cbd56bf06d582b32a2b34ca3a79ca0704126117c8100f8f6b0cb428e81b67170

Analysis

max time kernel
130s
max time network
140s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
24-08-2024 11:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be7fe2d0c836c97d74b7c12704277929_JaffaCakes118.html
Size

23KB
MD5

be7fe2d0c836c97d74b7c12704277929
SHA1

2f9a566781145badb32a5f2f5c711d9cf14cf4dd
SHA256

cbd56bf06d582b32a2b34ca3a79ca0704126117c8100f8f6b0cb428e81b67170
SHA512

79b67c22cac4cff5c614528de4c41ccbd3688ca5fd634a70235b2774276345eab0b4200e6fad83ff3f509312c03302e612b9d29c7f368f20b7f6804254368abb
SSDEEP

192:uWDAb5nKGnQjxn5Q/GWnQieoNn2EFnQOkEntggbnQTbnxnQeCnQt6wMBIqnYnQ7w:3Q/GpEawqJis

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6D32AD31-620C-11EF-B6C3-72D3501DAA0F} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430660966"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3048	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3048	iexplore.exe
3048	iexplore.exe
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2352	3048	iexplore.exe	31
PID 3048 wrote to memory of 2352	3048	iexplore.exe	31
PID 3048 wrote to memory of 2352	3048	iexplore.exe	31
PID 3048 wrote to memory of 2352	3048	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\be7fe2d0c836c97d74b7c12704277929_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3048 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
207cccb4f270da8a93b06ead08504c0e

SHA1
fe648d5f7d47acf69766b9cfd43095f572c6ab15

SHA256
f5348f2f3e4c00807916031b2bf104cc43792c79e251b558bb9fb363457b9081

SHA512
0d5fd16fdbd91190f7d2b89b19e2c99bf0d5c7ce76f35493d4e2a44a2a0e49bcacb1aed75377283e701f0dc8100a499ece61fccc139c6e707814f9b9a39451ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4bed71eab3abac855e7e3b7eb1d96c5a

SHA1
6e41c232e6fb63d135032ebfb729443e690fda9b

SHA256
325fbf042204eee4489a140e0689e86f5cda8cd323972fae4ea2f125f17cbca1

SHA512
75b09214e456230971735d89c8105ee2eb7cf75ddc5f3bb0adddf09e8c0348ab984f9fbd4986a133f8cb57ff9a44e5868fec7f590de398884f1edfddcbcbfda1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb22d34cfde672605c4289e03cf28b37

SHA1
19505edbf35ff33bbca527b3ffb8d4c055f17426

SHA256
c7a1286ac6cb59dc7a81819cd5f7357eb658f95802b003e477cf541303b6160a

SHA512
d402195cff33a1ceed17f33a59cc2f3b7186c097e6eac3808e972bc00261b23a50207bf4d89583a5c8b340a29cd171f69d1873ccd7761ec8d0844bc761a438a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3426ab737a59b63b70e8a75c5d7a0f40

SHA1
d9605e17152cdc089f8f60ce0bc5c3323831708b

SHA256
18c198f26a63c4bc6d57bc6b4dbd8a535f93caf8290aad2a3810bceffc9fbaf4

SHA512
b4d8fa0bb607b5c797e6f5e331d4260f3e90e64e1b3a84611bd469fe5b82e3bc1978657da11d8120ab4d30d0d2bf220d971d2335f7db3978c4e07231b172b15d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07077a8a95970ac6552c448ee404b428

SHA1
4fdd16a4d9bab241ed89eb0da1bc11907341b3aa

SHA256
b05cc39d3db521a72cd436e7f0ce306043f914d04dbefa7c3489a00f76913ff2

SHA512
13e4f5db7bc64d6ffcbec8276bee5a6bf59317727a8fa3a1425c989aceb91c8750b37ef1aa1f3127f635b5c180d1796c172f13c08cfbc02dad7a1977cc527765

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b8f442d59e0abf2d55a1291c61d494e

SHA1
556bed4828688979460ee80867939bd6911dc534

SHA256
7ca4b9aec0bb334cb4af3da75f90221b93b10c967ce4233921a8488041a52cf7

SHA512
83e1e3dd67650dfc36ce710e0b7a4abe31be49ced967edd811da36e90c1b5f5ddc0dfe440a1929ba371550d3527a20ddc4320a54478eb2683f52d2adb1f007b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8388a75aa36ac90536676107309d8b5d

SHA1
5e4b7115da9803da24b3d8a4f6251ef8f6b690b5

SHA256
3b1cfc97d0001905c03117542745d3d4fea922b5ae319fd4a6ec78a8c6b6bc58

SHA512
9e24dbfb814416791b509f7e741510b9a53ef5d51b38aae79dd988d926201f867d5a810a930a397209c261d4a712345ce0c5073f73de0fb0890c0f47e7c00f4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b426c11b94214555fde4035c88fbe14c

SHA1
00891a6929bd7df9b9be8d451b8f1b03bea29561

SHA256
39370f3c299d7c9b61ac03f77c96d51d78b53563237641e6c0ca055a5e418623

SHA512
abf4a685d9d60ef72b8dd9cae065fbe1267597032070c331d691dd6cacd16adf13251d1602a2537673c9d72168178733bd8d0879d0989999fe0fdd175e1bd7ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a766b2edbcadf37a6490286cee0d8033

SHA1
8bbf71b66d38094e26a5455d29e9633523052b0b

SHA256
971e5fda1d8ee2c9e763b4ec37e1d23b7fa67dbe9375e0c6d8133bf5a68e2c90

SHA512
cc1551ca3feb593fb4150fed0982723d804710c9acc50ff914b3ac69b3e4a42ae6acd66a4a17bda2e8c297343137449b3aae45f1164afa107d86eef9e17738b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD135.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD1A6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit