b8378b51809c2b817942dbb939a4a383953efaaa6aab334a6c969a80d5e73291

Analysis

max time kernel
142s
max time network
144s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 15:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c11548d5cd175e7cda4dd6585f16d24a_JaffaCakes118.html
Size

218KB
MD5

c11548d5cd175e7cda4dd6585f16d24a
SHA1

6d13bef9e9af0a929f022e781ebadecdefc717fe
SHA256

b8378b51809c2b817942dbb939a4a383953efaaa6aab334a6c969a80d5e73291
SHA512

fa770403e9d592a3568cd1f7ba6a5359bd338ad24f262090c8d193357274e02f38b7eabd8feff626da5034260fc261707de97b48121cf08ae5f24e28b6bcbaa3
SSDEEP

3072:SjzMqRYN8ayfkMY+BES09JXAnyrZalI+YQ:SjzMiYG/sMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000002b2bf65016c58fdb3673deb84ef3bf965aaf49bb13c801975c0eb5f810d3a231000000000e8000000002000020000000d649b7fd9d0eae024d9d0917b9c53863a09bc0488206642b0b7897e7fc62db2820000000067e66a152bb56ac66a0de927bebbd2d455af9b8019d9192047f9d71ef6db48540000000e931164e269dd7892cb9ad9952c7f8923488c2f39ac6dc30694077e30bd0440c89a8742c358e77c93f6e906f3a0087585bbbf68b73249a42193f78ddd782a2b4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B0FE90D1-62FA-11EF-BA5F-F62146527E3B} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430763302"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000632b90a43c5dc1228b3f12480fa07ece323e39e7dcc7cd7d665ba9c913da517d000000000e8000000002000020000000e892cd27ba7eff522af233ea70d238dfff42dcd411d5b4ed98d274f7438a39e290000000e748d4088c0ea4d9895e8576bd2cc4a2965d2387de533bd569fdc21457a9f7eee24e0e7c38b8db476bb1260c64fbb56176ab6d23dcd27a9b4efb118f6f7669be44e46d533ae20319f5af0c3fae18286281c3c06ff94e1689f83c4a68a67682278f7ee73c3c2fa246d0dfe7d27dddc2ab390cced5d94adee324c6b5533a79e9e90dac241d57f6be8c2d867bc03341a4c6400000003630014c4cae366a6425b249a95126a601f3b315de1f5eb27e55940257fcc98d727fb732d966ebe81071db6ab7a2d00e5cebc2d3e59510a10b0b5531e79f95b3	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 001975c807f7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1316	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1316	iexplore.exe
1316	iexplore.exe
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 2316	1316	iexplore.exe	30
PID 1316 wrote to memory of 2316	1316	iexplore.exe	30
PID 1316 wrote to memory of 2316	1316	iexplore.exe	30
PID 1316 wrote to memory of 2316	1316	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c11548d5cd175e7cda4dd6585f16d24a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1316 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5012e1559432825d22fee8be1709c26

SHA1
1886e1f7984e533497971dbd9eb0af5bee10843b

SHA256
3d38730f3e63e5e68c69dfa5ff37b2f349c5c2fcf8e5ceb2f3eab6fa2856998c

SHA512
bcd5d34a053529500e0e6bd8ad799ffa3d75fb7164cda29aa833bedf0182433d36dbbdfba39572c6f89a77b29c20c1a55c9e216ae3a7b8b44d072c61a8cce699

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
522cee75f67b39ea5570962f3cce2322

SHA1
f0365337c9ae906f52416dc460c60c866c0aa310

SHA256
a686676d67d2a9b46d599da6c2fba695a26229880cbb42f6aec0210d4e7af53e

SHA512
3b3a5417944ef130eac7f6d710e731afad79dfb08fab99fd8d77ec2ffb22f1cd4dd90e3ebf127351f5940c41e6230a5c1a2ce5628ed439095676fdc379703653

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9661a674fac0fe6f4092bf6d2d3a9f68

SHA1
7e48099a82d8fb02575a9a381204d1fef9191016

SHA256
5e1704a517b98f439f4574417927506af347a0ea47e3a9eebf7e6138fedbdc19

SHA512
700b1adb5ac8fac3b715ddc4218399e7f888edd1ab4d05ec47e5c913b088c62eaa1f96815921a2dd7c5c93ff18531a9d42c0f214cd45f3fa9e6c0a645f6359de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9567466a1a45181fd162482e3fb4805

SHA1
9baef4d53d82c2d1fff7264f0f0a2efd2218b099

SHA256
e438dfc45659bbab09125561e5b07ec5d2fec842933869713ebeb27b973b8b43

SHA512
d7dd0a40036770801e3d7675889c0ff1404f71ad984828e80b8c5b5ce051351d6a8bb41fcbd4b43a5fb11b6a422b4b65b68ae1e04ac1b49fd95fd50953c91bb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94e028b822c5436b64907877095243d4

SHA1
de59329a4163f0f315ea3e17778567b9ccf6c80e

SHA256
3849592c1da50aff00ef777f69bc5b90fb0f98cac6ffddffcef2146b80f6fecb

SHA512
ec7b8ec2ed64075aa85063a0e310e0f558be20d0bfe7d24a2bd0c124b3af53b303b55f1bae20c60254fd8eb1d7f098954b6118e4ba1ee48628461f15615177d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f1aeb48c00d804376b2ae7e5e66d08e

SHA1
15914ab884460842fe1bbafa7c59cbd17f77ecba

SHA256
c32a44eb6f053b3afc059b8868ef7f971c677bc2c30db00ecd258137762d884a

SHA512
4da5163a3f85896c8bbd212036c6ad12a01cee5f8720feb828c263cf5cebba08b64f623b283951cc477e2488e058448f49a75fe45e2ddd03fc0b5b9e9106a353

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f5fcb5bb4afa3a24220f431757d1959

SHA1
762ac6e3e748a67e4035ae4fbd97d6e0596b1c6d

SHA256
4f8cca3107c35d4398aef20041c0c153d446353ed12e08fafce56491f22f3f07

SHA512
1f720bb004325763f95989323ffccef7fce5825189ad1e7654b8d114729e66481b2c3b736dc03347476b01e4a4ddb800dfdb5d2e31528318d1605c8301107785

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4779ff7543d000f087bc024f36d1dcc

SHA1
d35e6c5e1f16c6ff743dc6bd0954726fd5e4de31

SHA256
ad5280fafdcd6f22a5a58d917f5f768a94952d7f62a673b9590c211ef216afc3

SHA512
a368c350871cdf84684ed69a208438a797944228c04b099d3d2a4fd53c9852ec5322e8d864ebe9a476eccbb6ffab478c27ff206c56c0f2d904eeb74adfa33705

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
893b6ae51d491cfe37b83d7d12e282b8

SHA1
0ccacf3fe11465ce72a4cab1d9b421f6fde853b9

SHA256
2791ed3654cf87716da6de424640608fe0f27639195db674f8ac97e0123c3e91

SHA512
db1080c356d24ac2ebea6014cd6341c8838a2be3753493c70b71e2aa3d70fd895ac6b32c0be8b511e79374783dfcd5f0c91a97148676a12ab6f7372ec574c6ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd8527f43e3aba328c64b5fb50cb6c76

SHA1
551cf9e1b3a6c02ef1dd28fb8625f8ea4c078839

SHA256
a8ddeb943802cd12cc7de7d3259f7aaa3d85a5314fbc32eabb0337508bca8c35

SHA512
da37f8e55ff421737a9e834a6426f8c2ffdeb35935f71172b09216b455d0562cdb3cd7aabe40fcb5dafcbb8dd7006b5f54a0d436cb288902109a95832d2a077a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c568e39d31e006b1a9e7250f7846fe40

SHA1
72d9e5d39be99013d8b22a4f61fcf757bdfa8f9c

SHA256
37e4241e77a4d7957cfef48d0de2a42ebb6c197f253f578dcb01bd333c337e9a

SHA512
8c3b938487427b80c7954372d5321b5d6c5ed051dcce8783f44d367ca92ddd9ba924ba46dec85bfa701fd24295384384b8f6ac82b9437d5e71f0bdb9cb413383

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA797.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA846.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit