1bc25e3d996b8847ba0612f4fc4d67adf7f53a10707cc5d05bd12a84c0d9a4b7

Analysis

max time kernel
131s
max time network
141s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 19:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1764364367b0953b7f2e97db7a1ee04_JaffaCakes118.html
Size

31KB
MD5

c1764364367b0953b7f2e97db7a1ee04
SHA1

80e5f99457cb420a85a573d5479870bc6ae5a2f2
SHA256

1bc25e3d996b8847ba0612f4fc4d67adf7f53a10707cc5d05bd12a84c0d9a4b7
SHA512

add4ec99db3d7317d60615ec9c5a0df7d87afb157ed9c5d2ce2c98fecddafc2dfc2984d4d2890396f01d165f03ec7f342102f568ba0475871cee624b107d17d3
SSDEEP

192:VWCk3GDG7GSFGNGeWqGUpGtqhyP7b5ntCnQjxn5Q/YnQiejNn6nQOkEntkinQTbq:ACk3GDG7GaGNG9qG8Gt5Q/sWSeSQ/j5Q

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9775F191-631C-11EF-91EE-7699BFC84B14} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430777860"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
756	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
756	iexplore.exe
756	iexplore.exe
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE
2528	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 2528	756	iexplore.exe	30
PID 756 wrote to memory of 2528	756	iexplore.exe	30
PID 756 wrote to memory of 2528	756	iexplore.exe	30
PID 756 wrote to memory of 2528	756	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c1764364367b0953b7f2e97db7a1ee04_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:756
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:756 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82ddc91dac2a225798539f9d6e36a30a

SHA1
81da86b6b97f9ddcb8a2e48f0d8d5d9930965df2

SHA256
5a1c8447210c69162fa268f854035b539f7528d6d6ac8af1828b41afb5c0fd37

SHA512
80f934a60dabb306b56004d2404139eb91073c3cd80dd0f31faacd087e24039232c602544193cf6c74113a32d1912a9816623da51a48d02367db301f3b35e96a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96e58bbca5adb71d23b86b5d5b2d693b

SHA1
459f670c962f60080ade46c19b18f75c2ef16e11

SHA256
4e2e68abd71fb601d02bfb7af14a94e265c266feb1559dd0482c13fc72e6c45d

SHA512
2a7609d700c5911cd5496b71e5e183d1957a650a974573432a280f1f0b09b2faa876705967a7db35782c04de2af0839e5b1715f512102e57df23fb4e2ab61658

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8154e3f972e5e9df464b54e66629fef0

SHA1
befa8f76d6779ad8f7c052608f51c1d7119c627c

SHA256
4b08ff65046d2132347d8fc265246b6a03e3dd4362d59d7b0a93640a65489794

SHA512
1e3c9edee8be2f66658d27d9b76d8c2c0191aa86c747d68b83ffd33f31928afc9ce3281a8173056faac419bb06302104fb18990cf063ff4fb4630be020743505

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
302afdc48449d081223880dae7cb19de

SHA1
389cc05fad486c5a5fb8339dffc57a1ebfee559b

SHA256
130ad802d8d20d9a65106a8ce1a3fc18c3d9da789f9b6e933d1613fcdf8972f9

SHA512
bbf8b974fd4749aca725e2fe9b922434df1f0946a6cff9c0b8588c88d18dbb0830b61ac9a04bd62ca3332d8db1cb45878b5b9378e6e59eed9b86e194d1ec8412

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5252316f18886f732fdf882c77006d9d

SHA1
21a90427f9e996fb6afce423ca056abb63ed0b87

SHA256
19b6615dbb238a4bc2bc1164b3e1b9cecd263cafd688eab194de74e6aeb02628

SHA512
904a6519b016c2fa0de5e5d5c3f2087558d0295f24123102320b7af8e6789630aca6de37a86fb1c6e7df1e9a88060d1d7b2cc37b7d7ab8204bb4ca949eed620b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
107c81b39b26cba3863d3e8e58afda8e

SHA1
edadc82ba233710222006f082c09e8a67d75ba56

SHA256
0f28d3ebe911c11a389a1816594ff4db7292468e7f107119ab34d07ed838d167

SHA512
d5c6cbcfe78f6088842e59150d2019fa7071b55bba87044127d74c2e4628811d1a99fd17af1d00350726c87374ed6ec5446cc90363592f89079787896dd15926

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9291f9d11e7f37c92e3642500affcf31

SHA1
e68dcb971b37c450167024345335c28b2cef3455

SHA256
d9637825243e3d3f718a0793b5233015dfb95e788675ce7ef8bdf9170d140af9

SHA512
24cb0ff71648f745b74c5dc337cb3e1de7b41766bf6e5a3e55a204731504a07b91722de69d26d50c94fcf56dacf5adb12f1824691271c3b0c62eab53783f6b6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
156c28c2859a64ef121e6ab617ed2eed

SHA1
a03e34091b2fcd231dd4ff9eb2e6bfcc07b43290

SHA256
43a07112a207b4185dcdfeb092d6ad9096237c38789630e745928ab4a89964f0

SHA512
8f724207a423d11919acdafa46f56b7eb9995a6ef5f4806c5ee92c88f2d95d5273845b3d77f813613552edd6ed55e3ade17a361e4279e320f58b48f143eda8b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84102f4ef753fe09a7bed42a101c7567

SHA1
a0227f12d9da959393f02e4905336267b042e157

SHA256
53379af9d3c320fa1646b0cb42a03be58d04536f7e4261ec41c7c94f16c40edb

SHA512
fe0bb82f80d48b0cfd173df9502cdb766f4152e82e05e216556093bf15c0276053d73ac0ae879fa53aa0729cd31de6f334dc01f832c77ce72c1eff97dcaca503

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB33B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB3AB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit