c2a1e3f54dd690d7e736ff5785c2ea8fc459876cecb26413575afedf46285e83

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
28/08/2024, 18:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c761423805af6b450772752223079dfb_JaffaCakes118.html
Size

27KB
MD5

c761423805af6b450772752223079dfb
SHA1

fd5f6075163fee1f4c58324b8afe91412a1a2dbd
SHA256

c2a1e3f54dd690d7e736ff5785c2ea8fc459876cecb26413575afedf46285e83
SHA512

c6574e6c46bc51540d833517c0b8416ef43048c5a2528df15674839e0ab256d65cbc15e1d95a1cf1444a5886008ff02e99ac4e6f2afd99a907032b0450702502
SSDEEP

192:uwjMb5nO+nQjxn5Q/BnQieENnWnQOkEntv7nQTbnxnQ9eagm6utI6Ql7MBkqnYnq:LQ/iPYEIdSu54t

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431030490"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CAB50D91-6568-11EF-B3C0-E6140BA5C80C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2676	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2676	iexplore.exe
2676	iexplore.exe
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 3028	2676	iexplore.exe	28
PID 2676 wrote to memory of 3028	2676	iexplore.exe	28
PID 2676 wrote to memory of 3028	2676	iexplore.exe	28
PID 2676 wrote to memory of 3028	2676	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c761423805af6b450772752223079dfb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2676 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
98f1a6435e38ad307a56de7e85710452

SHA1
11ff4c3750e234c163c27eba61ee896f63871225

SHA256
20e0167cb852b8f8f8962195c81b5d21cebf5d3e6b575d6be59d46bdfb5e75e2

SHA512
f2b6b600c20cdb0c1a466df667b8e1e95ff1b1cf01a663d55bba9f8234f625e1cab0584ea94d8f3d8f56584f28c3e7a24815aa1012f8e220c6b900021e784283

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b5036d6e4a0b52739c0d58333db79fa5

SHA1
bcb1211bb5425e42ed22495d7fa41974458360b2

SHA256
2ead7b0969610855e984e56b0c0ab13795de9d2ee3faeb0ffc953ac4320f17f5

SHA512
8d6847ebec7de3fe2aac6a4506a242e12762be1102106916c9db18cf32286ae3b1006f5f2cc15c979b3a7d972d7807bda82194d99d31c2c3d1bf7f10bb2d875b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b39ccf306be3ad06542b2394c886b496

SHA1
f5040c3dbeb379b2301b4976a78feb91a8134683

SHA256
376e74b2ba03626b2d002406829b58b93b2f240d60726d5af4cd8d79fc0c07b3

SHA512
588055cd7ef81a96aa1e6dc5d662b91b3803c0c455895518948eb268aeded3273b4c379fe77a8e63956026fe7ec78a317d149fe871e8c987b6be1b3e4b71ec6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
cf201ed2879367d322aed8f3152a4d12

SHA1
713bdc98fdf73fa1d23ba7ff1bb9f53b83dcc397

SHA256
13902eccb529746bb01f7d60c981c29cf400eb1fa176d6bf5317829e7d52a7d9

SHA512
3760572bc7cc60a047909a4c71b35a8a76479433e45806405ee4a6541acdeaffc681e0c8969e9955288a38132e1c921d02ed0a9295a51c107d877edf0bceb616

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5b2dd15c4a8c27592c61b3751d0d47f0

SHA1
62e26222f005d0e2da7a250ea0691664ba56e134

SHA256
1b26c7ddbba893494d8e7359b5b53db663074819667c39c2c3848b0488bee6a3

SHA512
573df8f90a0043a7b47cbfb4699e50d6ef5dc33b6e8243d3023e43f2627580a219c4e35ddcca234bc94f0e75d22ea54b18114c441aebab6bb359611a09f807e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
afeead279f3ac20be65c0abc28eeb9c4

SHA1
26d06fd8ab4584488391a467ff74d5ff99d119ed

SHA256
6a6f0c97040e7ee91df8d0fee6b67c31370d8c58842951c0fb32abf46a700e97

SHA512
d9a4d213a2f4a64e7d96ea4391dbb641b99b74878fad8f90939477591b637304a2b9aa13dc5edf23e8b900ee5149045667d73b00a0d194f52a9242cbebac9113

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b2b5c7caca9c216e85e4e44b24ef4d5a

SHA1
a178e04809794f74b00750f172e69f179d0b7408

SHA256
f07b43cb7beeddef810bd5066e23adb03a67815c9627496412ff766288b6721c

SHA512
d47da6197792386191af15ccb81a45bd09697562ad45798227c703d13bde97f1fe695e3ccf68e58df7ca7cd2ca9e8c64cca9e7706e65535d69120e2d240a18bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
db8ea8dc6798e06a90214449902bf362

SHA1
3ec3ec41382828487c23d52d53e10a584580b991

SHA256
2aa8a272924cdefc0460588937128dfab2accacb8d01264c11d8e7ac7f503602

SHA512
d84951da675722f7c645aba506f7c160ed2cc147da6b789a9b599637436d86799e4d39a267f198779a7e4a65d5d595e18c62db7317e2ad8f5513d0a41887e2ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5012becbf9ad4ca66a8f3e33c348a434

SHA1
5a676751cda19e29bf46bb61b1d823c2a7e56221

SHA256
e761311a89816554aa3612e75d8af1d17b1e54e0c5bee1c4d8280f244a6e1f7f

SHA512
d39f4f958f1c21303f7abee4957bb9044f1a3f8a90edebec8559a532aafab7bc74b3e96a3ba9e316b04922014c6aa404f88fc97b3903475535c6d719622434a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4E51.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4F1F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit