b73262500187fe090bc64762e54386631806679cb06ffdd26be38a4a77378d90

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
28/08/2024, 19:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c788e4ed8dc5d10c0856b25a00fefe0a_JaffaCakes118.html
Size

27KB
MD5

c788e4ed8dc5d10c0856b25a00fefe0a
SHA1

22a41dd7c6df8be806303c4ef5912ffb816e8252
SHA256

b73262500187fe090bc64762e54386631806679cb06ffdd26be38a4a77378d90
SHA512

3733ef5c3335b304403d34564ea633141ca1cb22e4fd6fbc103dfbed930447f98a5579306413127e94c8418d6a7768854ecae03d01695a3b48c2ab6c08a5186d
SSDEEP

192:uwHMb5nLGnQjxn5Q/ynQieZNninQOkEnt+cnQTbnxnQ9elBm60fnRQl7MB5qnYnl:2Q/I0rYn4SjUNI

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431036414"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{94E078E1-6576-11EF-A74E-76B5B9884319} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
708	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
708	iexplore.exe
708	iexplore.exe
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 708 wrote to memory of 2832	708	iexplore.exe	29
PID 708 wrote to memory of 2832	708	iexplore.exe	29
PID 708 wrote to memory of 2832	708	iexplore.exe	29
PID 708 wrote to memory of 2832	708	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c788e4ed8dc5d10c0856b25a00fefe0a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:708
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:708 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6cb6e9e2486d0de6babd3f2d323c220a

SHA1
d367e68c47d8dd5dc741f35ccab84ca6e11f83d4

SHA256
7a6f1235a30541506a2ae459693bc190f0ecb61c9a0755a4dc4e3526b5db9a00

SHA512
9ca637046af60bb29c2c2687091dedaf093f17b946efb24a64c9383c22f4ac1f43a3fa4216ba9abf6640d905d3e50c028a97c8c5bbbb88e186864c3a5de7e5d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89161f32e98776cc05818757f7546785

SHA1
28e901a6310c3af16281f364bb97ac4f677ac690

SHA256
8b1ad0bc66cb6f8e2a12a0e9568f0f2e0b8f07ec1c6290cc0899668107b04acb

SHA512
05c37f332096ed51a2f0aaf14af7828b4e26e8982ecf554c7ef6829f2ff94a2105182dad267b044954d26f587491fb01fc77267ab5a9df6dc579c34bb5330068

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85b65eed0f909bc1aafa812f9ab78c49

SHA1
d9cd9fdfb57550c7ac2956c09270e9d03a4f42ff

SHA256
75aea34b6d0f09bb344f3bf711481fb81dbece6604eb3273b35c3a4591f15f57

SHA512
24f3a388679bb33b13ee82b80d7e37b6dd606260f90d994c3bd285ec04498479d66acda5dfea67e04f290d47f551c6f027b095a40cba9bfbc62c1ccadce64f0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c8f91d0a246c062edbea9ad7dae3e85

SHA1
1e831f7fea98b2fa9829abb7686eb94b55cdecc6

SHA256
2b474d5177e64257204a86dbc5e2a70dd5fedf7b5525882eceb1b08096679485

SHA512
0b2135572e5527b9909c278df881e2c77c96d0bf952e970febd331da65a05348005251bd875a9b81d4f9e1a1f822bd7cbd47b6e5f114558e5c60d81f6110031b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f2f5e41a1305b7265420e645578fbb4

SHA1
bc02827eecb225f59aeb667bdfe249649b67a2f9

SHA256
6809634fb7f5fe734dd1bb36a7224576b78937f4b9c1f30819185e33b9f8679f

SHA512
6ec8be0ba795f3a42bf16b70f021005a04d1b36f1e80f670ba4a592c6fef0e5ec5eba12697aff504903d0ba784547be7a7d93f9aee870fa16888f7ec0a7e62fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
286e431eb51397cb9fd22a8b8d4c953d

SHA1
0ddccc2812ce258ff04579a9b89214d74ab53754

SHA256
9c053c78ebb7a0e92977987e944e3beb6ae56885e91e012281329ca1a5027f9e

SHA512
8ac16ab3af4bbcd3d748edf6e43edf175af1ba989c8b1ddd0a2800f1e6be2fee586a2113489b017d2d071c64cf58bae4fe484c8910577e1ab7684795325546fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8725dc076f33f6c9663d919faf44ed47

SHA1
c5964eac46471693912afbe03a23e82000e0b479

SHA256
7cd1cacc74489f1024044b7a73d79991bfda2fa9391d251c41337e10ac1522b1

SHA512
db62f1082a7b92eb893a4d0457660b3d302d4ee03cd6167d6086d92e117e56cc44b7b442ea515b7c9d6196b6cf250bcfaa79e7ccb54a62c5ecf4f799083bd682

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54a9c6c4bb11b3fda5894061a5fd24ae

SHA1
01dc85546639e426403274511e6c9794ebbb290a

SHA256
564f26538211afd71a71e018ddfab2ff0c68ac4c0e758bfddcc25b5aac19713f

SHA512
0c6ffd761c74487082129176da058c982363ed4f7447bb7b4c5dd65d4bc14cd5c4a07c3c348234fc6d8e595bc0e6695008a6220c8ab3576551bb7cafa0bc5478

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff91a9c6e2da5d54f525fcc13f828feb

SHA1
5cae4085af7229a4e28fbc3271f53a162c808bbf

SHA256
cc22fe826af888e81b850b9b512963dd358db6685393d47b91ffcd41999d5411

SHA512
5cd93b738c6f28b25d5d5f2e2eafa229e71d95f8c67ec6e6a0bb76b037e34a66ecd57f853044b32b2a1ef3c16057380985fca1256b3ebd8df4f954a6c8152f19

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEFFA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF0BA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit