e23f545517553632289b6573c1bebcefc7e5dda1382374bf357818fd8e299b14

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 04:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c834ce6fbd1da6364dba6bc81ab58d29_JaffaCakes118.html
Size

27KB
MD5

c834ce6fbd1da6364dba6bc81ab58d29
SHA1

3e1f11e03ef32543792d798b67ff7b7a239e56b3
SHA256

e23f545517553632289b6573c1bebcefc7e5dda1382374bf357818fd8e299b14
SHA512

80517377fae7d7579ca153e1824ae2684cf583b14cda0ceb8ee263590fcdee0e54fab9b4b656db231676e479687fa2fe4798a26bc0e6f0c3c453394c3285b9e2
SSDEEP

192:uwFB1sg3vMcsb5n6ItRMONMh1c6JMQknQjxn5Q/BnQiecnNnFhjnQOkEntjrXnQa:XQ/JDoMM9SO5Y

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431066548"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BEE90D01-65BC-11EF-803C-6A4552514C55} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2272	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2272	iexplore.exe
2272	iexplore.exe
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2816	2272	iexplore.exe	30
PID 2272 wrote to memory of 2816	2272	iexplore.exe	30
PID 2272 wrote to memory of 2816	2272	iexplore.exe	30
PID 2272 wrote to memory of 2816	2272	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c834ce6fbd1da6364dba6bc81ab58d29_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2272 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a44e113c3f1bc3f94b81e62a69e2d273

SHA1
8866a3192677560c096b5debc8d2e8f38397b1d1

SHA256
30a6d6f8d52e07a70c52b1a5e172f54326aa7cfae91c069d6665354219760680

SHA512
d341b40b410aa9d2d5f4e863a2185a565c5c1700f7f9fdaa94bfad8ed94697678888e044e8d47fb31e101bfe19731206858e9a0dac7b9dfdc11fd7f0bef3d735

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10f8e48f4d97aa5c4982daf5dd118604

SHA1
c33bacaa1694f27c45aaf1acedba8aec269666ad

SHA256
e54a03674927500a8e2dd66a5a7509f778211f1397598090cd35047ff7c70855

SHA512
ff696d2c456f1792fc42f8e55eca978e44bf9fddde2832b90e9992bb03cf6ce146255b7505a2861e4e0a3929a5846c89609211774f772ffc624a321ea5e963b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0337fd977dcfb53ae5b55b02c45f7bc1

SHA1
537710f0e3c0a99698be8baea0b4c45bebdd2963

SHA256
c1a7bc3cd3198d4f35f63ef1b34a645fc89f2f28a996af64bbc3811d71b7e068

SHA512
9af989bb8e1bb7f8a1c299485be7e63cd974c97fa5c4f72e0df7f2260331ee5bf69cbb90cfac0c60ddfbfba35d677772ce1c3991024cce9d956df23f8d028820

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f683900f943f76f383702a66e78722ee

SHA1
877778c3f2aa2de5e9c6fe93369c86550058cd9b

SHA256
7380eb4ee5fd5813b916271e218c2ad51ae305ba766c4f61388f8160ef9c358c

SHA512
b48072d4cb47b996bb5b31719924d4d563fcdcb68713c8babfcc9f42d3877f453415d2ea750d45a1d5b1c874f240700eb137d59990f31fc4bae15168ca6a4e0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31de3647072b4392456fc3ba97318b51

SHA1
ec12b09e530fcd0ac0989c2ae9e22b2abb13dd40

SHA256
d164f337eb6de498203edda3743b7fb9feb0c641aeffee302c7485ddb4be4075

SHA512
48c2405678a94422782f6d32f5189483217ec4879746f2abb66f6a2aff8ebf78451eec5b2645aabc7bf2fb728beee5a1194cd576bb7e38349f5cef71d4daeee6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b10795178d72410d4ada8ebea24eff5

SHA1
1976125f1891e2d3ace93b05b2741f5b60c72ae7

SHA256
248f0a47cfbe2e5057e3b604feeeb2dd48e8a548510ac5338a33c1abf2879455

SHA512
f2d4975307bca611569558c29b36d226c308973e63a3329361a6f1aa09af9020317cadac140ad5a90551562c6fc534127a0b177aa68497b8ac0b0c924c7307f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bc87899c74991135df65a29adb1aa03

SHA1
e425d16f4ee5b7be8f84629de48934de6c490c75

SHA256
be9fe6fe0945b526f90a069b26e7e1e402cda8f0ee614a06beb252f864d8c20a

SHA512
4993a2d31a99332f69c42587950899a87eded78e12082f448947e10543c76298105b5544ee8865d16eb13c5823854c180c06aa7b995e05bc50475a1627146ae2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a8bb84a0c3bafc3ba113036e286cff7

SHA1
692dc8b8c3f71b9122e96baba727582ea90d6987

SHA256
267ff45dac975a4745b77ca00a50f27f765d5a6b3041d988c7ab22796442b418

SHA512
3ad4e5a51bcfceefad8bcaa2e5e8bf442a4df2637a89dd58887ffd5d0c5dce70967bacb4aa7b8a0c46a0e7d5a67543bc654393daacc2a1a217dcdce157b12751

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75b5173063bb7cbf7f8d035b400d6e03

SHA1
0401b40cc5b7f44a681bb077a559ad448e9760ed

SHA256
3d4544078b584f6c8113c2dca6f889d56fe927b0d738369d9c085c86fc32905d

SHA512
f4e0280e4cc096c2c3bea8714310fe18236638c9d991f62a3afa6e5e6f0c9fae147bd3d6dcfc171d958406f04a0d98ada785355a30dc38e2dc98ce47e7018ef4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7F2E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7FEE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit