997595502f6c53b1100240fe1a7979

SHA512
7458424b2a36a6626a9920f33fc9558593352ad8fbdf815a48c994e30712d0540406baf915c339ff292abf310a778f81d5e435cb7690005834dc250288eb85ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a074127c8aeb169b643957063586c970

SHA1
306b40b8736628ba37e59fcd48a38a66d0612b9b

SHA256
ed1fc0cea7101ceb00932b4799a7cebafeacf13f2fbc1d3680275a70e00f96c4

SHA512
deb602957376a186bda4c14c9d72de52e6bcaeeddbb67e3be6c2e754d600e2ab50697140028f78e38e6cb72e7bfa6ec2e9a8a84d64974e66378fcbd4b391ca0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b48b30828eb6823ed863527ad5684b00

SHA1
6564bbb164e9bcf80a67c215d00459fff3cec0a3

SHA256
516f894865928a425f509d0e01dbee9f8c2b2e625d233826e87696781c2fb1b2

SHA512
1e91bf0cc31ea13cf0407c0502a6a2b6f5cfba5ad33c0bbd344e568f7953459d945f17c9d8d6a1d2e029ecbc3fcc8de43686fc2c5644ddc2a4291dc037d48590

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90a78cda1c90c885cb89f0548653c064

SHA1
47a7739be5b51097a021caad585d8a2ce9b56ebc

SHA256
fb3976220842784da2dfe2bed8db0e7cf93e3151eefcf3d86c6614a184b2a80e

SHA512
8432b33c72726a0541807364632a593f616545e0e5fae4124e4953ea30b05e041656cdfe3fc868a6bc25a7410ef66957875dac470e1ea97ba428538ee1b3e319

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a3bc2760db063986106d03401916bc7

SHA1
ab0bffe76628bc96ea93bed2ea240469aa36d8a4

SHA256
6286a25f63a9ca2d3b3f59a899221c44e062d3c6e34bd48ef1f9ecc30720739c

SHA512
bc95409744f35da43d4936e42febb949e7527f0cf625c5148c2fbeda775258516942374f360ba9f9cb754c0c0a9b9831ee6e8ba1f201b2640fa3afd370248dcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
560b4df4e787df98bfc97685aa9a0031

SHA1
98536a42f5d8a1db3d5e994eb643336e2e1aae69

SHA256
09ee9f4b05a71ae2eca88dc1d3c832f46f697c551de0fbb546c5461f0859a25f

SHA512
ce2c1f3d8c0bb15347ea8ce193052d04ae615aefd5a24ce2adeb0a73820a9fd1049a7a1481431e83d5f1e260ee12f27464901c7b6c09ce3960b6fb50ad8376fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93dd070d437a9030c27895be350329a4

SHA1
a72b8dc046ab24a2f1e511a0344db202917f06f6

SHA256
d379883c6b21bb4d70cdc9bd913ed3025aee8b38def72d2bd065d1471828a8ac

SHA512
04a5f178a2b481ac4807e41f6b548b24bac6679128b38233b03081c203bc940f4c27e5fd7aec30167f40bc1e178204d8bbe3d23506dcd352041af98d7ff0fc81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f2e74fef62021e8d270e25fb339a3da

SHA1
1aabe3573a36f11a32a4bbc99c089803cb57635c

SHA256
b3b5831339775d88c9087c2fb9b0c817e5c627a6e79348599a585d7a3fc13d6a

SHA512
c21e1d283f4274e8fb5193c1e8994d049e32b2e6118855f6443021297e65a3fc53d3208fa25f8b23142c9174eeb3e26c6316575311e5577f61676bc8caac6ec0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33011862fa96ab017fb36dec29a6653b

SHA1
760b4e304db3dfc2adbeae9be3c02e20ec0b27c1

SHA256
73509949b3a974305905e5439f1453481c4ba781c3224c87624ddb0430dc4272

SHA512
11ea23c66366a229de68e2fc55c20b19476713a0225d1ab3923d2595cb208a474ffd55e3ba17fc470fd4667bba7f2d54b1c909992b00aa47ca36a935635692be

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFE8B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFF6B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit