3a3e37c17f88828be1ffb745ca496d2d77565cf6d96e6e52c68160687cb0daad

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 00:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7eb044b01f9985aa2221dea69acd26b_JaffaCakes118.html
Size

32KB
MD5

c7eb044b01f9985aa2221dea69acd26b
SHA1

fce8f39fa02291ecbe075be8a15879841120e1f3
SHA256

3a3e37c17f88828be1ffb745ca496d2d77565cf6d96e6e52c68160687cb0daad
SHA512

eb5571ac8e4e39823258f63cd85addead37e2ad686023091fd6110f1d05a984dc9aef664e116a49da527872d26e12a5e0bb19031f505e2c018e84bf0c0c861c6
SSDEEP

192:uwrE0b5nMA4WnQjxn5Q/QnQiezNnSnQOkEntoCnQTbn1nQmS8xq14HZ8y3eAyAwq:eQ/FPxXZeAyzzftQV

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{32780521-659D-11EF-B58C-DA960850E1DF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431052998"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2072	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2072	iexplore.exe
2072	iexplore.exe
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2908	2072	iexplore.exe	29
PID 2072 wrote to memory of 2908	2072	iexplore.exe	29
PID 2072 wrote to memory of 2908	2072	iexplore.exe	29
PID 2072 wrote to memory of 2908	2072	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c7eb044b01f9985aa2221dea69acd26b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2072 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd7bf5ed3b4190a8e1604c2da220fa27

SHA1
c27d9cf81d4edacc45d3652051dfb8bcc59d97da

SHA256
c5d9290370315401c840f5c3929eee0071dfed259df4cd12f6baa31ca8955f1a

SHA512
82dfe9aba83db5446860286fb15841add42d1dcdc4eaf2bd506c7f9e74ff53ca33e5b776a2f697f46e302b39aa591925a27c02f0ec2948b156f58fefd104f1e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4fa94cd59a49c8d7447df555eff90be3

SHA1
31731e5b482d87c05cdcb398c2ef71c31565b8fa

SHA256
6826e32eb9f407242a51f8f254c42bb9acf090fce78df8776c56dc89fc469f81

SHA512
02e4f00016283b7e7dcf1812c9a3165a258ca37b7a97dd940d15ab4027366c0e165ab33e08f9fc050b8a17c25fa7bfcefadf6fff6c1078515e951f9815e872c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69a8d2243fd636c88f0516a89742076a

SHA1
00e9ed3867cb3c210068f16b36eb1df4ada1f2ba

SHA256
7a6d3249b92e7a0cf29e8be4ed9aeb60899e83111cea427ccb4095b992709264

SHA512
6f32fd85b3f0596497640f9fce39d27956be046f2f347fe03726c510ccfbf4be1982012fa0a5f9d0dc571494fc9322f4a1f5d6b1c36bea6c7afefd4e89d965f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08efcc2528f43875ca3d65626fce8b2a

SHA1
2a66e4ce019d2aea653f9810975830d6c221aec8

SHA256
5303f6281e635adc92bea6e1026e6221fecc3e15ccb089dc698b093fa99ec584

SHA512
bd07b1c59f878a7013c52678a9c55382ff51fab4dd891d21d516fe396e570f9fd27f6b90c777d3ea8f14393d80cd3a730e607dc57d5d77e30ca3d03ab6c670f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74ac9a0306ee7eb67e46df6d79feddae

SHA1
cdc6fd6e16f2255ab7e1d08674ffec9af9674916

SHA256
dc11eb2621f2a4cbebcd57e33b633f2a60c7e5e757ce81412c2d1941dd8fbe4a

SHA512
dfc070b52378bb7c325581ea167a76d0fa798b78a27430377ff9901e9185a2fce93578b1477eceb11a058d233ede0b90fbd3c5de08df38f2cb0800828105f2a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8dd49e5f0a1b8e8b4a465954b990296b

SHA1
d1e05516d5fc260aa161ca901c889b7f0b4021e5

SHA256
9e858309d25f38dfd5347fec4b5145400129f464a7ec4ed6398cd33b0f60a842

SHA512
0fd3773bbe570068965a7eeeebb4c635289488541dedbcc3d4eb3e5b44fee494c0e86508f6df5730b10ed6228a487397b17eea1eb69fd0c47caf4c2e34885739

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3bbbc3100d9d7fd39d1f077557760f31

SHA1
4cda92445ce98cbc1e0af9b4c8e0ad010035bbc0

SHA256
bc63fa31301a546e514dfd7931ae5e197c89a1901d326d4e12cdb5a83500b4dc

SHA512
1c945c2237bbc27b1c551d18ceddb2f5bfe39cb58246b2aa03915625b11c11fe2480ecdee73f1a16948edafea9380b02be9b044737391c52b0612ba8f37c0be4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7db6929ef59f04e364d73da2de1b5d1

SHA1
615d1b7d1838dbdc31c0548fb44d75209add7b28

SHA256
5d3a6acb1424e655abd6ec033006e648d641c0a547ce431878e141c0dde72e4b

SHA512
36020950769b84c2cf0aea84218ca8231e83f182a2daf0ed39a411367a5f15a5f8fa728a5627ff900d1e8c7dcd362fdd1d075c4605ef4be23bccadef85900ba9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e577be52d92f476a2a1651203367a4c5

SHA1
6bf4ec84c4b93f3216c5c8a6a47aee57d3286530

SHA256
934ff08188a9b51646c53a570da7441d5e805c3cdca7e5eea990dae748db9c6f

SHA512
807416ac7a20856a3cb06efa96e85b6111de0ca7ba512e4f32e34218b3f2d041f5a9ec066823b6b517963bcf71691e9300acea65e6209b840dab121487ff7e1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDC1E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDCBD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit