7d6f31500edca27f70faed8323e551733e57208b0ece782943fdc9e497e9a70e

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25-08-2024 21:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c19507910babf655e5cf584ca71c04f3_JaffaCakes118.html
Size

23KB
MD5

c19507910babf655e5cf584ca71c04f3
SHA1

fdecb39a1385c2578e6cccdec57e7e4815a7b8b8
SHA256

7d6f31500edca27f70faed8323e551733e57208b0ece782943fdc9e497e9a70e
SHA512

ba40ed084341e079e8c5b862d3ccc1fb85d6ecf805043a60a034eecec505d3f232235f66d11cea172feca66c91b8357e835d2c9656ea8fe53e899786ac7d6c89
SSDEEP

192:uWvYb5nBGnQjxn5Q/4nQieLNn7nQOkEntA2nQTbnBnQBCnQtjwMBrqnYnQ7tnkYK:MQ/Rtr

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430781729"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{99992101-6325-11EF-A850-F62146527E3B} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
860	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
860	iexplore.exe
860	iexplore.exe
1272	IEXPLORE.EXE
1272	IEXPLORE.EXE
1272	IEXPLORE.EXE
1272	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 1272	860	iexplore.exe	29
PID 860 wrote to memory of 1272	860	iexplore.exe	29
PID 860 wrote to memory of 1272	860	iexplore.exe	29
PID 860 wrote to memory of 1272	860	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c19507910babf655e5cf584ca71c04f3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:860
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:860 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f236415ee24aa3cbb4e3eafedd3acaaf

SHA1
399a2c5346c6e4317ec7737a06cd6bbf963c9c14

SHA256
4cf614dd22d6d6ca8c8a658eb70b619a7be81ea5c1c287895f4790caced5cd45

SHA512
30506324ee74ed9696b351e77332178e0deacd5955f0b67e2642cbea4eab28bfeb9bf5ace23536a79bce41eb5189d16b51cb777c2d484b516200270c1e405a70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee67e9e6965cbfd7e544b75d8a048d30

SHA1
e0cb07cfc5ac8821c9f75caa8e0eccc762fd5205

SHA256
6664cc453753ffd481ca783a60a288acc3feda2c1fd9717af3b59b00137fda70

SHA512
5b7f28dc30d28ba2cfb6d513c5ad95ac780aa1da6574e769e5f01e369119fe11843dbd599d6ba07bf4f79b0be7d4a2a92115e0b1be13154fe3a4a7abae4774d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64610647d103733cd0037ace82bb2e7b

SHA1
29f15875540c2846836cb3e189e6657164902b07

SHA256
74d5501b26d9b6c8dc46d0c9cc8ced322c81e7b23a6e02a83d0e6b5ad26b5ff9

SHA512
383dd9a77c22dbecba43074dbe99f936b1cf931b478201b1953f515eca98d1028cbbc4b0f3f68fecd15d6df53ccffc34b8f97a607a8a62e39591d95ca3dd7fad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38e2b3c3aa48f7718da6c947227e5ac8

SHA1
d37c9e144b22a16beaded8a2c45aaebec2d4877a

SHA256
d6a69fcc2173a18218fcf4a6b1173b1a82dd7b97b3ed1d4d76d8bcdd5ea0a3ca

SHA512
845e255b4e9cfebb2dafaedd2fd23622ac75ba9fd0c685579a7fc45ec104e93aa5315e91190a9da3354584da715aaee8e1b39f48a160174b40d5e0c9d5ebd4a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
569f392c1016e016fe60830371637fdd

SHA1
8b3e8730c3c1e6f54ec9de965e8c19047af0f1e3

SHA256
9db6f465dd5767005b0e314d95fd15acb3a48686ab1e2fd1b13dc482e3d07fda

SHA512
db35a4a9006420ba1b8a55204f3893869329f71170f00d4501c9c43ac3766880532bfbfd007b28255374e0b794d78b7edd35e75cbbd2af4481936c2a1a5834a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
340c9a6b329870001b60e3d536269791

SHA1
a5496fc2b65f55d073566abd0b19f6212ceced9e

SHA256
c9acd6cdd43eeade908a74872faa46a70232c8231489b8103962e0d2a6121eb0

SHA512
2acdba02454b0a6775618aeaff35db2d8186568d141ee8d00230326da475a4b644e14058cb1905b8b0ddbe3679efed8cbf801a1279e3a9c533417f4d7c0a5ae0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be3d6868a511d407f051544610a93f6d

SHA1
2715f5e66e07c2ebd7937b35a44429e031269be0

SHA256
29132b4a13452477350f1225f67f2c730ee9ea05157fdf0011ab3a6045f8496d

SHA512
66b9d5e3449f0adb674acf8e80225eeb7fde2a8d34a1fbe00b87926612873e12117ed19ec0658b5761eaa220d0bfcb88d5b2ba1091aff6151a8c1ff128aa9887

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aefadc245fb2958a21cd5ad73065a171

SHA1
16f8fcdd8d822123627e425cead8ff967d1bc70e

SHA256
afa4b4ddecbb0df8b65aa477890318eef2808a5a2d24596e209c93899800daed

SHA512
a4afc4780c782893587dcf1f07234d24850a1f9917e9e5c7334de73ba00cae4a72f1b461f6e0fdbce90ba65ca5dc5cfc07d3d77aeaeabb006c78c8b34d4141b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3aef66279c307f3560b757adcfb46536

SHA1
6e994482cad0539f3b56623679d4c65cafaaffbb

SHA256
b8e384a44406257f684d6c5ddfeb9ee883660befe33e9380a7e4b62838dcb682

SHA512
4c4dca28efab53e5770db4a6dc6c0673a82299144fa95c067c9a74e2f4c24f66560e0ad91b33d6a0e633465eaf0e1503d332ffb013a5ff783638c1488c8d4d86

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab122C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar12DA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit