546afad3dc4f7790ac35d94424112265befa8938ba38ea195dda539f75300782

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29-08-2024 02:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c818befbbb21dae3b21d3a21b250e674_JaffaCakes118.html
Size

23KB
MD5

c818befbbb21dae3b21d3a21b250e674
SHA1

5d0895cad063d3fd4b2e8f01be4ad14df0d5d121
SHA256

546afad3dc4f7790ac35d94424112265befa8938ba38ea195dda539f75300782
SHA512

101210073cb2f0dfb21116400571d77495c5bae2a36ef9356f281badb9c97327eef86969318f1b946c87cd9e3efb285cc5561eb52712f61aee6a7a4cef24ae57
SSDEEP

192:uwzka57tHAJffb5nQ94SJoiQ/OE5JC2+nnQjxn5Q/eDnQieaGNn+ss/nQOkEntE0:eQ/6OMI8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431061368"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AF5F0441-65B0-11EF-8B6F-725FF0DF1EEB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2708	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2708	iexplore.exe
2708	iexplore.exe
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 3024	2708	iexplore.exe	31
PID 2708 wrote to memory of 3024	2708	iexplore.exe	31
PID 2708 wrote to memory of 3024	2708	iexplore.exe	31
PID 2708 wrote to memory of 3024	2708	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c818befbbb21dae3b21d3a21b250e674_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2708 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f4742b1a5d0e0a758373e6c7500e1a3

SHA1
a9d560db9526f61652cd7bb9f7ea4e9796699fc1

SHA256
aa824af0a7b5029dbdc63b465209877ea7488e7222f9d8432a66d49c1999e7ae

SHA512
5db7abdb71e3900188e427552278d112e7b882644ef565f578395ddaeed0ed8280f003f4f6f708fd6e82509fd62a107a94fe74e547f7573d7e1f78a35cfb2e47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c82145e7413bcb0bed8caca24dd8b52

SHA1
adc1dd2311d13f44f3b04e6a6e442ad485c9acc7

SHA256
ba39a546a41124021f655128373011955ccb6c6eefbe16de519b509b5faa7a97

SHA512
bb5facac688b9e16bcb6fa58a7c2ef62a97cafbd0f1ec47c3d5a8fd2b6e04e80d5b06f8f82c7cc563724ded9cc6f3155df062b176372283aedd2b1111daf71eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e3bafaa81adeb8981b3be8f4e0ddfe3

SHA1
12d49dd5b2534f3114ac37e7ae95c87e243a0897

SHA256
06f2dfcac53ebc9d7a7bb0ee80e7cc584279ff4edabd754f9bd6fbf8d753f8f5

SHA512
0b1f5f8229b65c7ff9e514f3abf1ff391c99a89865fd2f6c9f8c6bdc760e57e5ee04828853192ea5477fcc55a65cb3b17580ed81229a5a32037b0f3502a575e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2fdaa11cea06cddbf4d736e567f62e99

SHA1
03af761adaf3c337d80197751590c55340cde37c

SHA256
7242f7b8f616df063a9b4ae38bef87ad90a9496c144903f56323e002abc45fb3

SHA512
8f088a1fe4d863fa5da1c7087fb80438c9661731f69f55b110df7f8b50fb7773b37ab29bd459c2b8eb4706b8f5299e9c611dbc9ebef44cfacc90154d9e9d8221

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79e7208852b0b803759b107c75f33dfb

SHA1
b0381e0b209d4e7d86f46580314604940af967fb

SHA256
bcab5060056562bca83992beb8e1c4e55b45b335e489d351ed9a43f322544f14

SHA512
a7412ca19aaa88c82366cb649e8c0783b533fcb20e3b532251bc7881acfc2d6b70509dcc3ea75fc27c33d8487b47fd3a5e3092ae874e0b25aecc5f90b024f25e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0671a150d6ceeabda03f5aaf40e568d1

SHA1
f0d2d521d3db0d84b062caa209c8ac5a2365a6ff

SHA256
db4bb2cf8c01369685130dfa8a08a5325d9ae00df18994d0c29015b3f3bd8ce7

SHA512
9f1b87e5d7b73bfcabef966d1ba4510865d8b8413a9e94d662c6146284f7129e5c943236eab09b23ecc5c241eae3f7e9be4b82e05d832ccc3ed2b9b70cfb0f4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d94603b0ab1dc201a56aca94a8e3bcf

SHA1
4a3518dd4095f7f198a7184e4fe8ef5427879d68

SHA256
875b42b67d7b92d1cc468fc080136ab7184895bcb3b8f3abf2dc277a08adfb78

SHA512
a517b31cbfbb672007dbe285a1e8f73ce871c17753af9f80d5a2b620a6514e3a2215589c72d071e12c3ffe0fe76d7088542dca63347151595acc077c75369611

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e926d643834a6adbbec63ae39ea9a3ad

SHA1
aa27cd8570ddab08515d4e26bee5c0ef7d8cd028

SHA256
f47aee27967280631ec9c5f82bec8009da67b7366354695640c462bb7a4f19bd

SHA512
e4d845d0f63976e3cc9e713e92c314deec3a2c78c56952f08dcab827f2efa2a6a113598bdaa08b7823556993f3b519681a9d95dd3f239d35fe9412087966952a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe9afdcd69a9d20c7e407f78124b5090

SHA1
325deb7287479bcaca53c83bb480e90932aa7422

SHA256
9810d9f0fefe39600292c50d9ab228bf9c79645608ff8c55efd6cf01a84040b2

SHA512
e10da4e28ca16c45ffa5ecbf43a5203f16d5ce7387075f7596e0a7ec0733cc95071fe7e3f0edfa165cac2d686d8ddc80df9ac6506f6a16a6e03bcddda986ec78

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE320.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE3CF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit