5471f4a2ee0426adb98ed6348d7d6455f0ffc831241c29c1d193119ba61cdad4

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 13:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0ded6bda512da358f8608baadce8d3b_JaffaCakes118.html
Size

23KB
MD5

c0ded6bda512da358f8608baadce8d3b
SHA1

9cd7077456d9363d36116c0b3a4a3f9ef5fa80b6
SHA256

5471f4a2ee0426adb98ed6348d7d6455f0ffc831241c29c1d193119ba61cdad4
SHA512

a92f872da16e63f1ebcd26170c8a78110fb1d29a719745f9532f8fa40cdef8cedb81ce1405116bc4af087008528da57d744e5276a1416427430bd93ab0509fff
SSDEEP

384:P1J1h1K1c1i1l121S171e1Z191l1x1S1D1O1U1R1u1S1XQ/A1C111v1V1O1c1j1+:trz6wCHmSpebvHjShuYDOS5i3NXuwB0T

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430755341"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{291BB881-62E8-11EF-BB94-CE397B957442} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2200	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2200	iexplore.exe
2200	iexplore.exe
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2776	2200	iexplore.exe	30
PID 2200 wrote to memory of 2776	2200	iexplore.exe	30
PID 2200 wrote to memory of 2776	2200	iexplore.exe	30
PID 2200 wrote to memory of 2776	2200	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c0ded6bda512da358f8608baadce8d3b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2200 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54a2395bcbd77acaf362af62ea0ae8ad

SHA1
916adca2841f7c0d76ac0d709e18b0568164cc5c

SHA256
fec6e9f753bb05578ae790fd068c9947c25430a1c29a634684cbc3e04fedb43d

SHA512
2bdb6c60ca24f69138bce33c8add4e62658167e29c5569254de3b450fb5d254018aa713f457d671a8fad260492d0fc892919e8e075ad3560d157c4a735a92e96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9c93d50bc986128b66f5726747b6fd8

SHA1
2bb44c53546e0a0288fae9c2c8fb218095c9ceba

SHA256
13106cd152dbcf5c1ff8e6297d6fa80eb924d75b679558ddfe13577e2b6e0900

SHA512
a98153d3d138a03f59921a3f4559b236d4523686db9d2d59eea851997197c3a7de2c3bd937d540e3760e14d95dba39df5af275458e14863db917f3777f588a2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de192190ed8253668a808ec49c9d71af

SHA1
a96ed3ee29b1f2c23b95458e680832bea13d0f99

SHA256
199ce7343d76fee67d61c022a0103f44b52fda15f80d17156fee32c16c0f33a8

SHA512
3746eaf862238f5d4626a8a2ca19892957e09430ee4390ec102b115c0b1e669e15229b5498d69b799821c8f0a943d918c610407ae3a91854a30f94b5bb95053d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10eba3a0f5efca5c9873bd08781c08b1

SHA1
0f5fc0991bedc8dfb3e3bde882bf088e9d31b04c

SHA256
a1f5ab3cc1be7b7076dafb98724a576eefc91ff3902e917dc3a94db2dcfe4276

SHA512
4a01ec7b9d7bf15b9214a5c3559b9853d607b64a7863333ebe4b2cb72a096514744008c151a0201eb20e6857ac0d348512af7fcc04e9d8ea34932daac5b509a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d78068ca65062fd1ab6564ebab8aca53

SHA1
8e1c9a4b7bdff0e97c6d939087b57f31ed3270d2

SHA256
8682858c0941b93005292c3000a3865ed60f5c2ecef932f738f864226b1fbd81

SHA512
c0c16c64f97dd387f86395481a53fa9b0e554af35186642b261a9621480e1746caa5398b38b5741f06f60ccdec4b7da674130396c4faaa329fbfecf2f7dc974f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7f2343f8a51bea8a1e494035ff71643

SHA1
f5f84a3394fedf93bcbba6b58d8ba7b855360230

SHA256
fb7b97cd0c929298dc5543d6035cb73bfeb9df4890b2bfbbe4dbe2a7d5720cac

SHA512
581e9af29f555b96c1fe015bdec91ef21ccfd2fbcd6efb7b1c1803374ed3b5defc2b9b5fed46d5edb0c27e114979e40b62c313f4964e235d3783ef1f508b9413

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0cc2178c3ea58983749547afea7b0105

SHA1
4e9b97b3c14c9d8f8d0ba3508f15b5d72baa17db

SHA256
23ade361f1226069b259e01a5210aa9d8489be20a8dc7620b39b4055ae089832

SHA512
a2856a304172e7c28829b7255b4556b3214ec2d2be7fdf545b7d4d2795ced0569af600ad64bce746b02b126f818197c7c5a3336e3125814b1ab72656da2ae9f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23e548669ba4b6442bb8430b128b2f11

SHA1
48899a9dfcd382a96b6780820af09be5de89dcac

SHA256
d7a8e69f3bb0d07f8b38ebcffbf43fcf3c5a38f3317f14a8bfc27565b47e4d4b

SHA512
314c517603797c257af4b9d5f75e8ac18cc6e54cf7eb6eb6620539ee5009b373b2eed193da93dde6abb3eb08918a9f70f1fbbd2c4b6aadf52ba23e173dcaf810

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c280dfbbe701215055fed130a50d912

SHA1
2ff9785c743e68801abf7069203c478ae51a79a2

SHA256
dfd1e8f92b17072d4ad3d1a0dd9841545657763af99ec5f8028bf3012953a61a

SHA512
613d8c746a40e42af66c4aec6352662bc73744482f650eefa935803b56d0b5b2b538e032411f2db8e1eb2dac9d00582f50314bf0b0a275747c3bed8eb0c7605a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d8b06a35b22e580463e3833758b14f6

SHA1
2ca69d7e7dcddaab9f825e2b18e17dfac365cd0b

SHA256
6529571b3912d2628821b1afe8f799dcbd1624c56adaebc4dc1063d3356288d5

SHA512
26d8620158cd6a653a965229535b5d01568733ed5807b510acb200820e035904be7ba34d527cb733d6c364c52b3d9de08f0fa1a58062d3f6c505edb107681c6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab43F5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4465.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit