4620c80529dcf1ac2b4ca6a7964ebfaab17ee4e9790405fb334562234f02266b

Analysis

max time kernel
94s
max time network
127s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
26/08/2024, 06:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c271c32b28ce8ea5f2df6c3ae2aa5e3a_JaffaCakes118.html
Size

18KB
MD5

c271c32b28ce8ea5f2df6c3ae2aa5e3a
SHA1

7abf624bdca11769ead7ed96b12fcb658c00e5d0
SHA256

4620c80529dcf1ac2b4ca6a7964ebfaab17ee4e9790405fb334562234f02266b
SHA512

250d69adbe20deb4739cb321111d193515ad7dcab7cec380dd4d032637bb4d1f722918a60c31966a6ba87965c37ca6b6acbc5a4b8b61452970daf063d33c8257
SSDEEP

384:smlIcEt54I3THuJlvI0DN6Z8N/gb8LOXguLZ:078Fg4ExLZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5F5324C1-6373-11EF-9DBD-525C7857EE89} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430815132"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
376	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
376	iexplore.exe
376	iexplore.exe
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 376 wrote to memory of 2884	376	iexplore.exe	30
PID 376 wrote to memory of 2884	376	iexplore.exe	30
PID 376 wrote to memory of 2884	376	iexplore.exe	30
PID 376 wrote to memory of 2884	376	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c271c32b28ce8ea5f2df6c3ae2aa5e3a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:376
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:376 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
baed1dcc70d4c18a24a31d784136f679

SHA1
1c9bf99668852152fd587741f5d39dd02bcfe16d

SHA256
427c1524bcec1837780203d00501a9c8c67686bb27ec861cb0f4f6d3ff8554ed

SHA512
6fab6e2d290cebcc1cbc119f419845cf63ef1dcbe04847ef144a94951e1fecc6f119f28436e95b20bcfb4fd2d45e4ad29842350e41c30fe2bdad98ffd826d129

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9978d48a9021592591a92127806a9b07

SHA1
79d8bc774145e57b63c17420f3b64fd9ad147ff3

SHA256
01e20330ceba5c3bc9e0637bd3734d4a36b0ba2b0a47f62bf652b2f8ad6c4dac

SHA512
1a46b3d7b696dbe3a64f61605c5c15f02fcaabb3661de70a53eec0d136f05eea35defdd9e3fca2e66dea1052dbb7fdbedaad5f4de7336355782e38763677bdd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79277a0f392294518541253d1fee8f2c

SHA1
70aca282464703df66e289c6d0ac1504e7c382db

SHA256
c0e14153b57956e3ac777fce34feee368aaef0acdeca9479378c7ab425f9cf42

SHA512
331c40c4822b1cac7890acab701cd9bf1cdb2b990ebc9d333b2dc8682626a59080776df72c78f08881af9e25de76716b5a230512b5c8c1adf770142fc17b4c7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fde52997ced771446a7bd87457446aa

SHA1
792da3a3ee7015a380907ab5ad3fd8796c19e5d0

SHA256
56abd7a775afbe53245e4bfc35e8f14ab415f3a320591ea796a4ad0beebc7ea8

SHA512
070e3d4554564234a24562b5c963481395c47a59a15d5846d6f2c19794204b4eedd99c685ab0e647781d77bdec58e92d7b94c0485548b5877ec9855732301ade

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3dc0bf6b12161cdcacde5d665adff8db

SHA1
49a7f98086a929a08420b82a29e31b5b66859e0b

SHA256
7a6a5db051030cb2940b31b3835ddb9554e3a1fd83c759c1d71a245ced02accd

SHA512
ffd5263349e40bb69b6a153c5d9dca84103922d9070a8d6dce845a96bfe39ae248b2d664e3d21e6cb6299d0e9d94c59ac49fd4de95e62c477ac43b7684491b24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4b1d62573b63d7e84f6fbbb82dd34b1

SHA1
50ba24976dc15edf14acf127511b1056509034ad

SHA256
8e717e9344303cbeab587da0816e45a419a6670d00d69c0cb75b0a61aaf2e29f

SHA512
d6fdf8177c7a7f9d590f072458c008ff986242aae27a8d2cd1686f9b2c8234f97e82512fab6ebebe731e1e3ecb0791b673dd9a1d8db1473ffec6458d7deb11a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
848f41e488ffd4d2bf2c5f726cb268d2

SHA1
e1a798c98313eb587484e48f3c1201192b600094

SHA256
10795064ef0e58318a1325ca9a18e8711b23fac2edfdb466466bd28a1e96f316

SHA512
8bf1a443e0ccd0c6681f8846ad457f302374d1d8545a0864f3e5a1c2bd77d8de81e4e8bf94fffd9289c4f0d5eefbd277f915ef66a8b810593d1d4e019ccac5a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f79c8386f01ccfcd5680145da4a3caa9

SHA1
3b4e46d95d3768b64c0971c1b41434531b2eae0c

SHA256
4470882d1e3dcacaa8839cf3746079d051626091ec8dbb8031a91f1efff1ef62

SHA512
6970d2ee8ff68d382ac64c8f895721855431390a777092260da5c30e199f51f5c3b3a2ae66c4b9a9321208e9c682c1ac08611f56ce8eb3f2799c59c6da89a443

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
911f32226868150724bfdcfd547b69c3

SHA1
b0d89e71d6ea536d9d5a0e41ff41e2b20249402d

SHA256
575ae3c9c24ee2b4a228bd55a57fc71a59f435fb3bbac92a278fff9fa28324d0

SHA512
91a91f8b734d3941212f7b844e896b49ff45933cbc2288a10fa9d2fc7641f89c52a9e3fb41e405c836c78100fde7c70cdb67d9030fd01d16451b1c2567af21a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5F51.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5FC3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit