c058b167f8628495157c6cf1c1332202c435d2643fa185eed88b7eb8545c3f75

Analysis

max time kernel
133s
max time network
149s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 01:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c7fd8fe8a90e184c8f78031fd81c7088_JaffaCakes118.html
Size

27KB
MD5

c7fd8fe8a90e184c8f78031fd81c7088
SHA1

0f8149b495a2170b2dd3ce8e65767bf2d8646947
SHA256

c058b167f8628495157c6cf1c1332202c435d2643fa185eed88b7eb8545c3f75
SHA512

eed5fb7b5744e2d201fb7f4a2d5f2944c90ae35a85309c16c594fa160a02aa88485beec6a5006f97246ef383fcfd6d321223f537ff4cc07f111ca1b550de9c07
SSDEEP

192:uw70b5nbyXnQjxn5Q/SnQiexNnLnQOkEntq8nQTbnVnQ9e5Zm60L7NQl7MBRqnYZ:6Q/7wT478S3gCd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431056458"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{40DF7BE1-65A5-11EF-9478-46FE39DD2993} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1936	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1936	iexplore.exe
1936	iexplore.exe
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2688	1936	iexplore.exe	30
PID 1936 wrote to memory of 2688	1936	iexplore.exe	30
PID 1936 wrote to memory of 2688	1936	iexplore.exe	30
PID 1936 wrote to memory of 2688	1936	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c7fd8fe8a90e184c8f78031fd81c7088_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1936 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4de8907b43a49fb18f3929c83fc03ab8

SHA1
1a6874f494a8b4a095f767b9799a01e42e7aef91

SHA256
ef01dc631c1412f69f7065118c70d4d1e6b3067924fecd3cb3da66562dbd9d65

SHA512
f8275f2a5bb30ae5ecee22982ba66019bc32e1cd862f772eda3dcb0179f63d6eab4572dc97c28874e561bcb906d961c622ca4a21a2367728479e350dd6e5b334

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a19c9f180cd51f1919c78397a25d60f5

SHA1
d2a4255b04f225f31cb4fcacb467b23ba8231d60

SHA256
1026b176734937aeb4f37f09031a7eed966fb63db99281b19a9ae7e5f43e95f4

SHA512
223aeb900d0b69e35ef336eb7a83315dd16236ab0def080a751a0c78b83dcd5cfdc93c0be726ba69a260274f324f6beec378650ad09ae91ac62964e4344fdac4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c10aed31fc568c9e7e13c1122b004cdf

SHA1
3afde09e771e3e2610a30aeee86a9b6ab3807885

SHA256
a0888dfe5b6f0849be6846601d7b99382f73be636e82dd3b5339a02ceba39911

SHA512
cf09941e917671817b8a1eddc5698c1d7700acf8868614026598ae93eae2780b53b2db6de3943f3db7503dfbf087293703d443cb3d05b3f08cd559ad09917506

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69a360763c0f197e3a3cd983d30adf77

SHA1
bc1c953fff978e550deca6a1bcc104d25ffd45f6

SHA256
8d35ba233e1c35903cbca98b586824b3ca26c25f0d8fc1cda42b666d0eed792f

SHA512
128535e881de566ed3523e5f5f759492c5ea5d8cb9bc230b33f60922d265b04c496cdf23b1692d04124e5e0071501684908db9b9a2e9f2c9a518213b6d271156

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3926bb3e0ee71763a4cabd496444044f

SHA1
bb083ac41c0fc4829ea1ea763c723fb4ee50084b

SHA256
b9a6488a1682c1059707dc336ae790ee9ea5fc478118a96a954639f9a1fc6701

SHA512
22f05aa8fe5ec847474a48d6213f37e89d6581898a0b54220f7b471de7c66c735c2d811c52481d3c90d0b9493e939f330694b1cd8cd298a892b4cbeda838bf49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24b0aee3eec74f5761045ab4c7a49474

SHA1
aaa4abcf538a6c14d26a340326edae537f7ba69b

SHA256
e016720ba4d790c44210f0f71000b641cd8bdb6c4233f826c5d27258a0fbceca

SHA512
abe07eaefc4f954dec61c493e64037fba579f74f6c9e9a05a5ae0433be5457cdd1478377824f83514134a120af4ebebefeaccddaf35c0768f13c572e2dbf2337

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8448a329772054e06d3f7bfef4bfc3c

SHA1
649013f7db56a5a75b9f63c7da638ed7b3521c74

SHA256
24ca9a110f36011ba30a4104af1e7880cad7bfb82eb3a7acf4ebedc6145cf40e

SHA512
a354e2484ae4317d355be09dfc019fbda80c5b83b58ed6dbbc401c61b23a8819630f1aa473a581abb7809b31f7e5b2e6c9c1c8fac3c9bd2b0f02babbb273fb7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec73436db279a699fb7e07cb4bef9cc1

SHA1
c71f043137a328a8fa8aed1586ce5510e41c433b

SHA256
be152fef9233bf0aa2fd8aa6bcdf1d74545e454fd24191249857115eee1767d8

SHA512
62cb6748a110714611bdea0ae5819481c518f3bf79c2f51070654ebe155e00a070df22cc3f5fafe788df5cd95634971161db02b67bbb1e271073d339dc3b8458

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA342.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA3B4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit