7980cb5bc62ff7aec1f10008260d37699c4513ce886f564fd33e7fcb36fcc395

Analysis

max time kernel
149s
max time network
143s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 02:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c81851a040f0e005c9e3667e701ff6f6_JaffaCakes118.html
Size

23KB
MD5

c81851a040f0e005c9e3667e701ff6f6
SHA1

91187850a80200a93ebe8210ff7fef294fa77612
SHA256

7980cb5bc62ff7aec1f10008260d37699c4513ce886f564fd33e7fcb36fcc395
SHA512

e251ea0c5262c46b5f2b78a3470c743ca57bfafe96f4d457c64bd409ad134251c11cd4015c19236347a7f2c12c2db784f4bed102211400137798f419c23eb01c
SSDEEP

192:uW7Ub5nmgRnQjxn5Q/hnQie0NnwnQOkEnt/jnQTbnRnQACnQtOwMBUqnYnQ7tnOj:XQ/4+j

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431061308"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8B2F67E1-65B0-11EF-B29C-DA2B18D38280} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3068	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3068	iexplore.exe
3068	iexplore.exe
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2764	3068	iexplore.exe	29
PID 3068 wrote to memory of 2764	3068	iexplore.exe	29
PID 3068 wrote to memory of 2764	3068	iexplore.exe	29
PID 3068 wrote to memory of 2764	3068	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c81851a040f0e005c9e3667e701ff6f6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3db956a6059687bdd864e5190db00bfb

SHA1
a72dc287ce9be2c60baa628678012fdd9622f14c

SHA256
f3742b9c2c8faae19af15b370aa5d08a93dd698b82e1cd22f54bd4bf6c871ae8

SHA512
71a519ad1add2d642d6687f92f2770895738da2e6e8490fc6ff020166b20c6df8654fa90b5c59b1d192c599adf93173366f8da586d3d124174aaa780280afcb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47c184fa9f5c5df2d0caabeea4e37592

SHA1
c10d542ee7af45501f9348685743ef637603381e

SHA256
45ab1e0bb9e4beb9ab4040e2eec022faf22da824b5a2dc1747468406545d35c0

SHA512
215ca45a94a699c79b6e032e3e0eff1db7025ef91a41fe8966e06d26ec687f2bcd6e6dd6a0a6aa5c74a45dccb65c3dd1a5bdcccaa863a885cf2dffb8db049317

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a379f42df2bfbbe65d035a8af555d76

SHA1
8fc589cc626074b62e601ab586e1c0f7be21cefb

SHA256
dfe0a1def404d8c1300431e825952bc793cb00a8f855ca1bff4933657ac5567b

SHA512
6d589835eb5351b9413256c4161f80c60770e182440b1ae905b16ae8e63cba9fabe406335dc1758196b0b093224765800a97d8a0145f6c905ef4d9fe7523791b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84b9fae30a702ac7469b7e0dcb574cec

SHA1
287ad07f496a997f4deabe5e8a92995d1d27baad

SHA256
162146aa091fa38aa4784566a3c67648f3abae8da1069e3c085c946f069ffd45

SHA512
721df742e3a789e5a8402d6adf412aa9116b8a0e9201f99e4ff1cff632848ac07548382d95047887c1fafe21e13e695f7c3aa9f62e43abf8175186858d6a29b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e078831c19c9afc70740151e089200e2

SHA1
1bbd68e530ce06fac66eff2c4ac903f6de87b399

SHA256
1e71a9a31a4cc8417c794818114cc9e97a819ec632b44116db0f751819d5ef89

SHA512
56ab1d234e59fa5d81668d90115303e370fd950ece5d00c6060cc782516fa452e430b8ff7f9d2c175b3e7a475ef1090c815331d5688ca44b50bb6f74e90b504c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a1edbf2eea61f28ef1cb98ae4914a89

SHA1
cbd95cd2efe032a033fe1f2036cd2d9ab99b0cc0

SHA256
d78b90660b9eecb1ee9a2ded3709e213758afdb136c6f9959594f703fbe4f067

SHA512
55a4417d37d3ca36616f38e28ecfdec82b8e5af7569301951247ca781e79473a95cb6bd9a0546101b2643c2fa9d69aa55a1a5ee8864d7bb41cf2edf20659ad60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e984dd06b0d853e493476b391ba07cb

SHA1
58b5221555fdc0154233fefe8bc77e1af13338a2

SHA256
e16aaf99ff9434a883bc74d89aef7bd1fc9443c4309f4eb1e9ebd2937f7c8ba3

SHA512
897b525fed23d620f1456dda9253073e776388b62ea71a08ef61d719931dbc29da4d9a21a399e64895a9a807b98608259e727e72b251957c7f65048d4eaf4d1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0ff0167dfbabc3f617ed96180fff6d4

SHA1
cf651fa1c3ad9d3494602cbb892023bcd2e7caec

SHA256
6c5d4975c14c262c5705b3d692db9a7f47a87cc67143b1dc802c153f02ae07e7

SHA512
39c70d79ff2d80a99ffb0c0f8f40230d12731543d031c23e56f03da5fade224b71e3a9f704fb757941db39a0c9f12d1edb7b797a0b7af527041efb7b4f2187bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62b480463accd0f4b71aaa0801d77567

SHA1
4031647506c0089b07806618931c409db5f80b01

SHA256
9cc96580b6e1931eb86461b06ba041d7e0b846a2ad300cc20a0dd2ecba799bb2

SHA512
168322a169f32bbc4bd709db1eaecae2e7d02b8d9bef5899afe818b22b862ddc11ee038343527f4adcc66374fa96e918984c0020239173c83875c71cc9b69442

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f7e64038a6a46cbfe3560089aa5c075

SHA1
f30f0f2face88fc5ba60409eacc4e068f469fef4

SHA256
e30fe8c93e24f477cb88f179d004b8f16fdaa50769447d877f125c806d802c2b

SHA512
2573f6f0ba65bad80ad210fe326c55f99ed7e0942f29c7c7e229a30fed6025803621cc816a4fae2fbff966c53b201d94bdf0f229abe71e046aea698efd944524

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab33BF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar347E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit