01deb409cc1331e427425aa8c05451b47dcfc8b84610aa4116fb83a41c571014

Analysis

max time kernel
132s
max time network
142s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c8ab712c3c9dc9cd04af14f2158f6604_JaffaCakes118.html
Size

32KB
MD5

c8ab712c3c9dc9cd04af14f2158f6604
SHA1

65b11b7810505afca534ef81f27d81b1fc1dbea6
SHA256

01deb409cc1331e427425aa8c05451b47dcfc8b84610aa4116fb83a41c571014
SHA512

c64227cc135fcf797879b2967f5fd5e97b83dd28777a57fa215173817c974bee0670b57cb88bad5de98e94c2f92cef19eabe0791c4ac17f062524e45123687a3
SSDEEP

192:uWPJb5nFnnQjxn5Q/InQie7NnOtnQOkEntk6nQTbn1nQeMC9ACbLU/IfyINcsitL:mQ/NvBLuxVP2ZIAlkYObp

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D0920701-65F3-11EF-9CB8-C278C12D1CB0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431090200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2112	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2112	iexplore.exe
2112	iexplore.exe
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2404	2112	iexplore.exe	30
PID 2112 wrote to memory of 2404	2112	iexplore.exe	30
PID 2112 wrote to memory of 2404	2112	iexplore.exe	30
PID 2112 wrote to memory of 2404	2112	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c8ab712c3c9dc9cd04af14f2158f6604_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
72ce16fce5ef04f8303de9aded15e4d7

SHA1
419495dbfa16091b9d998675e99b5b185398e347

SHA256
b0e574549c7a1471cd030e41d70285e8c572406234326e1734691b980e881412

SHA512
e250a84ad61d0667bc6441f733262d6339685b0668f4ed011b94442c5ad9a9af73a17f3d49e2af9da227ad378fc2bfc7c7c69e78d92707f84a91ee80e8572ec5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
fe2668bbc1867462c457a4c8539a8309

SHA1
7832fbf50a84fd3356bfbad203ac053b4c6d4d35

SHA256
97c96d1b7d7c79e6538529bc3f81cf92da46cf3feb1b9e7f9c779f8e0e60a742

SHA512
348c39cc621662b641d52818fd3f746091bdea414632ddb9429b6397e3864ea19609dcd9bdc15f88544e22a5f80b92bebf9deadf665b7915a00c07c466f570be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
642d438ba1f8674a2e33e077f50bad84

SHA1
e004aaa39dc85a40359af1175178ec5927317c0b

SHA256
a5cb4d8193da02fd2c77ba24f72ce4e2540c231e41ea02c1109f5c95eb02e249

SHA512
7bfb3841f1cec571cf7c24d19b66e1df7010e9ad6a2bd2174d36d8ab1a6ebab760378491c5d71d2bd40e44c4775bb9d792c0767a9051b8f94ae917fe67065e4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
13803006f7768b0327e0fc0d82533a5e

SHA1
dcb58b6b513c8284b2d7d3cc0fd4f0b9e51bac58

SHA256
19f433605e387ea86d6e95aa05b17c9c0dbb56263e7840e8a80a89ef691bc3fc

SHA512
2df22a7d942639fb2fed7ffa6ff0f4fa6badb70885c4dabe20f8b3e902a3e8290b4eb66b3f30f0e488466ae0c9acfc5f83a742ed0af1da22a36cf21ff5ede1cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
63e529b6ea3873034d76c600d0a20633

SHA1
8d8676471f0f3067e2a5f04a758adf43bd92bd20

SHA256
7e2f235624880c1ebf42d7506690ebf8982b366f41e4af5b68041ee326e02c4f

SHA512
b734c8990f65051f48632465465d3ca2b1d542b9f25061d142507a10fd370902fdb1f49f5c0a5e1ed084671ed4137a397d67f2d4d6fc45d120d16366a9cf8d5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6c0d692abcabe1b14a664b4106423505

SHA1
40bd1506f724dc6d2d5fc436fc29716a921be466

SHA256
d1b541be960745deb2f137ab02414543fde49c5186025e62eb0d20c97b29f299

SHA512
5297b72699eae396f742b92d89c4cab71c5efbfb78bb29dfff030fc5229bbd7038f3101efe46c2387096be0c85ce5077f52ef2e352a2506a2a6165a3f9065705

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ce9fde8381341920053fa26ff4b58bbc

SHA1
60a7e7d1df71084293ec9bd349a107befcf08d57

SHA256
f99b0ed243ef64aaa15c62b50499eaf7486a0f69696b961d68489106bb99ff52

SHA512
b8cb9c37b9fcae4ca67dcb5601e5fa90ac3a76e5dbdd6de5f9673939ba2837ac1f48a49d701f105326a8516156d1d6a8cd3c3b13d8b0c18027e84a0cf26cc560

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
46776271c270f91c4737bea50a596479

SHA1
2ffc738a33207506e62213c81921bc70e80fd22e

SHA256
d9b7d99ed64002122bd2678d12b60b0caec3a0e648bca93389d6047b498c0c1c

SHA512
f91ddff0ab8c51ded48280caba785e53f97dbe32fa0e9f5fc20518625bd2d106559650c533e2b1a158353144d694a7142d81363736b900058d3b93841c953813

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3d22331703ffff25e65ccec2991eb1ec

SHA1
608a87ed97e82ff420135589ae8a38ceddf95481

SHA256
f1715efc3436214415cac5e30f9afeebb35ed1b8ccc11df57824a9cb1da15b0d

SHA512
5f45747de009c3e846137c8950bc6d967f4f3aad79cdc0f3d36a7772bc7500557e4fa24dc29cee39f9ef4f1bb9b1cf632f9b0031eedff6a776eeee6c9ebe1c0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA98A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAA29.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit