44c11567f924eedaaf263f1e1b58a3e6be899ed7a5d4858b3156633f25050a32

Analysis

max time kernel
132s
max time network
142s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bc6f88cb8b7d58e7ca4097f4c2a5d58f_JaffaCakes118.html
Size

37KB
MD5

bc6f88cb8b7d58e7ca4097f4c2a5d58f
SHA1

8663f7892fb8bf8ff509fb32bc3a4c7710301b1f
SHA256

44c11567f924eedaaf263f1e1b58a3e6be899ed7a5d4858b3156633f25050a32
SHA512

ef2fa9867d8ce632d7c2c6a53d3a0653252a5062ac940c62029d3db8ed515c1af6aeba8d39b816fa1b2335c0a6d17d8f418ab63418a05ba9dd50b4754918d427
SSDEEP

192:uWTfCb5nLINnQjxn5Q/XnQieeNn2cvnQOkEntFZnQTbnJnQYXC5AVtk2BkDyIFz8:4Q/QcqO/7IlGi3pwfOf7

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430591485"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A74B43D1-616A-11EF-932D-5E6560CBCC6E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2940	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2940	iexplore.exe
2940	iexplore.exe
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE
2264	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 2264	2940	iexplore.exe	31
PID 2940 wrote to memory of 2264	2940	iexplore.exe	31
PID 2940 wrote to memory of 2264	2940	iexplore.exe	31
PID 2940 wrote to memory of 2264	2940	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bc6f88cb8b7d58e7ca4097f4c2a5d58f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2940 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36cecb44a8ea7bbbbadd5c6137ca687f

SHA1
02e6f7cdfca45da3f0fee3ba4b45a0ec0a25c7a0

SHA256
b638a3d8ea8330ee248c849af602cb76299dc590bee861229c94bf8b2d8cba43

SHA512
3a48915dc5a6c2641c162255c4a70c2981307a5a13c12f492258fdb5ca45b0a4faa74fc0d6f025fcfe28e0a98161b0ee175cc24205098af2705bb0163c31ff12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9d99dc42008e11b4d424922c9216fa2

SHA1
35e673511a1090ee91dc69ff38fc515941e63817

SHA256
d32d4d234f3df2bf41c85867bedd38a166196bf49978d5483efc6e8303b75b8c

SHA512
60a36ad8bd4a723f87995681e215a60fba57394854d39189f79f37850ec44fe40685077d2210d136ec44ccf2fa82b37c9d95a0d91fbc32fe03ea0347fdff9f0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9fd109bb75f8b7e2bdeb6d65aca3d97d

SHA1
27102a37b246f1a42684f5df19771234cd937d5d

SHA256
0c7968b9231f80385ed38ddda3a344c794d6e98922041595c33f36933cd13349

SHA512
9c2953788895251cb318be7f8cd0d8ad737a2bc0ed531b675581e62089c0fb0c01129f5608a1b5eee252ea7b3ef46030365a3647ca17c6d14c2f24bb90811abd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1df7066ae3a403e506d8f23cbfd4e4d0

SHA1
6c6df9ec34f7ef51f9730fd70d976286b33af091

SHA256
6627963768a09ed15fd454a12ccad7455abe6f64377d14db0abb8fa112de59e6

SHA512
ef4b53adc7eaf1fa4e0e5836ef7234d41d83c8aab7b95d6588c9b2ccd450df729902af099adad1572198527cf0b9a1b05e8c19e045669804898fc98bd0ec4ffe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a171d5b5a5e415a3ae11df1fd87c6d1

SHA1
0d267f5bb4cd8b2b90cfd4bcf12e3f7125c56cd5

SHA256
5a5a21e50a7bfcfdca87649f460cd53b18342a7ff315265899d0e0096b34e413

SHA512
005504d57162757651757db2b8ef7cd16be23ceeaa2b6c615a08cc108b506de4fbdc3bc819500f65916056367e72a898fff698e667ea5110d0d918d785329e41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75d9745286e30554695bc007e6e85c3c

SHA1
5fc243c224a71b2744eac99b66cd78711dcaa7fe

SHA256
8243aab7b75a2eab730c4e3deada1a75deeae17f029dd8121dcfc255b59338e9

SHA512
41d54d1e86af2fde936e961a70f482d03b055e3be26f775fc4cf5c1eee85abcdc2c9ec2d01919bd2bb0f9ec3dbc87995b9dfd65c7317b34ddb92a2669f989357

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
166f7577aae5f17ce9b098b5f6ac17a5

SHA1
7c0bfe4e5e96c78bc42abc9172d87ee334394f65

SHA256
b6ada56434781ab4506eddd0280a74337e173cfe4ce68a4f060468bdab96ade5

SHA512
76d4244468b5b248d21f60e5bbf19cf44541980d63d7019971c98476f2dd30c99d78687fd87e5c563c740e5a481991f15e234acecf43fcdf5f70386c03ee5afd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f60d36e5534dd1b59bacf9b6c568bdb

SHA1
74715fb5595dec5a7fcb9985d4844a7f3f5da7a8

SHA256
2f48e191a037795003c1abc35c149a6cb4c4a4d71b21fa5a28b87967dac23fe0

SHA512
8bfa97c8b329e72b908e19685bc20095d85871a39288c21fc840bc7e9b2b514fc5ba33e62716799e2b3f33e2639439b77cc37469cf30acd87aa030dce5029c72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb018a581309ee2983e7d714af2766ee

SHA1
b6358719e9c12b9c0d6a57273723485757599329

SHA256
09adb9455bf160075d91452455e110863352a5a7f3973267de875966d0b4aa6c

SHA512
afcafe8d22c2f6b6fa85a44e45e83df65befee23a9b0afac57f742985693d3bd5c7fa807ea455065e36401012eda50ebcf7b9ff8d8b32ccfd1268f45b478d3b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE938.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEA06.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit