3f814c027f6f17a3ab6960d4dbe1c9afebc7c246180e82ff4b1f81cafc4cc13d

Analysis

max time kernel
149s
max time network
137s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29-08-2024 14:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8fe40b31636c152f84c9779d8279a3b_JaffaCakes118.html
Size

123KB
MD5

c8fe40b31636c152f84c9779d8279a3b
SHA1

e20e0085ce2a8ebc96b7cabcd7c32286f8091642
SHA256

3f814c027f6f17a3ab6960d4dbe1c9afebc7c246180e82ff4b1f81cafc4cc13d
SHA512

e764dbad81386412b551d01969964605e96fe929626f95b8dd44fbfedb82ccbeb60ea78843b7d910684a2c6daf997a2b3acd29af59ecdda59e4029f329d2da14
SSDEEP

1536:SAOZyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCW:SZyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431103021"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AA7C9801-6611-11EF-B4E2-F64010A3169C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
824	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
824	iexplore.exe
824	iexplore.exe
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 2712	824	iexplore.exe	31
PID 824 wrote to memory of 2712	824	iexplore.exe	31
PID 824 wrote to memory of 2712	824	iexplore.exe	31
PID 824 wrote to memory of 2712	824	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c8fe40b31636c152f84c9779d8279a3b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:824
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:824 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ef08ec6bd31bc87819d318e94e17ba6

SHA1
3972f493eebb2e87d9d5ab24356e177da24aeeb0

SHA256
a711f5a3fd2f48ba628e0c978c0e68519c7296ed78282924a2991693fbb5e939

SHA512
2aff065de78788ebfa42c7b6a658b417edcbdac586227414f918b85ddbdd3adf8c338aaf0eedd415b0ec179011260d788270c31e99e449a53f6e7265749cc43c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a509aedf3f7bed17fc6582fcd173a140

SHA1
496bfd7dbb8b97dbde5367ba620e4c132d71e6cc

SHA256
bcca342ac08bae58e5009baa93a46b823c60c8b9ce56b79306b7f3a10cf4a627

SHA512
280e390cee7c0998c28585a6734e9d2186b3c20161ce2a59197a048b93ac96f41fd8429e2a2c5f0d61d64d8fbb247ec8ca4415adb77137f902b07aed97d874f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fdeb56c103420797678f22d6692ce66b

SHA1
92ab87b95aaaffa811ddadf7e0083c6edec87471

SHA256
dd5dbe2d9819fd32efa337a5f037adbd9b225969b6e5c6ebcef71614be6b74ae

SHA512
ed1a9de7d7915d7d53a9cef8ebbc1e92a1109bf371d0525c69796a9681316cfe00deb188330e92c589399d8e7bc2c34ebf6ffe29b937ad36a4bcb88d13f2a3bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a5ee5b81c6fb5b487017da1c81a25f0

SHA1
4b2106249849b286c1792f6a058584aa504f698f

SHA256
370ed314b52fafab110c2a3e9004f37ebc1686856d28a50874b1b3c604373d1c

SHA512
bca621eca0d416e1b45a367a33d2caa4843d67f04a0aa4de23d1d2a87782071b8650b2f4d6244fae15bc8bbfc96670df1b320e062df0b338d5807695e2a6370d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60a52b2db86c50cd980a5ceaf09348a9

SHA1
c86a222a495e0e78ea02647ad3831382db271a59

SHA256
d18aeaa1080722cdf25162186d52f2305029f1a0cff9014ab5cc398b933d7faf

SHA512
35b16c1af4b8149ab8568cc277aad77bbff69a2f10d2195caff7d8ad38a8fec179a8814a148ab9eb11d6ba189f8b261b78565b69e6515e98d4ae2d28c7c99f5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fbb6b81659e70081f6fdcd6209fc0349

SHA1
5f55668e5f94fb4bfe7b0f2953739c23f2d80207

SHA256
4334057b16a48dc76ad7919d1416e36c0bfb98ac6adcb72992f75f1d82a6782a

SHA512
ad33b78621f2e2494ef5939e2749c861e21263b4a419e935e28cb9a7dbfaf81911887ec5836cda007e26d7d54d016f7fc07ca36d821c828ee64dd8b43ad84164

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
279dfa472a6bc59ac5f9cec607713d6d

SHA1
dc19ad6840d819697ee57fe87468a498b6f63ac4

SHA256
0c93866ce53125dcd2b929fd058081261389320f5905d5c399f7dfca5775201d

SHA512
68a991493b7e3f0a81edc2999fea2debad2bfd14b98ca77e70cf3532f43b1d78c2f481e2ff34cd429c570e8500fdad20d47bac3e479216f5c6a77348fc6c13de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a8ebb89068622d17f5f3592a9901c23

SHA1
3e637825c9d0c906bde56cf745ed23593b07762a

SHA256
0b2e169051c36c972490cc161f08b0aa75c691cacc9c915113ada21300cd21be

SHA512
ccf243372aa6f7228030a01fb9326da4bc4e7595e09ce93b9c66271b6f8401a7b0990e7c641ea3ed9f2586eb4618753e538e13d30224e4cd858dda83490f96ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1131d6b976a919a8422cef71c852e8a2

SHA1
951953bd9a0fa94f43b494097634836bf55f5924

SHA256
cf54bd7cf78608abb13cfb3543575afd441f19e783e618670f9c3c4bf803893c

SHA512
eee1cb26930336e71c3b3c791997e954f88a607f00f013d0ff0d8ae6cb611784431aa37ec28a1296952f622e877c115c101390cdb6d0d123efdab0c62cbc5b5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE053.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE111.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit