9b3ee16a6ac33d1d59b52fcc96fbc1be9a803f9f0b8f4c2338532d639037381a

Analysis

max time kernel
148s
max time network
138s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 11:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8b47d6aaa25e5dd43bb8253129a0fda_JaffaCakes118.html
Size

18KB
MD5

c8b47d6aaa25e5dd43bb8253129a0fda
SHA1

2d958bd76a7b5bc50492b51d6704ebf47d5a6ec4
SHA256

9b3ee16a6ac33d1d59b52fcc96fbc1be9a803f9f0b8f4c2338532d639037381a
SHA512

26d4cce9165bae369bc0db6a6489e86a99a6086776f938558687ce240c2fa3c61c8d8ac3442d391fa073b53a098c1703cee455b4f7b561ab334ea1dd66d00ea0
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAI/4vzUnjBhRL82qDB8:SIMd0I5nO9HRsvRwxDB8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431091636"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{28870ED1-65F7-11EF-A2BA-566676D6F1CF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2084	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2084	iexplore.exe
2084	iexplore.exe
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2796	2084	iexplore.exe	30
PID 2084 wrote to memory of 2796	2084	iexplore.exe	30
PID 2084 wrote to memory of 2796	2084	iexplore.exe	30
PID 2084 wrote to memory of 2796	2084	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c8b47d6aaa25e5dd43bb8253129a0fda_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2084 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15d5364297ff3646660996d31d42b1db

SHA1
ad7a819fc135bd54d1d28e7434a1edccbe3e7083

SHA256
42a6ad50414e4975d307dfe8aad3bff3c43991a02e622da3b3b58c7a4aff6970

SHA512
01bdda9b929e20885ae96c313b30495c510e69f0f22fcc8b2d3ba417c1de69e19e9854988fcc3020b6c2bc4d09f07ba85d1d8ab2b70c873b8149664937308300

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36ac7e4cc9a4acda2194da2f70f55643

SHA1
7bdb3dc903b092f92a6cd47c9219205c93210602

SHA256
fcb7cbe84efd3bfbe3d64704b6fb880f32f47ca94d17b2fb7831e6fcac0120b3

SHA512
9f5254845cb4f6a1055dee1dcfa454e84ccf4cd232a1a04c19ba40a9006033d15edee8d6c2aa16fdb6e0fdadd99efe48116da9e9d23fc3e209155876a91de241

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bdd15c1daa0dd63bc4a01eb598276aba

SHA1
5904ec4094340788fcc1bf8a2597cbfb4080db83

SHA256
36af396755847debfe3774e793b563f969cabe5a467e053b77854fa7c8e0b8cf

SHA512
a8c4fa64fb723d398866ae85187fe2a914258e920f2f480639d8c5546615d89f40617c36dbc75654b96a7ed2b8d6ab886170964cd7aac07c6c5591df8908259e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
373c1de9a25f075eb497e8371d4f9552

SHA1
38debc28e398e703c8a3687bb181f160ca8d40b8

SHA256
49dad5a012d2f02dbfaf36184b5212d539282442aa2a5f8c38f829fd6e4f41fb

SHA512
84eab82bf0a36ac4da4b4b82edb664c5a3e64741ad86ead22bd6f68457351721f347465eaa2b9ba824e98911cd88f5db0ecfab41699a2d4c42cfeb96f9cb4574

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b144b9e8bd64558dbf3d6a32291c47f

SHA1
8ae2e7d043d77dc6fcfc12b0fce723de54de8a1e

SHA256
b36521b1b9c0e478d195e28a91233b080a6f314eec4d8cf81dbc200b796db6cb

SHA512
00756454edb72429f4c9e019d5b4608ce3d8fc34f1117632282b59b4ee8eb358aa2477c7d3f86b24944ba57de48de659eafc213701c798bdb12e5179a5c9128f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41866391dd7c03cc33b525d3dc3846fd

SHA1
5a7622a52c7098e0e8bc3d55e8e256fd2bcc4459

SHA256
b07f06642c87a15daa7f725f2794a48ec1ff1c489e3356059395143e318ec615

SHA512
d554018e1eb873c84a413c166386032fcf91eed3900f36f4cb19eadc5db2fccb906685ff0394b25ff1f750e03a6dfd95293e5a6e27e7e8dc1bfcaffe5647ec94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2afa86175ac4398fb48e5946ba98b196

SHA1
a07197c4ebc900554859451783166565bacd5e21

SHA256
a4163accf1223b72c58552abdca9f9292018a63f77abad89596a6ab83aa1c502

SHA512
eed86e6cbf0cfea86c8ae34ed67bfb280e441647d5c48679b7c5b1fbc2701302a468ab264f20d7dd0b561c53ce068e1b85c29aab13f42d8586c39e17aedadc9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1317ad8538a3217dd6b3533892f2fa5a

SHA1
020fca178e4d92cb3b52556204e96dc098d3e60b

SHA256
c4d4de1d81268bc60bb6e975fd64765e01e0a8214a9d0e90117f89807f0b75da

SHA512
8aee0923e2fd143ed17c62ea0b1a9befe4f3c73c6e0351af1cbcf2614db72d2e322e5061cbe69834aa611f96074fb9084d6fcf53f4ea08a88619fac7ba7dfa72

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabED5D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEDCD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit