2c5348e0be6f40da2310acb2a5def8a9f143d98f339d8adfcbc16a3fdf1d42cc

Analysis

max time kernel
149s
max time network
142s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24-08-2024 08:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be42bd2f4849b28b198a19c3a683ed9f_JaffaCakes118.html
Size

18KB
MD5

be42bd2f4849b28b198a19c3a683ed9f
SHA1

9deae97774a00f2abff5989a6f4964ee5671e0f2
SHA256

2c5348e0be6f40da2310acb2a5def8a9f143d98f339d8adfcbc16a3fdf1d42cc
SHA512

0ee3f093f3e5845403b6e9ea5d2c2c7b65fef73576303b5e1d26fcd12b0be8b97fff0bad70af52363dc95a65b723ebd25f68c9754a55750350dc0fb3e148b378
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIY4izUnjBh+A82qDB8:SIMd0I5nvHnsv+DxDB8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D6990B91-61F6-11EF-A251-667598992E52} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430651695"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2776	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2776	iexplore.exe
2776	iexplore.exe
1944	IEXPLORE.EXE
1944	IEXPLORE.EXE
1944	IEXPLORE.EXE
1944	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 1944	2776	iexplore.exe	30
PID 2776 wrote to memory of 1944	2776	iexplore.exe	30
PID 2776 wrote to memory of 1944	2776	iexplore.exe	30
PID 2776 wrote to memory of 1944	2776	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\be42bd2f4849b28b198a19c3a683ed9f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2776 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e81c7dd26023b4c7c0fa21c011b811cb

SHA1
3cf400f7758737d295937fabfeacd57cc8e12042

SHA256
51c4216e70c0b87837687074ac486e81493dc2cf628e052a6c7ab20dba46d6a4

SHA512
da20796da1f9a7a72af6726146f20962b052593d5a00e86b2ea2f6e53dcedc0479b6348c84975df0c9b26c3a37184a286cd88fb9072fd64bc2bc31544f2ec1f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f16c8d7c593b92c820d9b2977e809b0

SHA1
0bb86db9359881ea01335cc8c2c76ce644ebf5e8

SHA256
2c95bcd0dc7f987b3dc78fa98fa6713a527693c1187a76384145514fa2abfaa6

SHA512
6d0055b936293eb91d5a77880807a830824ab3ae1e2f320ba2ffc4344b92ac786a868b14fc4a22cc1121d8c58f476588dd63fe4795c4c6d35f6316a7b586e9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7617239c1298c5eeb376de605e89b18

SHA1
4216954b8c9e76929843c5f6b014d35f459cac76

SHA256
2df4b5e8d2d86dc68147883bdcd7e534c17d54c83d3e55f9962c50dffbfa49a9

SHA512
7f026dc3290ddbb5fb4ee02c0fa9c7a2040fc34bd8ea835c557194fd8da65be270d91e1b068d38df498b605805fabda465143b6c1966250bdb8e88b033f5b22d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6cf6b2944b5e54450e4df632f2c5ebe4

SHA1
a7f8421c860507577b4120c8986397d042488b00

SHA256
0ba079bc25bfcc23fa3fa07f3a702aca101aacaaf5c82a4eadecfedc95e98044

SHA512
2a33dbad55e92941d0caf7b271fcfa956a499558d5d78be9bce7570e878dcd6d1b1d6e2f9f6cf4ef8b32b09bb75abc95c5a3f110130255513ca390b4b8fea1c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
487fc9ed6192b058822d516b6f720a46

SHA1
db6e2ea57a5727e6ba887267eebccfc5a6fb50f1

SHA256
be8b08c54dca8769b5c0a408182960dd8e61673d73b8f741f1d86963fdd72269

SHA512
aad71617cebc8ecc37866cd2239fe9fa2c716cf5d3867c7d45a0299b12665158341849446fb8ea220d894933044757758cd79a665376513c579d25332a93ff87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc145b20b0ff69d93fd804191548b4d9

SHA1
e9386462427aa0ba965286c659d59798e7680d2b

SHA256
9919e7b699a355283ba5ae4b36cd0155a7d5fdf3a869b837bf9c3ad899eb2d2f

SHA512
a265920b6331bb682677d0f598e7dea04db6e12b3cd53edfbb3fecf808f80b6baa4b889867f2528411fef9eb74e8de6f9e9a6b6d49275894b55684ad007f3a8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1588adb8992173ff05fca35ccb14c6fa

SHA1
0353be08d96c940ff5fe9b81982442fccfb2e7d8

SHA256
d4479179abf94f01b926a06ee7cb034e9144da47ba99c3f52e12d86f716b02ea

SHA512
211fadaf9b6cd0c35b607f9537928403f43bfdc1037f76da15267dfae622ad16fd3ca0985e0dbafe408e433fa0e35bba8fd92be11a9a1013d818b3a8a689abd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7b7ae35ef1552c820d1989451d690e1

SHA1
a84253c78ace14ae5b25e216216297a9d8641983

SHA256
ac00a9b60a16eca4cf8460a12073eb7e027d3389d3e721b7e0adabda8e98d69c

SHA512
0cf12b11ada38cb18f0841cc77d5790238a59ef5e87ec074581add96d4de2cc231338a0391145d7b5df74c7331baadee7c0b2976799b7f7a635728f9b69788f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de0687630f75c7fc04780ae910c1ce8e

SHA1
4d7a74d4a73587554849f87cb0bc6b740f911afe

SHA256
095713254376cd6e6456d7da6ced92da15d06ad7fe51b4a2193dc6714f5c797e

SHA512
a7e2c42a758a9f601535d5c0535a3d488c1818f8af93350d69bfe70cf7fc1de53f7d8b79e998c6edeab3c03e9ef158278c91b59fe156a879509fa9bbc6f57e90

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB731.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB80E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit