7dca58e9c6443a48529d1fb6a3e00554f880a614e726555089e0aee2722cc85c

Analysis

max time kernel
132s
max time network
142s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 12:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8d79086a758540ddbee2bce58e64752_JaffaCakes118.html
Size

27KB
MD5

c8d79086a758540ddbee2bce58e64752
SHA1

e69ba689e26c5e87e65193ceef48f81735b68ea8
SHA256

7dca58e9c6443a48529d1fb6a3e00554f880a614e726555089e0aee2722cc85c
SHA512

874f855b804bf76c9dd95e8df63ed0fd876971b2881f721c65e6706671c4d49eb64bae6afd04637c0688564a5eb5c926943944cb8362cd7dcf44ae69bddc8fcf
SSDEEP

192:uwzEb5nsghnQjxn5Q//nQieWNnAnQOkEntthnQTbn5nQ9ecjam6l8oNaEQl7MB2d:miQ/INWXavSoDp

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{63DFAC01-6604-11EF-A19A-DA9ECB958399} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431097319"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2580	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2580	iexplore.exe
2580	iexplore.exe
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 3024	2580	iexplore.exe	30
PID 2580 wrote to memory of 3024	2580	iexplore.exe	30
PID 2580 wrote to memory of 3024	2580	iexplore.exe	30
PID 2580 wrote to memory of 3024	2580	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c8d79086a758540ddbee2bce58e64752_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2580 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26b2a1b4f29a5eb26a1c30b3698801d3

SHA1
406ce4bd4a5e26255418f7aaf48ac5d3a5c2c38a

SHA256
95b4bc737b72bdd616d367a44ce32c17600d61da2a85896b9fd8916850be7499

SHA512
7f4dd918316fcaa0d71496eeb0a82ca9630ea50bd0845dbe889eee57e94e359450e2171613f9856c425dcfae47f47b295ec4d3bbd52a08c7c88e739cdb82f1a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
435cd38e48c58ce964b165b9e4013bc3

SHA1
03fb655f7c26e9b3257a19e375b10b35bfa40d77

SHA256
e98e0c8a37b87a6e7e9a6c917fdf2bab88f3e57ca0b564977c00eadc7b2fc4a0

SHA512
2b76b3233fb391aa3fc54bc136414b732fa791406ef5920f793b01bfdc8136d36f03322f8c9040a352fb3435152e00b4914e778275b1ea6ea8b4bfcabbe993f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4db210c9d9010e7688bc129c8def9609

SHA1
299e227d2d0f8b3bcb48539bff1966566e0b53f9

SHA256
1e74f9a18fae5084b1dc15b7479b0a26ae8f7f6cbc3fce06478e86c241be5a18

SHA512
8b0fed644a9137e32b14581ff9f0096078860796227a78b51e3b57af41be1ba2f8c3c9ac6a98d4852d2445483e8b366af37680dcb8bbf7c62b275549334c29a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e6c1710726861599f6d7810c54806fe

SHA1
a37efd343734e5c36b6d8423bbc0089dc2883c46

SHA256
ed40bffeeecfde5b83cb06f5447fc8a447919d34a22756f4c52edb0d41569280

SHA512
4259b0c7ba3177cc943d5c09c44bd0d01c4ffa8699b01b51d76fcc50b1d4fb541b8e8568bd46349a38c38972a308304a21bb70817628c5e8786d66733fa582c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc78560c6bfcb4f50eb4d696ede46277

SHA1
c34fd5fd498717c044a86a20ab27aa4b3d161bcf

SHA256
568eb947a23975339f8b67dc242cfd37541a7f19ae56dce1774b68ddc89653dd

SHA512
3c165be251f1876190c85e36bf2acad7dd038f4a47fe38a8a453c370793bfad22844bdcba815dd02f9f321cbfa1105e3113fb6059f273400e31a60cda479a4b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a5af4bfd4f5ec67415d0e4c1213caf9

SHA1
eadf9250c8bcdb1a087f2416132a46a8270c165d

SHA256
32da2023c88365a9cafc4378925464ae2e3e9c0691b868a2526fc11b99b127bd

SHA512
911179a5c9380289904cbbf11b29727b3492bd2f7078b3e208ed93fc14bb596c5b5382d9ff7cba26636b44b589752e5c35c2491e4ca20996ae6ff511fe2fdf27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5102911b8c22b67f9959628976cc638

SHA1
f11021f370ea2fb57108e0e02a06abb983831a69

SHA256
105b342cb9ba04359787a033e5047eb45f74d9ae6e7e3a7766841eedf4cd2a33

SHA512
13b8f316656c1fa4dc1abaf1825a4ffba2e6ce6478b543618db9504c0b11968b03b0022157a0ea937fb17be8db67c3ef9add18f89ac0343984637e91d2765c28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed380d856821eef33818fb6b05f43026

SHA1
2271070ae35219626aa98c3d49025705e2e7c859

SHA256
eabf2482192f5c990c4cad65e23470e74b0b095465ee705f0eb406ad5ebff89d

SHA512
b89b58e04a63c0d2eba5293eb3d196c6057e445d05ed720b3ec3fc4537b84ec8d9c40b22427a2e354ec2707b1aa9ba18758eb2836e282e8c31dfa6cd35e16655

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d28405c723b4289cfa125bfe8015e73e

SHA1
66eefde4053bcc294fdbd7e948d0ee7269a2b501

SHA256
50636197936dfb84ab90210308c51fb109c55ae4509f528c154a11e7b50ce455

SHA512
5a10db2883a4d5317fb4c646fbe7a26391e4e51729ea6d60ab8a762e4297e6c1dced6d1f3d2d5399e5022148ed45285071ff1b9adc58d95bc15715010d30371e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12af20a844dc86b5040965028c9e5dd0

SHA1
c67140f1ac1d9c37354b90e2a85d34f033aa9e6f

SHA256
2ec1b050273cd7797a7d3313ef3600fe854ffdba9d8d39aa13887ed2d6e60bbb

SHA512
871a42cdcabfa3568295b4fed2c65216042aae564c520fed18bcf350cd3245e2ad15a4a8fb2ba5425cd750a2c567d82594dd05b81c30cb225b2df8814d0ae329

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB167.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB179.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit