ec0e834d26e6cc0e2f60b0eb10add64c34944456b0770bf849901169e7993840

Analysis

max time kernel
132s
max time network
142s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 05:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c853841a9a190f744c4ce00c7c2b0dbf_JaffaCakes118.html
Size

27KB
MD5

c853841a9a190f744c4ce00c7c2b0dbf
SHA1

2548cebe046b372d1a3544650c626eb0df3eee41
SHA256

ec0e834d26e6cc0e2f60b0eb10add64c34944456b0770bf849901169e7993840
SHA512

17073afc99c2b38bd0abaffb39b249c1b059c8c7e112b1ff472c04bbe60cb5003a3aa0b569ee19188be34c4d62b62f6918914ed6cf9f40ab8ac63328896f6930
SSDEEP

192:uwbcb5nGmnQjxn5Q/BnQieUNnwnQOkEnt3LnQTbnQsnQ9eqQm60NICQl7MB0qnYK:jQ/43XICIVSeI

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{71C82FB1-65CB-11EF-A748-EEF6AC92610E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431072861"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2504	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2504	iexplore.exe
2504	iexplore.exe
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2060	2504	iexplore.exe	30
PID 2504 wrote to memory of 2060	2504	iexplore.exe	30
PID 2504 wrote to memory of 2060	2504	iexplore.exe	30
PID 2504 wrote to memory of 2060	2504	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c853841a9a190f744c4ce00c7c2b0dbf_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2504 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd3011ff82fd19530f3bc1b648504450

SHA1
b6208a1bc6ad2b559c082ae00fccffdadca8a5b3

SHA256
1646907199144faf25303fdf9a5125017261f25bb29670402ac3471a7381bdac

SHA512
2a7b40fdf7052c2a62906f5fc7370b3942f9a8356d03d2ef1466e72159b7cd2a3ed23320bfcc6278615f4eb000e833ed4c5f9b4b07a6753f7abdcc6b22c691dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b00cab502bbc2ba1dedcaec622a0765

SHA1
06c6e955b33159eb2111815717eb5b440b9f5262

SHA256
d5c191102a0af13f47f8600942799a359213e8e59c7ea6d76dc73ed9f1a1ada3

SHA512
0ff17b252dcd13482506880cd8d2b084deb8af6947afd3902e3e405a402ca59f0d49219331357fa376c19ae68695eb523051d540ae8b0f65c0e2a18b0595df20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a1127210da11cc96b7cac8f14c60c41

SHA1
37126685f71f05736fa915fdf9a3c005a8a10ac4

SHA256
f917e7b970ef7a62161c46afccb9dee85337d305ff14039d180b1437c11c0e5c

SHA512
2f62df7e038068a4e82822ccdbae39f6d61e2a2c236e6df89e6706941f7057da2056b5f7af9406bed242bd0e6c6a1f04f6ae7ec95121e7957d6daee06541fcea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a9db976cf2a6a78b5bdcbd1725c07bd

SHA1
ac7ebea971f740a64053cdf85ccb4f847f7f7027

SHA256
7581bb5f1e1c76f9eb0c35f82776fd72796eeaf77094b2291bfee49897f0f623

SHA512
36403abc603df5652adafe0d5014a77ec6c31a187ad467f3c0349d68c431613e3a7ef5ff136c82d0245d66b6b74538d34b13480fa3301353651ae5398bc31363

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f732fb087f4e9977d91b3a2b77166478

SHA1
7832e795acbd712c9943df1ef24211afc9e17405

SHA256
4dd5d4b4f0951c9157bd8064d931bd2acf3b8a9e00bf2bedc794b7e9703dc015

SHA512
d8f112b0c13980d692c7701da4b52fb2e44ad237ba8c910df59394ba8f3d2d38e280c40e76fa488f748030bc005410826aae765966fc1ff6fd7de3e9cefaad85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1500448c889bf0e06c15d0981c7f7e53

SHA1
4ba4b158da67160c3d2b7693dfe5bbc4643f9492

SHA256
e3282fcc4e55a302827210cf664de5f5bf403c0f9c9f47c85bcdda0813cb1fe4

SHA512
2ec57530aaff634f7d3e2a295d3c0e3033fffbd885647858c2b08bb796857505ab4af02e9658680710e213df521e30d5d18340a5e788f800ddc27db8a166b804

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a34b63f3b333d5808cfcbc832f7e5d1

SHA1
fa7887e3169cbaaed533b1f93b039276e3a493ee

SHA256
c77b514d17392aa47a4335c4f98c3b6d3e52de9c6e4a5ac596de38975448136e

SHA512
68b2e092df384da01d1e5dc88615259d1d593e7906bb89e53a39f755cdc2163e6a28bc0479b2934e0bf41f5f7d8ccbe6fae153bd55d6f92afa83a5aa43b403db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
adb1b8d58a8e53a7b06dbced35369ff3

SHA1
29a30f0f22a59c1dd8f2d0e28417b076f55ebfd8

SHA256
49cac60f612a2ff38ed787bdd9c14b44147d6a1a7a4c3cdd9171c211f93254a4

SHA512
926f50392975aa168971b30729bb0027a23573cff02ff24a145b4b3393e95f1a078813334bf2602064eeb0e193e86c41463e5008d1c032be73b680b85f7b67e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e9f74777c349faa87e86a6a7e85d2b0

SHA1
0734dec8552b43eb2a614be91a8e006319f44adb

SHA256
67690bf556ce20620c0afd9228d5e456c4bdadcc21e642bcda2a1122c9c7750c

SHA512
40aa12ca98e52697b85a3dac99013ab9a7a1fadb2c90cb6187b93c0203e9115c1430a70bae5069acd01de7747fb665699a5a8035d8e4a809d97721354373400c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC66D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC71B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit