3aa7e1d6c841ab7be2cbc84c3751c8ec38b3c4ee4b2cc4ca08caef7fd0375656

Analysis

max time kernel
140s
max time network
144s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
28/08/2024, 23:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7d5ce9b3372881184c8723666b1156b_JaffaCakes118.html
Size

58KB
MD5

c7d5ce9b3372881184c8723666b1156b
SHA1

c6ecfd8c42e2734404e184af25f774ac77639a7e
SHA256

3aa7e1d6c841ab7be2cbc84c3751c8ec38b3c4ee4b2cc4ca08caef7fd0375656
SHA512

5a5342f90924bb72ee0ce8c2622848390bc64e40fbe81f5ca5bb124e7a0151c421a4bf9ebf3e6fb3821c557904dfcc31a7a6f1719aed13604b8ed6db5653437a
SSDEEP

1536:IblJmjI193v/oFNOICjowtSiJq38CN+yshy:Ji9mW+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431049305"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{98A3AF61-6594-11EF-890B-725FF0DF1EEB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1960	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1960	iexplore.exe
1960	iexplore.exe
2900	IEXPLORE.EXE
2900	IEXPLORE.EXE
2900	IEXPLORE.EXE
2900	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2900	1960	iexplore.exe	30
PID 1960 wrote to memory of 2900	1960	iexplore.exe	30
PID 1960 wrote to memory of 2900	1960	iexplore.exe	30
PID 1960 wrote to memory of 2900	1960	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c7d5ce9b3372881184c8723666b1156b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1960 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
8cbb058cb341857a5c0ae9ac336906ce

SHA1
fbd3c03d0397ec371941c00b66007004fb418974

SHA256
0b06a60caa1b5502083d35f78e66f11da3bc4763e573ce2fbfff248f5b2c4a92

SHA512
b276bcd7dbe725fbe6bc22c00653eb6e0f2879702bf6484d3ec310cf8021a2f90e8282f27707a84eff6b6c6288fdc9ed48d064c62fa39284a3b3e0122f569a3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c7e5aa6b902ef484f011fccaa9037ee9

SHA1
65b6f0927c7d71f7bf880e8370b4a8232a9a5431

SHA256
7c2065e1338150f9babdabc6e6f4e253fd077aaabe1ce20f4c01d3e49834bd15

SHA512
860dbd6fb311318875203524ed555eda9a5e80e07b3ab412f7cbd08b22f8d27045a26eddb0be338044096aeb2d08d381f7c32ba9f569d6881c547e952a559208

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3a6ca94626bd83c8dff046e1a3133456

SHA1
7de3c9b10f72f7d834ae646bde5a117da90def6f

SHA256
2522f8f7351350d87120f04e4c584a461db92b65d9af0b92139500732939c2ef

SHA512
bc240995ce9470826572069aad8d9581acd652dbf910abcbae59177c901bbd0970af2bb6aac0b1c6ae4779f5b751873300b1ca5778fc78d9cb302826157fd2a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
82b071f9e1fe0ba8e0dfef191b186926

SHA1
dec0632eb2edce879d30b854d12765b6ecc6b077

SHA256
9878ddaf75019be714dd473711f62283f380c87edd3d89c5ab36607787fa4a35

SHA512
3799d867c454aca8ac2852441da4c88b1e658bbfa60a622323deded6591bfd9372d6d97c87fd5aa139d0a55271f64d414e2a9d021594adaf5c3829e6534d40c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e39a7f2fa0561d4343ad3b7992a5df91

SHA1
fb3cba939cd86b23c458a7c3a2dbcc7b834813fc

SHA256
2038b5ec26f462b4d2fd48127760fd8da8e3d6ae0da9c45d475c65ed31a6b394

SHA512
dbc1d6ac5b775d468255d8eff80ce9f8104213912e9a251f7d5bb5ee0f27ce06ba49739c3e7d854df780c37189f233aef4e72ce8bf6be7c1f046b6d5b647060d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
705b75294318923d0b3b64918b9f6035

SHA1
400e2678cc84d55976a65b64da484aed3564dede

SHA256
ba0a7207942211918691e4d4226ca4d01d867694f6f4222d7345e90399d29566

SHA512
80239f4710fe380ce7e2716379943ea1327fe29018d9accc23777e7b393074967c484835dddabaa1ecad43353dc5ea417de88189caa37c314d2466fa35444222

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
349bf1bc71556bfc537f625e2a61b824

SHA1
434e11789652f8ed323932d1a963ec15582a7d00

SHA256
ee828c26956138bdeec55e05a035f56800d15621d42ee3cfabf8c94885454a8e

SHA512
b6c0e0bc03604914841d2e7156d84ef0d977a1dc1824df3971a4d12a6f984e306f57cd6f92e653563f9308233c02972dc7facf1c21ce8d70b6ffc08e780fef9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
820e4decd982d16952d1020b85bb350e

SHA1
3d60e00dc011b02d5432d305a55707c27086d392

SHA256
1282663cf7dbfea0ba8b606d9663e00fa4fd96a69df9b86a8cb5c8aadd365a2d

SHA512
28e0ef1cfcab0e610dd2969c6d275d984e454b3a72cfee2dfa932ac1a4dacbbacc8585411b25d8ffd14e2e0e7650a90ac8f818cdbb7733760514147343af7081

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7431c06adbdd65f866dc90f082dd2ed9

SHA1
ca7e105f92e9b8bbeda2b667b121321f7c27e377

SHA256
4c60a56afa4ba5a63ef8c0fb6ca79cb388fe2e641fa89ceef5ea196bbb13faab

SHA512
b876c61028c4e1f48f673336568630687351beb2221de13306bd0aede8184570f1dbdf79d5735792b350d30513d1d178cd15d4c5cf3235ed8d0ddd5e4053a10c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
6042380e8c9f91f7165d79f90cd9b983

SHA1
ecb27a59a8356b902948236a267bf5af49d79046

SHA256
bfccb86f1cd07cad0dbfbd5c4baaf690ee21f26d9e3ad3abb38f6046924ee0bb

SHA512
f9ff9a6639ee3c6e60b7f3dabffa4fec1c6581031738975e6f275cfab168277b6b7725e4e3b9e978a7a9fa1f8c0bc0313d14bf196fef6100be61980348206518

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab98F5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9908.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit