85b5c4c60d73a8bb48e2ecc4002d077e4d1ebd78825ad1f8d77890863b8d8d4b

Analysis

max time kernel
140s
max time network
134s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 11:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be73f22373b60368f5805bf0f62dfde0_JaffaCakes118.html
Size

36KB
MD5

be73f22373b60368f5805bf0f62dfde0
SHA1

097347a60fc6d3fa91f7744610bf96c94f7239cf
SHA256

85b5c4c60d73a8bb48e2ecc4002d077e4d1ebd78825ad1f8d77890863b8d8d4b
SHA512

16b9c97ea6eae0441d0a798465b916c1304e7f9f95883c872cbdac404e9cc6382a6ebae0d91a068b8e7abcc80cb9cda9e50ea72de6452c58e8bffecebfba7afd
SSDEEP

768:A2riIhTzj5G2riIb2Kt0idOPeBzFJExak1NxPeBzFJExak1Nxzav/hw9oldZVuKx:A2G4TzjI2GW2EgPeBz3Exak1NxPeBz35

Score

6^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3756	2320	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3956D8A1-6208-11EF-991F-E297BF49BD91} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430659165"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2980	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2980	iexplore.exe
2980	iexplore.exe
2320	IEXPLORE.EXE
2320	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2320	2980	iexplore.exe	30
PID 2980 wrote to memory of 2320	2980	iexplore.exe	30
PID 2980 wrote to memory of 2320	2980	iexplore.exe	30
PID 2980 wrote to memory of 2320	2980	iexplore.exe	30
PID 2320 wrote to memory of 3756	2320	IEXPLORE.EXE	32
PID 2320 wrote to memory of 3756	2320	IEXPLORE.EXE	32
PID 2320 wrote to memory of 3756	2320	IEXPLORE.EXE	32
PID 2320 wrote to memory of 3756	2320	IEXPLORE.EXE	32

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\be73f22373b60368f5805bf0f62dfde0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2980 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 4052
    3⤵
    - Program crash
    PID:3756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
fff72d938e678b6260fd1ac6fcfef7e9

SHA1
4fb1e221b2d6d6467b29f6a048fde0906f0a8225

SHA256
19d9da10975382f64076b274dcbf3a1d5e78591ef1ead5b9a60e23c52d5203a0

SHA512
4ea1f023de9e100344257072a9e7169121c3b8ed15f5d51cbb05ab89a2496de495564a5ed0840852f4a1b2886cef1088642c30673058667c55a263894cd3140c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f31c99894863678219ec36a35f604573

SHA1
9b2ef507851a51546160a09f26d9ba2a6842b305

SHA256
3a1a46e7cccbc19ede8315ad6174c00bd42ecc253959c7153b5e3fa794186f07

SHA512
e565bba44bddcc4151d29e0fe496fcb52276e5969d603dd7f2668f0f37a23c09d9a27cbefb352af568ecc9c650b23bfc63fdc27be1f2d3e005beb7af909804dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69e306ab524b671b6ae18a7c820faa3c

SHA1
5c3e92f4d8409666faea023243b142ca8f54daf1

SHA256
6a4a03b758e1b4e25327c898e6e9b161e2b78657737471d165cb4711717155a4

SHA512
a76fbccc69a79d586520dc07d843f3a14a48cfab0845398f6fb5e85632bdc8f079cf2131ba465f1f817d5203bb6926be53e96d119506cc31362b2d442302846e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b828d2d300a1cf5faa85f6c57461cd19

SHA1
5ce3bf3ad2d802535928db097ce72a459902c816

SHA256
76e00427c7a8a90987f7e71e9103716f9c880193a8e1fa15972a5af45b9640cf

SHA512
6fc07689eb2a260d4a8db259663df96da99e83ac45e3d62f9b37103f5c47b79ff957e573a7d1f8c64cd9b8016b66c2c0b72f6d646ef67455cda6b92a60fbf58c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
c7932ec7b6d173ea8c87e1a4e8a6eb11

SHA1
9a2b7224f37fd2075e79b4fdd8f228ab095c89d6

SHA256
43ae42459151c474bd57b10ad59f5c0667dc38fa1227030c25fa3281cf584daf

SHA512
c34a6e914b4665ad80436f13bf1afdd6fafe6b600d909026d76cb353fdcc83ba6f94b0893924e42e2ccd8d33584bdd38ea02220aaed6a946b82e6023c638ccc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1VX38S3F\css[1].css

Filesize
243B

MD5
6daf2bf9de882caa6bb24104b5ffa025

SHA1
7f20892a8d0edafbbf2d65d9c0413207fcdcd260

SHA256
90fec720d4b316104eff8ff065ca63ca03fdca3b14404ad476d3adf1109418ba

SHA512
e9a2add09d394b7e3f0ed0069ba98999e77b426700c9bea1de91d4481f6fb16be983696f57171a045b77c1a355914f19d73b5d9b6c4fc8af5c5ec3fd2373359f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M7GT0RRO\css[1].css

Filesize
1KB

MD5
0743c5642f1d2724766198735cdb82a5

SHA1
720fec02d2bf9ffe79b7a0ae712cc2cd9c6c0dc2

SHA256
08515102a4fecee1125494c3215acb6dd1c830689b4d9420a1844af1ba01c492

SHA512
0a44c10e0cfe8ce24741fb62d9dcebac609a0746b2439c178b74bdbd0c4ae36cef8ed973b8a4c1823123fa475b000fd39bf5734b03135b4611ba6d1fbd6f6f5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab91A5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar932E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit