5f58fb40f72bf1afa9aa7a2f91ab7c5a958273a8a1852b4b0ed53a0bfca989a8

Analysis

max time kernel
141s
max time network
142s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
29-08-2024 00:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7f3cb0461272d5903e02435d0143629_JaffaCakes118.html
Size

192KB
MD5

c7f3cb0461272d5903e02435d0143629
SHA1

0ae4fe1c9cb5bee48b80abad8b0d1f0b85f942f3
SHA256

5f58fb40f72bf1afa9aa7a2f91ab7c5a958273a8a1852b4b0ed53a0bfca989a8
SHA512

21555aa495fadf86df38a7c3474cc1afd04b0070accaa12e2c3ed2e485725df436230fc29f84fb4121d0e477ee3fa4f67db84a9b534655255b4f2698dffe5116
SSDEEP

3072:SiRDVnyfkMY+BES09JXAnyrZalI+Y5N86QwUdedbFilfO5YFiM:SsDVysMYod+X3oI+Yn86/U9jFiM

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431054643"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{06F83AB1-65A1-11EF-B2F9-66F7CEAD1BEF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2392	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2392	iexplore.exe
2392	iexplore.exe
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE
2112	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 2112	2392	iexplore.exe	30
PID 2392 wrote to memory of 2112	2392	iexplore.exe	30
PID 2392 wrote to memory of 2112	2392	iexplore.exe	30
PID 2392 wrote to memory of 2112	2392	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c7f3cb0461272d5903e02435d0143629_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2392 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a451959d503d4070f58bbb6740e5837

SHA1
bd47d96cadbb936cc86439034897ba246fa77f01

SHA256
3020b5dcd68b47b9c8efe1605d4fda0006ce0587113150912cc0d02735ad2909

SHA512
cdff4c51a06015ebe87240a015375bf78a72b3e23919a7d89091df408eed8c874997cee67c4b9388b23cfc0b7c4de7a484ab7dca354d1177e1a8d14c96918c31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
891ebdf26ad08712468039fad25c3db8

SHA1
295628f18aac22e076f6ecb12a726664e07a67b3

SHA256
65dbf9ad1e9e32821548ae423657b9f45ce20581935ee13b61e48a61b5035cca

SHA512
6e1de101587ec5c0c7f252bc630c1c30e716e20bb4f874e52e5a8a9681a8fc7d222c80d794d99b514b53c24bff57fd70a7107a8fd070e23a5db1aa55ac7b12be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
692b44e9e7bc76fc3af3297c8d2f1960

SHA1
774c66be37ebc828d7607fcbff1c38323dcf4fe9

SHA256
aa355fd0a39656b9c5502663fdaf1ebc4d865d62cac894115236b7caa684b099

SHA512
3ecc37701c9401193e3502775c7717a18956e137d9d98f37f53adc1bc62da0250cf54618256df900cb204a18856bf4eff09186e9aa48a51cd99a3682d0ad2bc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e6b4d1f01f332604006ce75765b86b3

SHA1
6131f5149fa760a6d775012f5a88a9e910dfef26

SHA256
048dddb6950aff8acc2c043a011e25f50bdb358efa18ce8b71cc5abab49d4feb

SHA512
ab8652a411ce2a5adfba1efd427a874bb7776aae7f76c5c139789f2e4d8b965d22c31a1d794a22069a6226152c4515aaeca18813f21035c126ce3c27bee56291

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba6552b5f16c5cc3f452e0121c1bed7d

SHA1
66cfca8481037e3dfe68a7b913619759c31dbff2

SHA256
487fabffcc2731bd01c2fe0102fd16835455b3ff41f3c53da31aa818c3db6348

SHA512
8faba7fc4bf32dfcd5f113af302288b4fe4416dce3bd41ff3c0b597cf928a2710a48d710a00775716abcf14c86080a6eec9252948e2561ffc91a4542077372dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2028fa039ecafa7f8adcee9e6f77f053

SHA1
32170fbb35f53d29ec77136450fde48b8f61918c

SHA256
8b40cb2c7aec25b343f109476f31bee023447edd61caf386e56c6fd3d0d6e491

SHA512
1408acb4409591d4ee7035e196f6e2d1877b7a163a71e977de60180e701a1f7f81434bca7dbc94306d8a510374a8ab098eb8cca58088bb3ad7f9170ba498cd1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3edb0b5d1430105bd3a6798fb38168d

SHA1
d33277b2a98c3139222279399eac655c93542e39

SHA256
2a433209ec3e22c2c88b1a3c440c46fe3f6614f09418e37169b8c34a75163ae8

SHA512
4c7892d7169c3c80f779402654705914dcf31a815011942e9c93c4ac7bb2a970c288eb904bb9a16d9088fec7e1571ad49023e0298f67a504497e1c75c8592759

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a0a3e2a80796d03a54accf78191d06c

SHA1
f2d1a5e72a7b467607352bd1c83882e970abef52

SHA256
94c73de7a9cb3cc5b6af3c3db9b6db2ac8da62c5542291b899d100dc0824952d

SHA512
02c3e39a9cc832580e5e4de060477f771c6541154b97725d282dfb03e34e95e59170af5e5ac3c5bcc7ebb8e9aa9b49064653bf06d415a3af532ab446aba91cdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f07317f7a30ba9abb2f1bd38096ce6a6

SHA1
bf72bd4a87a847a032f79a4439a05d477dd79dec

SHA256
406dba896c490a28371b86a0af092c53fac10f03b2c2628d73d55f95f5e2e8c6

SHA512
1954258ebc11f23d69c4b1279f8c93498e6a9f8078d780c342f6f8369d48e309d8291cfc86b486ae01c28bbd9b831035e773ef049fabe5df934cb05fe3b14fe7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ff91e3107e5620cd959ceb448c296b8

SHA1
e0662f76a0346aeddae335351ef2a9ef99e276f1

SHA256
107c67e9339a0be19a387c8ff69e4245b60e5f1801b29fbec4d7c2e139bca0e5

SHA512
6dae98052348245cbf45a8aaa5d5905edb4b89355863f8aad72811151f3f6d56d4b0447d3f93787c11d903dc01458970db6509c98246cff545f9588118597dc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z2D3H3V6\f[1].txt

Filesize
39KB

MD5
eb3e8e94d71112004359368fe956ea1c

SHA1
127be04315bf8d7f9b66346f390d536ed2fd5f4e

SHA256
01226261d9ccd0998d3c5c8e8d27eb4634179e25bd040ad6d698afa5df608f3b

SHA512
7643d4a3f3d19fb36f2013e1d301faa5a1db34f6bd8ad0e71045d340fcb16e5d02a8a5c1acb16415bfaebb4c15d25c976e5409dbf54e50a0e8d5e82ba907645c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8C69.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8CDA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit