48a85b88ed031b356384279c85ec8e786a39a958a8cf4166ee78393d5b950cff

Analysis

max time kernel
131s
max time network
146s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 08:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0618dd91eff7d2c11d1a8cd6e34dc0d_JaffaCakes118.html
Size

26KB
MD5

c0618dd91eff7d2c11d1a8cd6e34dc0d
SHA1

eb9483f3991bc6a34fa96d0993dc837405c82c8a
SHA256

48a85b88ed031b356384279c85ec8e786a39a958a8cf4166ee78393d5b950cff
SHA512

62bc14f68e10c665781b7b286a41f56886b1581ff65fcaea45c6ffd43168d2cfdbed4acbdb5c2a77c825c8ce06a46fd882269922392dab50b705d47e438263ce
SSDEEP

192:uqoHbmb5nESnQjxn5Q/3nQieWNnEnQOkEnt55nQTbnNnQMCJVevo7NtlFo+NzQ4c:nSQ/JygcGQcn

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AA135521-62BF-11EF-B8C9-666B6675A85F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430737948"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2408	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2408	iexplore.exe
2408	iexplore.exe
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE
3016	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 3016	2408	iexplore.exe	30
PID 2408 wrote to memory of 3016	2408	iexplore.exe	30
PID 2408 wrote to memory of 3016	2408	iexplore.exe	30
PID 2408 wrote to memory of 3016	2408	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c0618dd91eff7d2c11d1a8cd6e34dc0d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2408 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6dd4139954058d0ad27eb54c8fd06e7e

SHA1
ccbcb22ab0fcd933e9d9dce891b7bb44e172e7bd

SHA256
00175f77b892f7dae3f2aa84df1263baa3baadac66029a4db7e1b680274391fe

SHA512
bfec1316abf22e8205b0326890b386d26b3dddce1c9dedeb17ee6dd327d7d8fc4cd0e1787ec3d280ff2b769028fe642953390cdbbbe81e67f7b8f59b534e63e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77a8e3c75976aa6dbfc280b3217af44d

SHA1
a2ac54acb3414e01b0a8439b273b9e45a107b7a8

SHA256
68c2ae818d2e8aff18c107d924d6029a26f17ddee203379c03c947aa140da1e8

SHA512
1559ab26430fda0ec549be366d1e1909a70f18419beae802a2f68356ed363b4bb8e928692a4e1e9a792b896eedde4dcd8f47315b655a7d6e0ec2bfbff2444855

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b8e2328dc872a0875e856c239200b4a

SHA1
95aedbfe0db052e38646258a537058ae532a2eb6

SHA256
f89f88ff0892e27a2a70c431f07f36c07fa0db679338177b580c65b9199bfec0

SHA512
8d7d68961a223527df5ccf096e9364aac5e9d10a963e8726a14c124abbb26cde155b077652fe3a9de3f751532af1f2f0b115536ded69878fa9897a9e0af6ea65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc104dcfda69fd38e084fb0cb38a602d

SHA1
ad2b136d52992ae9fcce51e8da53ce1c3c3150f5

SHA256
4bee02d54370560ab1a5936f2da19133c4dfe2ca2d2d0cca05110584f5c4531d

SHA512
b13c347450c5dfc9ac99761dd4091d79894a5efcfe4a15e0b5cdc2b719969da2b8682e5a5938d8ad22c783100b124c29ea88c7151a6830d6cddaef926e4defd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a85ce58d9773122420282468c537581

SHA1
a09c709e92c800bbec5ad748e47434d9207c8d65

SHA256
c0a6207e415ded7d07bca2a17606a7a404ccf636408dd920f21460e49eb7cda3

SHA512
3a8cff93f0e8de5d58c5adaf92211cfdbb8520d7ff0e4851df678efe92ffa2309b68a7060e71b8515ab3c1d86374e72c6f66932aca5c1e692367c385612fda7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67965278a8eda5aa5af565d486c30949

SHA1
617e0a6b3beb438052e0b5c35018e1229d90a7ce

SHA256
1722d6ab5e52c92742b7369c3bc402364d8c20a8aabfe5fdc37eda0115b81035

SHA512
b52b3e89ba97456d150228a9af2987004e0c280edec026dfe1c714e311ac2a4696fe07277b3f11b1ba30ed0b5f4c8b6e159fe96060b56db42087cc7117c63579

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb8a212ec2af0e4c104b4829e3824a24

SHA1
a1ddf87aebd7c7d21682ca8ca7e2449daad1dd30

SHA256
f0f3ae0a56fbe04e929efe8bd3e168a70c9006a539a2f1b6107749cd0d29e2c0

SHA512
90af96f990b10f15fc2aa35763387a33449c0ba74d6c6c1601a08037e757cb5d8557b554a96034fe6c29705813b65b0f62fe59895b1734f514e214f4bca0a6f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43c7b7f8e40c0dbf47114e4a4af2f71b

SHA1
cc1920300bd15a28a891e899a62fad05da655f69

SHA256
865a5f4abdd9dc98de465780ed092fe81b5d5a3fc7feb496dbc7811c0beaa33e

SHA512
d87ead5260714627a8ef1fb478a1af886a34eadf4b6ee00396df7d26b2a43b0b49756268a05018ff52e55d8206e8dedd3c096fe1071b714a36adf62fb4ebb7b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c6d65b6ef7c02245a446a19fbe00a8b

SHA1
6d197bc5edbcb6569be7540be4b9fd27ae6650c0

SHA256
a4791448a4b646be26143d0aab1625f7dd628f9361b0dca1c0172c4cd3ae62c2

SHA512
25a8f3b1b7a16e8a409c4e64afa7c5645991c0e1da711369f9ed0973246a37d0b9b5c92d55b50769d7e2d07e034879a58fe57d306ab0e57634fd50b9f146283f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD6FF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD780.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit