38905c84fdfc4201dec3f5e9f905e1fad4ee939946c354c96235be9c732cb40d

Analysis

max time kernel
150s
max time network
156s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 00:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7f12411a4b274791740443eb1408d15_JaffaCakes118.html
Size

31KB
MD5

c7f12411a4b274791740443eb1408d15
SHA1

49ae41a166cb13ffde4fe33a977aae855b36e4ed
SHA256

38905c84fdfc4201dec3f5e9f905e1fad4ee939946c354c96235be9c732cb40d
SHA512

14a24084943f7e463377ee0546c09fbe6e2237d501b76aee4dfc85a3fec7b1b7e55f7b809eebc7e9a9591af2eceb204d17437a25a580d8be329fba2fa29d8c63
SSDEEP

192:uWTvb5nglnQjxn5Q//nQieONnunQOkEnt5lnQTbnNnQoMCwA9RyFLqDxcYLujZQs:5Q/V2MyFuVpLkZQiKJqCKOQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431054168"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EA949C21-659F-11EF-960D-6A8D92A4B8D0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2796	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2796	iexplore.exe
2796	iexplore.exe
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 2720	2796	iexplore.exe	29
PID 2796 wrote to memory of 2720	2796	iexplore.exe	29
PID 2796 wrote to memory of 2720	2796	iexplore.exe	29
PID 2796 wrote to memory of 2720	2796	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c7f12411a4b274791740443eb1408d15_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2796 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e0b884d8cb10a9bcce370e14712ee0d

SHA1
d07d4beeed00bae9d572eecbca111d3e5a227980

SHA256
14db610051b2ef2f9c85537deac1e2638beed8685e3c772063b1a172303b2d61

SHA512
b5c2fad4407439ec13979ca241b2237292ba8199e47fc77d7d48d3b1926ff292fb3bc690bf77f4c3c7ed645b0ceaf909229a71f8022d088a3ca44d2733821ecb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f71db7fd4799d2e0d747c190310b589

SHA1
609e284ecc5988463955e0bb8926954ed8cb3f00

SHA256
65f7c0bae73cc091bec14055d1b9951250f666daedb40937ddb3a096fb328dac

SHA512
b25f6291d6fcb9b8036fe7c2ffb8c77e21170eec3037b52eab722ae74f6d1795d71a4ea735a8ed127a4dcd03d5b3cd6758c3b9ee84de2bdac4683d63269f48c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f3a2878fe5bb93a9ddcae6863376ff9

SHA1
4fe6bd3c8a0a40d3e5959303644bc536ad7ca2f7

SHA256
b3a4e9538025b4d6e78f81bc795c052399a549f29e554cbc03da2391360d2aac

SHA512
edf9e622a73c48b60fd6e709030c626a6492edc18dd8d8174503927ecaafbce3bc331a8af04c9693e9e61c068768a2d08632f1b386a4d2e5124409ea9f75f3f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30a1388767fd496de4e1de56084dfbf5

SHA1
b29024f476016e5dd1858bb150af7cf6eb9cfec4

SHA256
eaf1ec1f7f6a3d9087d8ec34d97ea2b732e6bd6e65524e303f5f062d5b893acb

SHA512
b195253b4f805ae3aff8f4eaf0c80ee5a2fbc6246fd71fc8ce4533544114807ff1281e7f6ac48111b3522108f1fa389cd954a1604615f76cdbe063c34703813b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8d7d8f6d7fd4564180f32fced67bd2e

SHA1
96c7ddd954d880225eab3db5185d9942d18fc0b1

SHA256
f08217a640a724bc61436d63f882a3a7e530bda7ee27a8d81a6da54a5f3a5db7

SHA512
79f78bbf297deffe3195aa39b4808067aa85cf20756674e0564457a8b014a79a612e14c199059b61ab249fc8b9b5b879e5d36fbb50b1849fbf5f80e5c25d357d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
def53dd06dd0950a17bfe1d8e3ab4d2a

SHA1
e1deef3c5b03b69f1429630a659104efdba9de04

SHA256
999e7fe28789f5777cd59305cb1bcb36bbd288976a7a4ce9e5eacd661d38f1cd

SHA512
5358bc4184f0b13b4e49bd8a9ad8f05a692190b2e9088bc9ca4e607048cf6391de93b0c040447655bec4d8e9b7ed9cbb061f5a23920c44814b1b4e8a96c5855d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2fb042916d23b3ec74977307c341e4af

SHA1
d9214d0f35d36de3c48d63fa5286fcc0618e0604

SHA256
96b72a4fad9c5b164f006684acc7c19aee7057c88ef8fd698302052a171ceaa2

SHA512
a7124a3e65131c639795435e709d4d052465afa4f7551c0049ae9226e82fc945fd301d8cbe965b2c1f8fdba40956c388a671c208ee99a06419bd98217408fd6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF3E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar100D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit