8490c4d18be8fefdf71a6b020864a1ed532b92a26f48207f1cdd8f8956851ad7

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25-08-2024 20:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c19052d34c29c677cadac8479fe94fbf_JaffaCakes118.html
Size

25KB
MD5

c19052d34c29c677cadac8479fe94fbf
SHA1

82f35ff9477a2d6d15a51834987cf955d6a6a7c2
SHA256

8490c4d18be8fefdf71a6b020864a1ed532b92a26f48207f1cdd8f8956851ad7
SHA512

7f8d6db7de2cd0d8bb3bb2edb78baac2c96a2f491912a0d9c6859dcd79c5f395403ea03b5f04b9e925f15c51b54434edc8bef37833dbeefcc4687595b84c5758
SSDEEP

192:uWjumb5njCnQjxn5Q/qnQieBNn2LUnQOkEntuYnQTbnFnQQYqChAcpdEE4cwqHXV:hQ/8L2lZpOA

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430781180"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5256A7F1-6324-11EF-8CC8-424588269AE0} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3044	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3044	iexplore.exe
3044	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2748	3044	iexplore.exe	30
PID 3044 wrote to memory of 2748	3044	iexplore.exe	30
PID 3044 wrote to memory of 2748	3044	iexplore.exe	30
PID 3044 wrote to memory of 2748	3044	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c19052d34c29c677cadac8479fe94fbf_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3044 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9868e9e8987e884b12544442355d4ec

SHA1
e608b5dda6557b476e7394b76f1892ca20fb0606

SHA256
e93bceb5b8bd68b719eccccef21cdb9996adee10ec43ae66f4deb083332c1476

SHA512
3b29665556b44b084646cf6ebc9244366b8ee3e592e9755a7b1cb7c57a5030adf1f108693930fbbd9f23b9dd38b74170cfc61486fd5a0857737f76e1e98e655f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39ef09f4d6a62e48d25589464d974be8

SHA1
769d589b35af68ab8c5ca22434a36011e4199cd7

SHA256
0a50fce4542f1cfdf4769d4e055ec4a2a7e0de85ec65e2487192506be037c244

SHA512
76bc89348cdcc4303d41d51b8188a6c575703bd57e231c9c4aa9128b1bd678cbbdea14c6bb0d8ec61415611afc884cdb52c48d02b309e972e1751d0e3ed8e33c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9937f1a3ae1236280bc163dd3d105bd

SHA1
107bdfffee882d8963a670ce418a6cd690e63ee4

SHA256
099dd740a731f0eb68d308f30d5c2012816ccf3a8d987ee506e3561ae79d38c4

SHA512
ea7c017ebf91abcf0755603a19edc7911518892a7c838f2641d99f2344005768923cc56f21eb8661d276ba62af69e8c4dd377e5e3b1c3db71ce7c558547f929b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf811528f4ede449be87571c13e30a99

SHA1
bcc21c4317937c0def58a6c7830d755c41a9f845

SHA256
14c497537c2e31119ef748603424e6ed38e041a5aa2c3e184181b487a23489d9

SHA512
2ea2a60af1641bcf601bd321fc7b325c10de5a92e085b5aa5ce6cfd832d3f5e713eeb58e6381c772d39cb1119127cfadb3972082bc00d4f0dab6fec8635950c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2b028395d750afa8b34695a5a9c2732

SHA1
dd5f032093ace9ec5958daa8fc7f3912cd8c4267

SHA256
0850a67ab9ace3e3cd1cebf4f220dd2a4c95bf73b42038afd3698690552c2473

SHA512
e5c8aa5fe9f79bfad42eb2ab56bf16952d2e89317bf53f39dcbfa0d7d6f3faef4805bec370a8d38371acd3401650fd5509a6abc8ab3dd2f8f77810123f6d3820

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
939bb6958c3c4898471677c23ca9a39c

SHA1
4f487563c3ab60240b641ef0967257fe2fe062d9

SHA256
303a766ba93b412c46832bbbc2ec8a3cda87cf9a6194bf220e3dba6319643f90

SHA512
64628fb7c252cd8af317733f61e0eaa4653dcc048c38ee4e9473f2501b2de4f86f190ae1da06ea428cbadd4e8b69f985fd91905b15146f8ab42dbc2c0d25f834

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
240a202a937ca159f82de8921575a955

SHA1
a5b337b8342ca0eb5b692137e85c047b51ed82d2

SHA256
92e3c453ee7f8b51007b309f14a3d760a03ad00f97799438204ea916e267f04b

SHA512
b15a152f0eb963a55c3a6dc5c9647ca5433166d7aaddf09d76a6f817a2135408c6e443e094ed164f7e9180bbd5296f2913eb73bc5a9601fbfb00186bebbf7551

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f92dc2668060a3e5b81df5f8544a463f

SHA1
70f020d3611efb7cad428437e2c67852678889ce

SHA256
e5d041386c72a5c889269427c566d18d7fe8053c8519776812d7169c8671c39a

SHA512
c03e92f325043975175369c76e249032b8e6e646c901a4cabc567faf53445cac87c026788f00747208689b287dd45ffd0559de060247f2fdcd4db9db1a44bdef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3dd2d5ac09c19b5dd6f5dbb89399bc9a

SHA1
a8f15d87ea60572d9baeb8d2d05f6e33c9cbc6cd

SHA256
6e95a3cc69b67014785328dcb1107c6c5fff80cb6dea7d10ea3fadfdbf91d169

SHA512
6fcaf18329ace592e564f4637a4aba1f0dc911f39475117f8b6b81aeb5f736f44c3ea25e5f9375ab1368a8080517150cd72b79f714baf046339183848d9efcfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4D86.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4E35.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit