0a7675292418b55bbb68ba36451219a21c494064399eeaa87eff2399275f4347

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 16:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c12db3f1ae3a94b41fa2811cf77b4f44_JaffaCakes118.html
Size

63KB
MD5

c12db3f1ae3a94b41fa2811cf77b4f44
SHA1

2f3bcda42903b031ecc3291f8e0c87a05ad06e78
SHA256

0a7675292418b55bbb68ba36451219a21c494064399eeaa87eff2399275f4347
SHA512

b1f01b9d20050ff0f58c854aa98f4223c9eb0ae0ea04ca4da77bc1ca4c60c1f2fd370151ca40a474f0f78aa87204e05877b3fab594e136d036f9b4f69e900eaf
SSDEEP

1536:ughKACSh/C82JvDJZq/AoQFVVzCCSpR9bsLLWDCNbqXeykEeC02dmmTAhGJHjqpN:BCShK82JvDJZ+AoQ3VQRZ+2pTAhGJHjG

Score

6^/10

discovery

Malware Config

Signatures

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3263ED21-6303-11EF-A1FD-CAD9DE6C860B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430766952"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2488	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2488	iexplore.exe
2488	iexplore.exe
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2124	2488	iexplore.exe	31
PID 2488 wrote to memory of 2124	2488	iexplore.exe	31
PID 2488 wrote to memory of 2124	2488	iexplore.exe	31
PID 2488 wrote to memory of 2124	2488	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c12db3f1ae3a94b41fa2811cf77b4f44_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fac7dd1126bf1a0bfe7dbbcd0f0ce66e

SHA1
39fc724d430f5bc0e4170c1afe293abe805087fd

SHA256
9348ffb54569ddabaa81f66280308ffc5dcb722f399dc922a75b502124ed4943

SHA512
40278273a752832a5dbbdaec7a2778bee62df6205d5e5ddf8dd8136a3887ba0511d56489f0f4bdf6f6ce9bcd41d9e3ebe7f147316c35f93765163cc267cac15a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5abaf35502e88188819587bb0bc5c64

SHA1
e70d6d6c167bf88124e053b543f50915cc1e4410

SHA256
11946ae60aa23dc43f670b4a8435477fca004f2acf192eea9d12dc8ef839c880

SHA512
0f50d20b2550ad86a260b1a5c8f2e529b85579dcaeeb9a7f1297fbcb292fc136b634022f26515ceea4a31a8006366bf9d584ef22de0f546c40dc7efff0c3850f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
783a5f566e07791e20934d1c8aa75f0f

SHA1
d3ed719c81286c3842bf609fe368ca0800730319

SHA256
c96d4b4a2a676dc845bc88d92395d897859b673c958cc71df4f3f8ead99ea0f8

SHA512
9e1c8750cf75d4bcc43343f858e589e743fc20469b54a88ddfc293282e28ceefdcacd5d034c40f189fe5d1db0408b8f0fe790e80e57325205fe91f88d2a6a3bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2175a90d400b550fa8dcbe088ec3b852

SHA1
c90c57d1ea820933a7b3cc75c17b822f55ec5a75

SHA256
d779aeb61bd8b28823de055b3d9c68e9610993b7e11701ecb424f337acf09ab2

SHA512
c1523930da84bce32b7f3eaf3e7ec8aee8b1e7ad5b4c553325160f0bf84b514961bd3f6eca9e3f15e4ee4053a86b73a468c988ec94799d26ec5e5fb9d6c2dd0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1222252b4f66324c0c5c146c405b2f40

SHA1
a2103e83cfe8d88b6f28f56bdbc45d237318da80

SHA256
4d9486d41f0debba8b3bf10dc503408780648d9e7d8274aef61d26fc5c647b2b

SHA512
004e87cb0930caa565d23ac5b49b47893164c4643b6f55baeb263fc7890b6733a131e194327f4658589cc7dff1924b41c7af755bc609c3341b097c9f22a03748

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58caf4589a9ad16c79597349aa65ecd7

SHA1
3f1735f34c13e476da860e27964235eb5416da8f

SHA256
9f43608e807eae217f801353e007f842566fcfded75d2c77888f1d29b2b522d7

SHA512
9dfd21ada624c68946dda7a36810431287d93bf6edff53a8a63598d6000fef8f20a73045f7e139b430dcb39cbda3e5067db0d00e6bdf87e7840bbed28088b2f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bcb2337a420931b87e7f7755f0d139d7

SHA1
664f4ee5b4d6793a919b565a9c84d094b44b1232

SHA256
2a7d5853ca651341ba81686b4af1fbae3402b433feceda227bc8a24bda2232e0

SHA512
bf3588846bbc2ae68b39d501424b1fc9edaf4c35280f7505b96e5136a3fb184c69239cf35310a99933cf8705707f297967ac0648046b65f12e2cf35921f6cdd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27de10371a95fadd79cc0ace12796817

SHA1
cce3be094206eb86fc901ed7c23638d6d9f804a5

SHA256
a70c0e38ee699b401edc5aec330aafea990c6bcebd93e546c64502c4f93e1491

SHA512
bb00d2703efe34e1edcd99da3e4ab3e2675774cf4f219633a6b3adf74bb4c37b3e033ea93686ef6dece5b01cc9fb34b8883b409f72dbb16793930fb019caeea6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
766620d65732a3d2d7cb58a6d4e9e96b

SHA1
05609b135c1e647248b94da7e52c0ac2750dcbaf

SHA256
30b6ac3f37178913a3dbd547738fb1731426a283485d10a7b6d4c3c0bee7d32e

SHA512
abf48a55de8ee46c70f7540e6d3d4ac395cc402d8e52595dbddbc627ffb265300973b77bfcd6506f25b5421349af45ec4581d01625675058c7f8be7ae7da6dda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\40WV1DY9\css[1].css

Filesize
2KB

MD5
919afa0ec1256bf6ffbd9f4329d06062

SHA1
63322c63ce6527b5a806aa31d93d063edc84d46c

SHA256
201e11cdd35adad44eefce4ac29fab6c4ca755ab2af81842f6e4845ade28b843

SHA512
5ae9dfe247713a53193ff7750b9bac228e52cea32474537bd5cf55d68ff8a92b1c4a3d2a76e929f8d9e4bb4753572734ee73a7932ba8fe0454d31052e0d3524f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1526.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1539.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit