6e8a7952849cc82d256f129f8515ee626ff718e50b730d7b8118b3d329eca1d1

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
28/08/2024, 21:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7b81a3011bfd2a7e983d5e1d92e8c08_JaffaCakes118.html
Size

142KB
MD5

c7b81a3011bfd2a7e983d5e1d92e8c08
SHA1

1d324222d39dbb619e64597571ccfa07bf3b06ff
SHA256

6e8a7952849cc82d256f129f8515ee626ff718e50b730d7b8118b3d329eca1d1
SHA512

96deae5bf010908bb970d3ef377db0cde93bc0cb96ac4e833f5e5c91556d114f72984ff07fef14097e4224d1eb9f6f0d3066343e7a9b4e2e6584dab62534db89
SSDEEP

1536:SqZ1+mnVT1h0x76vuyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3p:Sw51mx7dyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A8295771-6588-11EF-B9CC-DE81EF03C4D2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431044179"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2152	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2152	iexplore.exe
2152	iexplore.exe
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2784	2152	iexplore.exe	30
PID 2152 wrote to memory of 2784	2152	iexplore.exe	30
PID 2152 wrote to memory of 2784	2152	iexplore.exe	30
PID 2152 wrote to memory of 2784	2152	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c7b81a3011bfd2a7e983d5e1d92e8c08_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2152 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0c08a0c6223eb8cbccdaecc5bb3ca6e

SHA1
b7c748438eb7f33d6595861d31e2e4a21d9d0a3d

SHA256
5a6eb3475693d3dd89e4c3ac1b934e983c1e8300ea46d33df094d4fd59025d5a

SHA512
cf3478b68c62e3cf1b3781087f5183b1234264724ee110f339ab1debdaf894cd966440c394494b12d1198b2f0bdbe80ad9374383ac166d64c35a2851417b1967

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16d0c01ee2d7210051e025e641c6e626

SHA1
06ddf5aaf472972098b61cf39a63bda400f672ae

SHA256
4d9ead74ddc6b3c58c83b6df7ae9f8554c0e47f733ec84905ecf630d4e0b8318

SHA512
579a38884b70f0d7c20e59878de2b27264513b031bf4604ac9bbb2f4cfd179cd523e1a7b78f1fc404411050e2015630e3d239be4e527a32d9feca39f41d7ce62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa8ccdb413b6496888f46e43c47f643e

SHA1
b87b1a2fd9e7b1845b83b0be68285851eb4ff708

SHA256
edcf3eccb3ab3d9e1a20a278a5d5b13c87a59cab3f321110087af6a197e971aa

SHA512
e04c42117566d081e7b645e14e7e860a853c61c49ae55df7292e19ac70f7bef2fb2156fe8acc18e96fd4c1975ea2ee782a8ae5393d68ee4f4d538638dcf8dca4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72c57693c83e60dd515eb05c6f03efdf

SHA1
ce2d55ff712f4937ebaaa0626f3b42bee7b04b33

SHA256
2dc2535c809f0a08ea62fdb1b65efa2031cd42d81dd00e03be490353e2ab91c6

SHA512
51f22bf79e287f4c10ef71de74c3dfd7e6bfce5e98fa9331f75646896b7b2255da870bb490aaf769dad36eeaad93c6bb94435c801f37e742b1368b46dba7a02a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a432eb3e8567c8a4ef9ec3d568b77edb

SHA1
230d11c4ebc628192c8e9123fb70f77446167f0b

SHA256
2a89b99ff9bf3c44751b25dd0d06e26f9033abac77e48bb0c6af2c86b10cb2a6

SHA512
0d6fb2e0200602f32940f05d06862a0a3fd1276de0c481c1419759859b6d15846f98c6ad36c2a4f8222e3fc54220889efb902bb8b35de3fbafc088993234c804

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b73440e5995fa4c5ad5dc800200de1ef

SHA1
dcf50bc5395ade0952a0cfa9070019ec5e310370

SHA256
b68887fe9bb6802ce50e841f0d4bd85993cf8d53d2fe3bedf512dd3b7e770806

SHA512
f3ceb1be1f0f02ee6b454b40c8f9a9bf948b6d9c59d2c9589e40489d72015b8dec13ce8305268af9035c2ffe24078551958d2a6be84abd9ce31b8d98b0af9d4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aceadad3b0d6ecc36d7677c448234ea0

SHA1
6043097cd4af6c14d9de7d6027dc9f8f5df7a9ca

SHA256
4d6817562367a0925a77206681c9a35088a5aae86321310f27ec06ad1bf79d6d

SHA512
894b1316555ecf88e13444238dfb3ff182478569b434bd11990cd002bfa01de4b78abb1366035a919bed22106ffa34dc8bfe9b9615d7307607b24fca5e5623f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2030f98a3273915dfadb9ed5b04c4eaa

SHA1
f357991a087db19c3d8e32811268f92fd701dfe7

SHA256
d2697a76b810888073a9e647cc16991909a80b994cdeb8bf0485ec7c8072c5f1

SHA512
cf29beedcd742ce71de4e377042ee6b32ef8ba5bcb5e4a88dfd444162d4e310be6f37c83201eec1c743d031f6e7e31554821e8c212d45200b556d1b8b908d57e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ef185bdaa824763f84cc6b6ce7f229f

SHA1
e07cdabfa8c64a5388f9b6e7fd08bc98d013e703

SHA256
114737ce9cc555ba68e457aa07a4482d239cba1ae4ff2be6822e67d1e214f1f5

SHA512
a01b4811aaf9059c5901ed47ecfb30f033c0c0f644293ce96c4ddb858de6c0eb911d623486a8e9b0bce26165756ef8da0586849a27bae670d7089e35e64797ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
078e9052315627d2a6b21489764b4a7a

SHA1
0b1cbaf9d155d0908ac6c32f2fe90158ea8f9b83

SHA256
612c5bc40b828b348364588433d2a529586fa0d8c849d38e4668329d0488147e

SHA512
c28d3ba8fa7c9c9788627efdde8e53433fe451c192958c1ee1d9960ef9babaf84e3e9f981f29085414c0d9a936766496067cbc86572f5b39e648fbcf16183f14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c8d36c1c1f4e81ccba33d4e09b9103f

SHA1
faf7f66cffc8c4f293d5b1af1739d3a5a91c4b70

SHA256
19237b6d29bdc4c62439823231e6a44b39a16a9f93f2bf6764b778d21e44e6b8

SHA512
ef058176994c23dbd1edd99512d4a80d3599edc2a7b0c1ab005d00617800f974d5999cf82fc5ea60ac10a4ab280a9303997a216f63786d6eab328948ace4980e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3CA5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3D53.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit