716d034d6bbf7721107d93ebcb8dd921570d44c32f591b7cc7a7f066e79f17a8

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 10:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c07e02bd4f97b0fe8f9236e7fd574254_JaffaCakes118.html
Size

23KB
MD5

c07e02bd4f97b0fe8f9236e7fd574254
SHA1

d4642df065a531934871197c22c4a4c8973f40f6
SHA256

716d034d6bbf7721107d93ebcb8dd921570d44c32f591b7cc7a7f066e79f17a8
SHA512

a4a0213729966554bd5e2ff6e6d6ad21a015e1e87a1ff342ca880652897e191732fb9abe73a8f1b38f316bf57c7bd0b3a27f6974bc65ab01c5341858be482099
SSDEEP

192:uW7Ib5nVunQjxn5Q/YnQiebNnjnQOkEnts2nQTbnhnQFCnQtDwMB7qnYnQ7tnoYn:oQ/ZtBo

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E1C9AAB1-62C8-11EF-8BC1-6AE4CEDF004B} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430741907"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1940	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1940	iexplore.exe
1940	iexplore.exe
296	IEXPLORE.EXE
296	IEXPLORE.EXE
296	IEXPLORE.EXE
296	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 296	1940	iexplore.exe	30
PID 1940 wrote to memory of 296	1940	iexplore.exe	30
PID 1940 wrote to memory of 296	1940	iexplore.exe	30
PID 1940 wrote to memory of 296	1940	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c07e02bd4f97b0fe8f9236e7fd574254_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1940 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14e8e9fb2a09b343e3a27c839979f83c

SHA1
c31576b9dcf8246aecb85ecf57f6ad8a6acf6108

SHA256
3c1680462dde8ce99e341527b4bceeb5f26e1d4a1c159493d12a6666f378a4d8

SHA512
f0f890ae3a1650b3ec2c611071ac3ec1162a76b46e5fa80f1a75ea69242fc738107f1749a8e7f2e9b67453e7f7ca0d0ad38608a4b1693a4fd5ba881b50316572

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39dfcd6a52f57b9f29c5af180b28503e

SHA1
a310462d5a140f10f005d35158d752a526081e87

SHA256
fe9de3558528693be168b941cb61aecca2747f7d5240f137c29ef263c1cb9eb9

SHA512
1794286f65318e219c2feeecb4d10061b87e930a2415c79a717af6537c6e9b4ba56ac98814f699b0cb52a2e95c0ba40804ce0d2e6fd650bd14d037d37b14138f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca987edb12481e4fd049bc1aed6b2365

SHA1
f0ff3bfa5540432e627b0ac3408c5c336b390570

SHA256
d4a1efdd1e91ac19cbf11fe4df56f5cc52b7ef7cce65813637e350f6add36699

SHA512
54cd090336b1209d0238c38cb9104a55a0681dac6f01ff9fffcaba4f2bab207cb412d71668e6ca98c509629b3a2dc138af49be3a1b3a08c54f5b6ff0b11a7a30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42feabb5cc0b4455d28e97dc727fba88

SHA1
61a007fd7b58327e9c4af8b080e1417acf0533d7

SHA256
4660a450f701d8df9ed14f4a53e7b56b8ca6d254d1e3937e227e0f4418531e06

SHA512
f9c702fa1bc33fa370155622b17355a6565131fd4931f1dae2ef672b32c56520fc78ce231768f8fe741833d461667a70ce9b26da834a875c40e9b4b6468bb50b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
afbfa99ad6ab233f3ed9443545ec63cc

SHA1
0839de1b6b4447d10e3de04570a7b97ad50c988d

SHA256
80170c617368888a37e6544d74c900b769aa970d74cddfb05b31cb3a20685b73

SHA512
80de2b6530862ca149b943af63d25c3d5bbaad4528ac796a7960d353b145b682259141bff2e3d9dc0042ec25c9d7db57752b205f1faa22fa8c29db9291a8cff5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54517840dba0db9ce7496c6d2d82795b

SHA1
da1d897fa521c6d5dd8557ebbd5e37c588f7fdd2

SHA256
2ddeeaf456f37480eed4b38964e443968d0860118716a5a1685778ed18dc19d3

SHA512
390154e387559a118fb256e28a19983e4b19f14218f21262705e6e2b82cdf6a9e1ccb88100cc4f219b4a8b167bd809e3d44137e4ea00e745790a19fd9b8e6995

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42e596fac382e4657a2f8313cc6196ef

SHA1
e77819e108d5fd856e18aec92ec0dbcfefb6718d

SHA256
63da3c97b518b5e0a35ad2dc6051cb7623a4dfc853e863979fddffe30a5898cb

SHA512
096747a3dd0d7339ae8857e3cb4232b55f98dc9bd9254a09496a26c566941346bf01f5b65e396e3b1f40e994a6632c8e702bf60894787eb2b86bfdad8dc3d7be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab78E9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar795A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit