3d8bf757d5d9a674861457f39386ec378e6523d62e9cadfadb0dac8bba976b65

Analysis

max time kernel
130s
max time network
140s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 05:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c00f5bd3299f6befe9565d612675d5a3_JaffaCakes118.html
Size

23KB
MD5

c00f5bd3299f6befe9565d612675d5a3
SHA1

509bd9d0ea5450d4202d853662cd611ff96e9a09
SHA256

3d8bf757d5d9a674861457f39386ec378e6523d62e9cadfadb0dac8bba976b65
SHA512

8d92c18cc0c0884773c0a20549e4a24bc6a0902a5c41747c3844e875c2a95136b15828488606382c8ff5bf63ae8f0fe7ecf1139c675997e37e0db6acc5e2ebcb
SSDEEP

192:uWjkb5njKnQjxn5Q/CnQie5NnbnQOkEntC8nQTbntnQjCnQtlwMBZqnYnQ7tn8YU:OQ/xPH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0F5AF301-62A4-11EF-9AB6-F6C828CC4EA3} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430726098"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2076	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2076	iexplore.exe
2076	iexplore.exe
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE
2080	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2080	2076	iexplore.exe	30
PID 2076 wrote to memory of 2080	2076	iexplore.exe	30
PID 2076 wrote to memory of 2080	2076	iexplore.exe	30
PID 2076 wrote to memory of 2080	2076	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c00f5bd3299f6befe9565d612675d5a3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2076 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
14c22200f35d2274b28e27e19d33774d

SHA1
e17227ae10faba1a79f3c9862547497815027eae

SHA256
1f144a57bb445376a605432a8bcc52ad0d346369998e1e7e5c69da78f4f49740

SHA512
2a9630c59ec7b4fdb172c81d4cf37fabf729367b9f0c134ea0e0e3002157875557904e42ce94b0d2a80f87371127cc9a253f4f6d2075585cdf413f7c88a51780

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d2fd6a6260bb6d50efa72eb260822849

SHA1
cf846896de8d423ec3d0dd0735724d50efdf26e8

SHA256
e4613338d4c38636c6af9ccc96f42cf1d7624fbf2225399218a83fe2922f2c38

SHA512
a7764e3adcdfad59df38000eee3aa4d71fb50781f98e62591a4086ccf8bc0ddc4e0aee2553e8ee93dc4b06b55fa051d9f93809e63b55ecee5b43b6d8e71ec48e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
59e7537d2109c0ad9d28bdaeb5c2ac65

SHA1
07423f78d7f4632a49dcdba86fe8a75e6c9e082f

SHA256
207490576339d2b2ff28ef940eb4511f61704fddfe9f5584a6a252840ea6394b

SHA512
169339141035e41b9d14d7006bb089e8bbfa7d70f01455c4af1eb719cf6c9389e1d988e6c8b0b99fe0a3df86c574f60acdf635e8c1aa8b8082588ecc85157533

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
96d923277e76d6293ff92ac4b85d8bdf

SHA1
f574921af2330a7eb635155ea00184d64fb853bf

SHA256
b9e7d39c14ab069508000c8496094e73d393992a0b2ae350f8e503c56a54f6d7

SHA512
f2b1494256a52eb6d2f012c7a3e1661c73b14456a78ae515446e27bf1bf031aad4401965e4c220d6287157f6f403396f89d2915b0ff552cd517fbf1feff956c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
28f5d587eca1fce5bb39370461d0c824

SHA1
70d611b710396979e3246a5d79a33e2300155c41

SHA256
6d2dbf7f2faea290b5829455e9d3160879a68312f737634272f6db3b080b8f7f

SHA512
4512976f2ae74f5d1cc298a2d629531819c747291b78a6c4199c95c3a3385efd55e31e607a5ade900070d4835bd14f7c3ffe61518bc5cfa382f1e83026803382

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f18a48a05da38c7bd088abf6624029d9

SHA1
66dcdd6bf9b6d326853eae1a00a7793bfe7418f2

SHA256
eda8266f7dcc9cd9f581bf02eeb41974ef47ffc2ed27a63b9087328df0190a62

SHA512
e8052d69a9c10ce17712025bbafe8460c6a43ffb06f87d898cb3bb83f4e15a247aa6ada6bcd7a1aa5efe3ac51a190448857aca4a6540fade8e63dde562634e91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d3746f6ba22ae104e0ceea26203734de

SHA1
f9117aa290be2b166c2937ad529c62be983fd587

SHA256
85bb2779b4e6f5df472e9298528c792f7d33603a49b864ad69c45f098e58ad10

SHA512
de97a2466279a468de3026cde4fe48110a8ce638f91eb4db60b45f30b478ace14573eb9e06860b6986e503f7fbd1fb40d87a4aac51d5d4d2611ff6a4873276ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC8BD.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC97C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit