13329f4618e7d75baffe80d30642f89cdfbe87637d17af62c5730587a95ee3a2

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
28/08/2024, 23:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c7dc89148b1525f64c56a1439ea0e83c_JaffaCakes118.html
Size

23KB
MD5

c7dc89148b1525f64c56a1439ea0e83c
SHA1

08a882d18784b49ea7a9ef332502877d34043b9b
SHA256

13329f4618e7d75baffe80d30642f89cdfbe87637d17af62c5730587a95ee3a2
SHA512

7e6326c3459a2b9fb39586c8c9808f7a450c3cd5ca8c9c1e595ffae5fb53a62ca555ad4482cb4d14e5e1e609e83eb27341574713f63e38f93c756ee1dc29ed24
SSDEEP

192:uW/Mb5n1i74nQjxn5Q/ZnQie8NnwXInQOkEntrznQTbnxnQqCnQt2wMBcqnYnQ7k:NQ/W0wYI

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431050621"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A9ABDAF1-6597-11EF-AB3C-C2666C5B6023} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2944	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2944	iexplore.exe
2944	iexplore.exe
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2736	2944	iexplore.exe	30
PID 2944 wrote to memory of 2736	2944	iexplore.exe	30
PID 2944 wrote to memory of 2736	2944	iexplore.exe	30
PID 2944 wrote to memory of 2736	2944	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c7dc89148b1525f64c56a1439ea0e83c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2944 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d67e5d6421f4c9fda8a96d7d06f8ee8

SHA1
319152bb852e0646a5e75e4846a319f9af098c06

SHA256
68440255c8771979303df991d298ba67adb11c8f9df0f2e888b528301faf2d42

SHA512
97d3e04edc2793d9ee7384eab8673c839d7d7c30ce52e1e3ec9d843bb05e7bc45f0def8b23d3795cd69b136aab7fad545c7e9cb2a570d76ad9ae399da12470e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6955d725837472bdf03fa00484cda60

SHA1
528c7574dd697191bd6412cabd2ae14407b134d1

SHA256
2d1fa8d165f5b7af2628e7b1c992164ddee89d2be3347436bfa44eb360732c05

SHA512
c27838306f639bc22b37aec744296e77537c777c43b6cbddbc00c41a6be14a8c94fe5ea3c04e2b7759e453f2c93bdec00b8c2f45231e2a74f6ae51f09869656a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a042e9847a2b1cc778f30957f91f598d

SHA1
356c7dfdde0562e7bff0f17ec91a47c33e8bab82

SHA256
7223263fa94e5030cc32425532ae947ef750fe46b29ce9e3241e938b94cf063b

SHA512
1d09599a01cb014c3351ae2956909635ef10e94c324895dfe2d704894ffb850d15075af5971211b60052fc9e0b0a8b55eb44da13f1df6928caab6c33d55ef5e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfb3c942f447c2e50b81161bb23da77c

SHA1
b3c524f8aee23e7a1a8babf9405712f131f3eee9

SHA256
708ee9e3ed8ce11455bbb916a8781947d49ad978455cdb4e50603c34fff04089

SHA512
ec9e8a18b61a90b32aa8ad334ab1c27cdf6b91e817e64c327b6b1534f04c385b4fa29a22d08243debb9b5869700cccfe2accf393868b53d8d1dd7e8847cbb8a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6db49bed8eb244a65e9e2e8bd523187

SHA1
cedbe57292bddbb679173fd022eecd4a41e05472

SHA256
ca3a6ae79b7de646a14871a2f33b5e5d1b4de327a5afb33fb2e92110de59537c

SHA512
4cf8bc174ac3a76ff0561c4557ca6f0494e5bc0098c8369b63106732937cc83ba74d5ea565c39a073b0b9971ffabd437645eb2eb391bb0dc938d4cce5f4b53c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75bdf0eef6cbce8ed2ed67f742a30862

SHA1
4bb342faf3fb779ed2200d501ed4c104c34d1c26

SHA256
c26857471e3ec072109959b60e9533e718a3796f664a5eb374401ca2f92db531

SHA512
af837e450360138a01e09a5c6107b152c28425f9f9784f863ed6e6d0bab8b7daf62005d674659865c6ef3a7ae33684b7f1e344562e2aa5d7c33fc0c6f9bb4b41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9cad4e4351442c68af57ddf6ebcfbe3f

SHA1
b92af959afa4cfa93452ce60e500c3189811ea8e

SHA256
1a775bb684b94617432009af1affbd1c9f9fe0a4b220346b76c53d1d5cdcd713

SHA512
6ffb1843b242afb3bcf831d6af727b9c64a124608a19ff4e5df10e3fb7e6d8e96d6df9574fb826b4ebb2b04c928ea7263dfbf8f83264e6d87571182cc89c9b66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
396df7e6b52d9c15e2d6ab34709d0a75

SHA1
6701f394e1fda56978deda6920b7e1a0a84d02b3

SHA256
4f5920de0cd44422e28ff852e2884501c4137d489292fb3b1896e61f58f163ec

SHA512
4cea9646ae8aaa2928f39628fd601ac5ed022d9479bf21cfc97cccdf4fcc05f423e7a4e0f4fbff00a0d83807e04239baf2f11bd741483382451061c93abbc542

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7519f791a83f466174d638748f455d59

SHA1
546a1ffcdfdc44aab79a05941bad76464ec47719

SHA256
c8047ce881c6aa5b5ca73ab5febc1811b766ec6882f21bde89396b37561d2855

SHA512
d115f3f10b5bb362aa30ef4290e1263cfc971df88b1c6cedf1097f7a1b94891d2e4bd09312f8f28bc5eda3c35a3ef3889023d2e759fe16c20a48a9d370162991

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab20D9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar213C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit