2835bf02295b008d3ee9b69e4d86679fe00f0cc930856f63f92d854c44a63de7

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 11:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c8bf8f6dee3f7d58d3f024d1496036ed_JaffaCakes118.html
Size

23KB
MD5

c8bf8f6dee3f7d58d3f024d1496036ed
SHA1

953346a992ee784179bf4c65f6559738f00dc10e
SHA256

2835bf02295b008d3ee9b69e4d86679fe00f0cc930856f63f92d854c44a63de7
SHA512

c7d75791ce74797418fe0f23d3114043ae8a78496c23fbe3f232cf131e350992fa53cc4c56f2944d847faab07f67994a2a75ea1026c9016f2e54d2c3f03426f4
SSDEEP

192:uW9/nyGH12aqb5nuOf7TXqPNOoH+KunQjxn5Q/U+nQieAhNn/WRnQOkEntSIrJn8:FQ/Mwr

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7C682F31-65FB-11EF-BB68-FA57F1690589} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431093496"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2152	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2152	iexplore.exe
2152	iexplore.exe
1304	IEXPLORE.EXE
1304	IEXPLORE.EXE
1304	IEXPLORE.EXE
1304	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 1304	2152	iexplore.exe	29
PID 2152 wrote to memory of 1304	2152	iexplore.exe	29
PID 2152 wrote to memory of 1304	2152	iexplore.exe	29
PID 2152 wrote to memory of 1304	2152	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c8bf8f6dee3f7d58d3f024d1496036ed_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2152 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63db902c4219d4ae323e8b2e4b910f14

SHA1
21eaf3844114898c9442356df6c4e60ff874c7b6

SHA256
e6a343c6a34285e888b75dda7762d2f24b1a85a9518c2985394af99d4b667428

SHA512
561a3c88812cbbedc5b62d401cb9b0425d4e58f0ef4ec6dd15962963eaad8159df9045054b67f17a8cf859028bfd543b83aa2e8411b2d68b6f9ef7419e85fc69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4b28dede45a804cdf88d28acfc95630

SHA1
8facd6ac2a0fdf701706368a261a37c15c7d1b7f

SHA256
5611c154f765ab83b651ae7829527cb635fdd8d8b2580e67f11ee12882fbf641

SHA512
13344afa4f2f407292e3a77668b71403350bc7315662020b9be9bf6a0d6f2ff6f750cbe567fea4b1bf14f8615b73ab112d06b58a3cbd1ed75bdae9f391985f7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
baf696bee8fc84374349a8a985c226c9

SHA1
f0d758b3cf4cba6222f7af18d08dd4f413b48f0c

SHA256
577fa600a16e8eec57fbba873ebe9c148706b109255fc37e664b80f037e51cf9

SHA512
3e77a5c3588057c265b880ccb435038f94b17f24c2f7f9a8f595526ec2f5eca3daefbbf80c33c2f422d267ba2fb5d4b9c4a17a60bed82fb2e3068e85320bd924

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41584afd4d15018682ff6c1cf5f238f7

SHA1
67d31319abdcf8fb3b072b726b5e8abf0b1e56d3

SHA256
9fdcbeb225211a87f633d6dd4c8a1708c91d27987c84c82d1149478fa8b40374

SHA512
87333bb290d293a7a3a26d969c61d0eec4bd1bb2077fd236f051b96fd288f1e0391d67d85375d95772a037c996e59bdece2471de69d80446decdc9134a29371f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15ae3163a36e6d0a1e277a580b256dfe

SHA1
6636e16640efd176a795754fbd070e85e04aa5f7

SHA256
abe8ad430633b163371305c8da7f429433d1e929992df9d49daa4ee04adbf2ed

SHA512
916f1b7132befc9c8395a4d7366882b3e7cd1bdde311bcac78e9166ad30729db537db3fb061dafe8a74eee2242269d0e5b8248013a1dca3e3d1df3aac48293f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22ce8591038c729270c1c549addd0e45

SHA1
57ec6239d0fb8308ab3b77fa2a68e4c75029b7cd

SHA256
1caef456f184d35cb0edd12d5cf76c699983425feeadfe829be0378fec7dc1ba

SHA512
db0431b7c780d0eb4b2c5ce2a88d11de4a2c299005955b4b396e53e37070a76e0752ee11e652148a8a98fde59f8e67dba6f9ebdf1ba344b5834a0821ce1704e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d449d2eb4790bd08708525aeff6bb4d8

SHA1
06f540ec88dfd07e22122c978393b0c6cde4e473

SHA256
d6da02ecd5016d3a8b0875bd40bf9bdde2e1b1bfb94812f56b89c8738f303ca8

SHA512
e63d8a302b634cb4885f5d9e7a530eafb343215a98189589f9d4ceca19594968196223d92090a21aa6d64fd2684b61dd7a045f3302dc726f6e15f4d6e2b24720

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27c71ffaeeca7af88f738da758680ac8

SHA1
597abeebb848554250fc0f7d59ae94bdef935c73

SHA256
c88f34e7e64a73797a8802e47b6df3da4c3106348ea8b713d352041a3e220904

SHA512
b69dce32d2d671d7e1220b40db6c567b656e70dd7498bd5df651b4bb36266b054a7b4b70732518dbebcf5f57c27d5dfecfa2549f1f655965ff3b9c2d58f4a874

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab454C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar462A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit