7ebd23b1405e9ce3c61698a509f90a72d801ca7a903d5318261a2631878a6987

Analysis

max time kernel
130s
max time network
140s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
26/08/2024, 03:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c23a0879cab47f8b16b1bd245aa33534_JaffaCakes118.html
Size

23KB
MD5

c23a0879cab47f8b16b1bd245aa33534
SHA1

73a209ddcb4a394c00bf44ea6d34f32e2227f4c4
SHA256

7ebd23b1405e9ce3c61698a509f90a72d801ca7a903d5318261a2631878a6987
SHA512

3b258c37cfe962dc2652bd7c476e7f058fe536324a1e12c3d4a82acc103e764490e3259df44a9f2f191bd6e145cd542cbd52fb73b7eede880c722dd954417e5c
SSDEEP

192:uWvAb5nOH3LIDh0nQjxn5Q/2nQie9NnTnQOkEntGMnQTbnZnQ1CnQtxwMBdqnYnn:qQ/LvGC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430806146"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{73490E51-635E-11EF-9403-6ED7993C8D5B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1460	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1460	iexplore.exe
1460	iexplore.exe
2280	IEXPLORE.EXE
2280	IEXPLORE.EXE
2280	IEXPLORE.EXE
2280	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 2280	1460	iexplore.exe	30
PID 1460 wrote to memory of 2280	1460	iexplore.exe	30
PID 1460 wrote to memory of 2280	1460	iexplore.exe	30
PID 1460 wrote to memory of 2280	1460	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c23a0879cab47f8b16b1bd245aa33534_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1460 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
037026edcdd70c89a0e1565cc8b6e147

SHA1
95f0e25fb888ae1bca8f073d30951492e1a9f3e4

SHA256
68d594454b4e47e8a556ec820a8cab235baa8be85b45b6e6064c27b11302cc18

SHA512
969494c4a3628d558beca0937d9de926b5ad85899fe6a1b38aecd02eb2831d85ea933df3b8d913e0f086fd10066cdd0e5f4528cb344ca553c89668f39de3fb3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1a7b3393c313c3bdb88940d7c9592e2

SHA1
409c9c2ee4c92355517630a8a92b0d5f744d8182

SHA256
c305f719bf77242a048e06425adcc5fa615768c36ebe01d14be7ea5ab2dad7e6

SHA512
91cb9c1151c74ebab80ce5c6cb875f39af584abb628d9a1f48f3581ec26704bdcbdd1bb48c422142e9c1c8617bc1c8140e28d519bce632d94ec2c60c650ce7d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df9f1cd63de58f065563b070994d8e08

SHA1
9b98061aa681c6f31cc9b979feba7d798bb8e2b6

SHA256
1f3f65021d0c375d4b51fffc640ac2d7655d3b68f236ade93c6820a5e54d788c

SHA512
6554335aa6a74141f99b7b0823d2289261412efa067b98afcebdcb2688b1eba27c9a32fdf5637cba5d77f9dfa49d1031bee1706dd4fc0bb12e9a218da779bd04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd1480536fb078f1a6b8bfa2084acf1b

SHA1
052305c48d815a6306c4d4995d907e8ced9a943c

SHA256
d0d35242a2c372678094d1a09e445a3199a61be6472a087599fecd6c81fb0742

SHA512
88380209affda45490a318242a6f057f7852dcfa0f3101e1109e145423c24a6100013fc4514019422c0318853877d8f8a4c970c6f223d37f9da27a52e66b818c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a3378d90773667a4e240e9078abc180

SHA1
fe13b2d9157bcf2b71aa33bc38654fc74cb0f51f

SHA256
b30cd2084e16a5e2ac9137a1cf5863669c6b6d788c99b76231a33da2dfc6d89b

SHA512
c26ae93b33caa4547f734aa9148b8faf4f4b4aa5186c97ed2c8728acedb4366f9cd84b684f6090455bff4def86308647f107127fae72881e8dfa4ee5430dba01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ffe3db77cd03aa38555fe23c602926ea

SHA1
2fe4025b3a644d109d627e9b86cd77d374e7a86a

SHA256
a16763d8c5a5745f51b2e29e2fdfdfd2beec9e1c3d5d26cee3a4684cd116d821

SHA512
656871355a93ff3c39f1e8ec5e980e32b483d1ec38c89b7ae932dcfe806fe060ad8f3b800a3ed8162f8f97cf4e8a555284c2234287f09553a190989241194ffa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb4711edb1725cbad9400212f10b91cc

SHA1
77939c950f26ed62af55331ec4841907d51517fa

SHA256
2f81b19cd7146465585d732b899764ae0898b7a66ebaab59188b716291ea7ac8

SHA512
4e93e3fa187a5a55fa844205869d33994f72b81c293bd8e649425dbe698172a2b7461b6297cfdbc2b818420e3bdd9143a851412d6063368329314a4d5bd3d9d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f2e76714bb993d86be0596c9ed5b533

SHA1
2f3ca3d6e4f85d58251297cb15614177b8deb0a8

SHA256
d8df50090d9796c51267421ab0371d29d70da0a605553ff19992ac5ead42986b

SHA512
7f570215df9d35bf6e1325f19767390dba974516296c03ff3bef4d79eb2942c9cf37b946306553694a270912065cafc0f404684762c634006fdf2349c1cf2f98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6df2817d77d2255772304f88d0aa897

SHA1
9737a9c246c911a3f60bfad6810ea83cde2e1272

SHA256
ed3009a11a07977cecf0fc8f0103d534b0aec7990b65648423b85ff90536622f

SHA512
777990445d2f0e025f426d2ff64c91f29c3b351c755f6ac4ac3b92f9601d24a6606b202ae44bdfe6123ba74d9312bf193b6cac86468e30f61a656c695e7d3b0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabACD3.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAD93.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit