9376719abda96f8dad03c66151502062ee50402a1f4aba7e8128338ae55039c1

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 09:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c072ee7b97b8c1a1b9194cd4f7c0bea2_JaffaCakes118.html
Size

22KB
MD5

c072ee7b97b8c1a1b9194cd4f7c0bea2
SHA1

94ca894f0497ee2685008443badef84cdb86c3b6
SHA256

9376719abda96f8dad03c66151502062ee50402a1f4aba7e8128338ae55039c1
SHA512

999742def42636c9799f67e0c065256b24d0aeba335adcef765c1d3da0a0dfa9aa0f17cb706b756feb1002b3e108b3473360ff77675f7fea63bb228417948be2
SSDEEP

384:6FHOiOiqU/a13pxsbAANeybQ/lMVpGS41NW4Z7wIreI3EW:6FHOiOiqU/a13pxsbAANeyWMVpGS41Nl

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430740285"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1B035FA1-62C5-11EF-ADD5-E21FB89EE600} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2852	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2852	iexplore.exe
2852	iexplore.exe
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2808	2852	iexplore.exe	30
PID 2852 wrote to memory of 2808	2852	iexplore.exe	30
PID 2852 wrote to memory of 2808	2852	iexplore.exe	30
PID 2852 wrote to memory of 2808	2852	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c072ee7b97b8c1a1b9194cd4f7c0bea2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2852 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e57764a04a9ef717fb7c0924fafe970

SHA1
e124d46e02d481aa80c5752d816a324e1644cfd9

SHA256
3786881c2394094b3ee6f27949d5db4006f3bda848be03bd840399b7e4f405ec

SHA512
3200612771e8f5489d4086171c1c12684756dd2071e69eaf0feed1285db2e14bffc922fac47fc760d6c89ff740b75283e71c661a03a0d4ced3aa1bdfc805cd29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc708a5e2a93945572d94fbcd7788083

SHA1
9b5f1b27739659e382660ad4ba85ec21d4e5ed89

SHA256
1d085baeca63b785386b25e863ec2d167bc0985193462cb6bb3992c853056b84

SHA512
06b546780a894eca199d6adab625ba1f5a0370ae9aa6a172b0828fa6e2382e879ab0ea3939858641ff50e5875334754092095a6a6dcb3ed9a69124213c9a41fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1856ed58ad63c5e3710779ba4e3b6512

SHA1
556d0bbfbb5f4b1c46b7a902f12e6cf7f822a95f

SHA256
b5db1752bb1b6ecd121f66fedc9e3ce801112fc06b58ec030487133a3fbb88c9

SHA512
9866e02f24c3f7b5587be001a0d9dd088b44dd0dc54cca981a9ec116da290a133436c956f5968922472a5ae05d5b8ecbb1c50a09848869ad15852dcb96e3cb8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e1505cd19f5c990750784412f7b63d61

SHA1
18c817a9e2befd7e48355710b58d98ed38f223af

SHA256
0722dfb46ba1ecdd0b41f588315cdef5d419cf953ee5500fc4b0e5d2bf06c7a6

SHA512
fd459e9aa6039eb0f0ff8e6523559dac5a02d1c13803022399636440f888cb5c5bd2393bda7d530b3e8b27a84cfa2f8fedb9abbb302d2185e3ddc7958a526148

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e754b92f4020bb3ead89c8fffe780c99

SHA1
44f19aa7ba25b2d732785aa8f5d25804b2186a42

SHA256
3b93b1c29b84b774c98f2514226a5778e2b15fcf8eaef7bc8ef1d9eac06b9e11

SHA512
47ebd1f3b05692011493b2f3210eb4612882401a4dccae05a43ecb2b7bebe4c4fae0ba4d22fd64c93a3c6352ebec02065b02f683e64540e0210a6f69430516ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a89692aa587c099bd6c6804bbb00f8a5

SHA1
cb769edcc0d11ab3ccaeb1f86d5325d61da7ce75

SHA256
70b14d3689095ce8de26a9f2ca75844de40c4b77d2c02bb71adb3c84eeb26b5d

SHA512
35eea2d7aff74194e70123f98fa8f6d005a5fbe1076d7fc5b8865adc510d8b096b619acb6cf44c90c61c604c0afaa2a1d2b0df11ac1df4c032e26e92bd413551

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
131e6d5be8b7dfe092609bde729b035a

SHA1
af61b4ac21793cd9d57ea8a4bafcc4aaeee7ad7a

SHA256
1b72f6f3d4b0034db4a51f59b82643b91ef02d41830ae6e16987cd41733fd865

SHA512
9865939ba53d30258d6689cfc267623ba741a22bebfb1ba8b70dfcfd42f3e7a4c9b20d5fc558e4d1866d5089568d026898df143321dc6c10b2ff594f3052209b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
823212fc2e826187bd0473868387f685

SHA1
fef477f3fdcc022341d17094854e1e9d0acf69e1

SHA256
ee7d383de46f03047b2845a0c48e0ac1bc24dc51801b0d3311c5a7ae7940bb01

SHA512
f78b99cf9f1e7b7fb4cc9643eb1f747a5992ddbcf2f77e87be0a6960d0fc66251946a4fae8f75279ad304f8f078d419f9d7647a65cc764b5c1ac57a44f9cb8b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2180be80d1e12dafd0fba0142078ba95

SHA1
6de46b5554182412750dfec4838fd3a8385664da

SHA256
2d24bc0bbc83717b25586380d726e36768f0fb21fabbb336009d53e814ef629e

SHA512
fe97b2d7a8854037242863019f8859ae280b8cc10e130313db1d524d7d09703ca65eb7597cab56e80d1a1c0633b4065c10801af623ad27900e2a96f3d616ea84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9590b50f1320079fb48a72745bdf705c

SHA1
534e9c3ca83eea2345cc701244feeba35059465b

SHA256
8233ad622c8fdb056a51aa85a974349ef62803d950cdda57d56fa66109e1bdf2

SHA512
92605ca5eaf1fe8f1b7a14ae7a434ab9c727c4764b68ce6d5cfd6bc49fed4c3107a4095a56cf11e1ef5cf896642baac38f67a7c4602e1d31212500ca16ea8ab2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d3202af78958b5379bea36a594517d1

SHA1
7316a165fd52a10fdc5bc7690e97f05509b1d48a

SHA256
f828cccc73d08a26181a2a19e475d3b44f91ab53c2a0ab24b11c73af9a4428cb

SHA512
cbda43803da28ee632bc3d665083988a6b15e85bd2c4e7269f7fd250b6fc5c2be3fe94a87f03bebef5b0a04412f77f44fd7992ac927ca08fef4550e77a0762cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2B95.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2C43.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit