7c4488061fed86c570db4e6b9defb5ceb585fd653e074385f9c64c252917cd8a

Analysis

max time kernel
150s
max time network
144s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
28-08-2024 22:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7bf34d57939dcfb61680acc35d87565_JaffaCakes118.html
Size

19KB
MD5

c7bf34d57939dcfb61680acc35d87565
SHA1

ef70610966775fb3cf634479a1a17403276c8786
SHA256

7c4488061fed86c570db4e6b9defb5ceb585fd653e074385f9c64c252917cd8a
SHA512

5f1b85912078b37865651bba875e6affb63172a0eaec435567e752775f4dce750198dc7cc73ba060b215c63764fbfc576fa7c9bd6e5af58ff64dbf3b7fc432f0
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIM4izUnjBh+w82qDB8:SIMd0I5nO9HDsv+zxDB8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{498020C1-658B-11EF-A74E-76B5B9884319} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431045307"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2860	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2860	iexplore.exe
2860	iexplore.exe
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2832	2860	iexplore.exe	29
PID 2860 wrote to memory of 2832	2860	iexplore.exe	29
PID 2860 wrote to memory of 2832	2860	iexplore.exe	29
PID 2860 wrote to memory of 2832	2860	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c7bf34d57939dcfb61680acc35d87565_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f2d1dd90986efef14045be082ebc735

SHA1
c128df0f30c9adf7e045a2924f762920f19b7ff3

SHA256
a8cf486ed431d0a3fc02042ca999cc81031d50debe8534fcd9861f80e6eb8d61

SHA512
9382ff5723e2b8201519747ccd7af5b23ef517274a0b1403de3b390cee8d61d0b52adff3f200d7645d51844eee97f61bd442e2785d22025ea76aa54fcecdaa3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41d13d54aaf5bd7b07108469c5ac795a

SHA1
6bdf0407fcadce037ae3216a0ec3cbd09775b6dd

SHA256
68287b0120a60aee51eb17b416286c430c4808ba9f208646da0a8a98c1e10358

SHA512
f8155ea7a66e173bfdaf207af67a174cf381be6129a0512d4c6c5a7a90428725cc9944d4d64b9bc269559bf3b887984e5ca28e05f6818fba083df88854928c66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d34f0cd55d34d556a3d290f536cf582e

SHA1
32548ff2644fd3396e9d61c06d2f0eddd4987510

SHA256
f864a1a47819d97585f0d7012577d9f196f616894dfc8e31f78e039f10a489f6

SHA512
ac211fc32dad5140ae705f90d53e12a49da24fb8781cf5374f76a08035efe0b6cbc541afd470f6ceca383edbbebb2c20acd654b09710f381eb16494be17d9f35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
849c0e3caf01d5686609672dd63564a5

SHA1
3b3aa0cdddc22d1067db6022591f837669eceea1

SHA256
d63e2d507131d9cf72a840055761e38eb441b2185d832a55d6b63c933f48c1d8

SHA512
db3d3ab7bfa798893b3477cb4636e83ccff1573d8bf32c8f43278abaeb90303e034fa8f4df3d7c65afc51ea58c39f2b7e413c71bfeb9c6db33629872fd41f3f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0042be73008a2c70dc69854927e56356

SHA1
5d4073187d8363300ed883675ad8d2d102a24d1e

SHA256
45d13a603adc66a7866af155c42a966e730fe842360466a6bc893dce7085f87c

SHA512
cde380239f82913b2f7c25aa6ad6c77f6080e7b97e012d487f04c5070c7cc67c9e39201afd5a2dfaef09e40b63e17d2a253b5868c21cbfcf0cea59792300a240

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36d6ab70cbbbee7cd8897c8478c34196

SHA1
60336e003c4a41e189969d4a7c92ba60843840c9

SHA256
6c21cbc3dd733e0cfc49ad9a341c26e184e88823c69bfdd2101c824aac476ec3

SHA512
6b34ed5f547d5c6284c0fa7b66c6660a8ca6623b89e6aa072bbeb22a0456a9b3d344fff06f3bf4f0bc6309526d1f0e547892fb13e3c48352cf81e097a60e3430

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e419dd0de9a91a6f904e1063f3dbe724

SHA1
de2f815084f1a2fc286cdfaf11f35b7adc99d8ed

SHA256
6c57aebfbb545324c28a4cc98c343d96290b611ea397475978d47deebc1bbe83

SHA512
e1c126d5fddb3069efc6284a27e17f3050c93b9701101ccf0c29d433cf32a7128dc64fd1e4225a936e1c1224b4290cbcd4994916fac5cafec6febf536567e6a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1e155ef019b08283dc0c253f69bc991

SHA1
8ed19db1edca5250086e1a30487ea2dcac7a032d

SHA256
99273df1d00a5a9e101a8204f7527bc385140199b5dfdfa780d1c54811d7d828

SHA512
4756bb1fce29be0765887a5df20631f7aaa86a5055f4639dec1c9173290bb57bf81f546042d3efad79fb5f7a6a6543b466ff0d2bc18855968b205e15b120b072

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4cf9daf884141663534ba8f1be66a1b8

SHA1
67e5fd39c4a8083579849ae2e68eee966b5dd5b2

SHA256
9a282332f30eab12e03df9729adf28b7a06eb8e2920dfe3dad461916113e8121

SHA512
38435b4455d1f153772732f7e17afcff6d0ea1d19a29fc993ac77366ffa493b514dd691ddc1fbd70cc0131571f15541055a0bc8cc6bd41ae89308d72b7e674ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF03A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF118.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit