c54ad3e09df8dd9d73c1dd20f485b91e6cb0fd17b5d4c80b4b46687fe1def44a

Analysis

max time kernel
131s
max time network
141s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
28-08-2024 18:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c760084f0d1a4bb92ab821a356a89d01_JaffaCakes118.html
Size

31KB
MD5

c760084f0d1a4bb92ab821a356a89d01
SHA1

00ac4d69e9a575b5c6d9261fd59714f4927a61b0
SHA256

c54ad3e09df8dd9d73c1dd20f485b91e6cb0fd17b5d4c80b4b46687fe1def44a
SHA512

f4c651c86941ee2f35d9de03a5ecd81ad47840e2f312e7cae5d23c02ec8ee616b971012d63c0a1ef4609966a95300f46c02c48ccd8aa6a4680ee5a515e4625b2
SSDEEP

192:uWDrsb5nLnnQjxn5Q/qnQie5Nn2bknQOkEnt+QnQTbnFnQgMCOxA2RyFLqDxcYL1:fHQ/EbXcxLyFuVpLkZQiKJqCQ2OamA

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2625BBD1-6568-11EF-BC8E-E6140BA5C80C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431030214"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1940	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1940	iexplore.exe
1940	iexplore.exe
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2368	1940	iexplore.exe	30
PID 1940 wrote to memory of 2368	1940	iexplore.exe	30
PID 1940 wrote to memory of 2368	1940	iexplore.exe	30
PID 1940 wrote to memory of 2368	1940	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c760084f0d1a4bb92ab821a356a89d01_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1940 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84cb39bff311365a5fd68c843d369348

SHA1
a8716d4fe95a08db9d39eee3c24c2eaef07eda75

SHA256
a6f11a82c557b7aad711bdec4e212729d4aeb7f9ce4d23081a91f438e8f7da05

SHA512
b45933dc17f9dac403f0a89eaa72fbc2c82f8c8ca65a4ef7c272ced4e6f4bb6ad5bbc1a861d8bb1f502bb1308b57abca1e1f26a92de2dd5c5bab015c139374c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65ef999af1999221cd54624100e32d55

SHA1
76bf55153f194730109cb666a98cdfa2484a5cdb

SHA256
7ae576568df3f8716c01cd6b6f2b4461591360a2132f2e032a430f6f7cae0fa5

SHA512
1a5520039ce0cdfdc47f8c85ddc69ad55371e8ba0b6439e01052ea4edc062e6cceac0a51198ce351c787967312a067f68ed99c5a9b4d421fb27f0ab2adb8f6f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3f9cc7730fb25b89cf2a91cbd772bac

SHA1
2aed4e366b67cc4cff868d28843f5c968489791e

SHA256
529b150acabef09686bd6bead94e0ef04bac6fd5d023e1a2da401220b1499cef

SHA512
3de0e10b60af021a9d3892c46afce57e045f8e47bbf7af632d651438f12e44e6138358670008f87c1125bdd1285a435d445a1df386988a77e61dc3c4d4acb2b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1fa1d6413f0da10e75df4d9d35dfcf6e

SHA1
e0e43a35048d1052dde64fc0a5549b04b43f2c8d

SHA256
db5a1e4391d133d35c10a86c4c042902a7d55e57e63b22cf866a08311d74c8d6

SHA512
a8d4435cfff9564ca2ff34b0f8099e6b70b10c7f8c61b657e00e249289aaa4cd5c3db1c48cb16cb993df2423f89d55f9388f16b98787ab91952fbff2298389de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d6bbe47df343d068566383764bbbf55

SHA1
3743673e92b21a609b7d7f4f20e762dc090c878f

SHA256
717f04310f4efcd04d3f1f3b56eeca74a11874fef2a27f5ecd95342a17671235

SHA512
1761322df35f68ca1748fc423802f8ea18dc28435cfdbe1ff164de37a578e22bfef2838f5e88db7e3a0a8334d6b1f188b1a0f58d054be61c1d8e7900ad5d1659

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ae2a0bbf5b8c665b45b8a66403cb29c

SHA1
5aee8822d5ae980c27c5e60b6c9e269dafc98183

SHA256
b8fa0acfd916661f4c28cae686878d1426927f9a146e17358483095d32edc886

SHA512
90b25d418534546d7a5cb3d19a8ba2aa034102aa16bc44bcbcf5615fa6cc75f25511c384c023cea4c0d2bf18e5bd0b8fc76df19ccdfd5e2ef26ec472efce538b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4084151828ae7cb5e165876bc474f5b7

SHA1
ba48112dc515f62b6ea2e44188e01f5297d55d54

SHA256
98881cbee4630d8b31e6b8bfdbd16d9c1fd1a5d45ceb4f5eaa91ba457a72e859

SHA512
0dfb1c5b1d530ba0edb8b7a5ef7e6ea7b15fcb5be7ab79d16dc6cd95cd8e4a9b59130dbb4bffb23f1fc18d7837699ed02f1aaed9400aa0078ed004df97f01cf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8638069e16b980602249f544276592bd

SHA1
48195f1065c9db68f1142efcd55527bdcb0647da

SHA256
9cfa82828816165c4491a96081eaf5af561f90e4ffb0471a11999a55aaff95f6

SHA512
b1aff7e033a3fe8be9d6e2d24979bc333e905270a8e7fc26774b7d5a2d9ca00047e57ed1ac9bc3944e84d0b5da7bfa9c3f3475784bbd87e9736e8df9d83d14e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c51652ae32f4b948776dfc2714e1ad3

SHA1
6686e485d7659ad49e4687f07127a48555abc0e3

SHA256
d1acd06225195970009cca9c3c1a6b86d4cab68d6269245fa5a29d97003b5f73

SHA512
33a83e71fc1b6bafe285bc896bf24fc136151337e235621410ec4bba2b841f1da55cc50adfe529b0d43aed800c8ea5741d42895c91b6ca8b38c645dedc0c0762

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB6E3.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB753.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit