3b52a9fc9dddf47ac01b680974d195a3071b118cf8244fc3d0c2fd9188d454ef

Analysis

max time kernel
130s
max time network
140s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
29/08/2024, 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c94f2b1820448f1ab35cfd975d7012a0_JaffaCakes118.html
Size

23KB
MD5

c94f2b1820448f1ab35cfd975d7012a0
SHA1

e0f2335f5dfa7240d7f6c8564d577b8daa63ab8b
SHA256

3b52a9fc9dddf47ac01b680974d195a3071b118cf8244fc3d0c2fd9188d454ef
SHA512

8efe8a8fc7a4f536c4ab4f5fabc840256288cd315000b32f988c9ce75f1e40b8e92235f141c78abb620e27d29335ed9d3da274a13f7f714e6d6f2fd59f3f01e6
SSDEEP

192:uWrIb5nbynQjxn5Q/KnQieBNn2z8nQOkEntuwnQTbndnQHCnQt9wMBhqnYnQ7tnu:qQ/czivx

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431115500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B8991E51-662E-11EF-991F-E297BF49BD91} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2976	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2976	iexplore.exe
2976	iexplore.exe
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2476	2976	iexplore.exe	30
PID 2976 wrote to memory of 2476	2976	iexplore.exe	30
PID 2976 wrote to memory of 2476	2976	iexplore.exe	30
PID 2976 wrote to memory of 2476	2976	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c94f2b1820448f1ab35cfd975d7012a0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2976 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
912e4da12279ddd6acd5d17dd39b12a9

SHA1
40ea577de22167344026eff363b246c068e76fef

SHA256
738468542e7d9cde9f7d45b5bfdb7f18cf2c12a365b417d6870a3d31f1630ed1

SHA512
860502fc396b9321b6ab20d4a2aa34c617818e684d47239d88530bd8474813915926723bb4f666ae1b5103e9c7dec869ffc4eef8eeb577aa5d1afca011c92c8a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58c7f0fe944aa3b457e87cbcb4334f40

SHA1
a803262d663c061c6d5345417b6905374c19ff53

SHA256
0ac373a3511a3c03f1b0ef3fa9eb1e3e216d40dfb393e1b62e4d67462a3ea288

SHA512
235c7ff34e68994c1794c5e2f99049a4686d07b6e77e43a389e623fb632fbba564812316b6fe793257317a67e92dc78bb462b509bc6044086014b3faa0a89fde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7794b1730b0301f69828408fd9a8cb40

SHA1
8b5653f150a532fce70c51817e5d3ae2434029be

SHA256
10ecb63380239be8338e7cc1476576452511c5c1693641599b9fd40eed85cc0f

SHA512
ae8d47c3c1998e895bf9e43241011d64cb67c00a42144cfaad9cf9d9d4853a9c69bee96e2312e22d153cab4cdd26aa9e78fe6a26689aa2ad703bc803e417bc27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddf01f1b2edec351c9e045e9a140d374

SHA1
b766de9e35368ed9dbb3b652af65e02852c0acfd

SHA256
081791631544815d86f41e0abe6c11aef3b9e05a8c11688e5b951d99bff46799

SHA512
535fcb5a5352947f75090e75724dec6a3a1c87123e10f4b64a0a9b13b4bc4ade23c09abcc0a2c9ca67a8956dfe1bb564a7c7dc9a4f124d27cf756acf59a0113e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38cce279e2404abf9456325cae5feed5

SHA1
d076e340b68764e1dcc43e6a45eb13ae080b63ea

SHA256
7add09f784385f79f4e26da49ba64976c572aae14d0d81d49165a622ebb9b4dd

SHA512
c8053dfa80fbba70ae9b5e46204feb5612e98526480ddaf35c37783ec007c53e08965beecd03a2fbecc4bbfa314eb6c9ddc503dd97752578f3f22e225ae7060d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8876b2c2a022579ad7e5550942b5b624

SHA1
45c0c85110d90fe93fe8e4f1b9ba35c9b02f0bbe

SHA256
8c47a03f97021dc2efcbfd662f807265aefbbf5855233765b90f46fcc7ea1d5c

SHA512
006c1ccb0fadafc8b265a470a8a2d68e7192d88765e85c60970611717f0e65ed36a805f5a399efcc51486696a2548eb4d8e339ee3e6089e7b54ed8c0db717786

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dcb9b2c3ca3c3c8474240b9970ff70ae

SHA1
8e84cb1b3c07aeac017d80bcf499a72656c71e2b

SHA256
13cbf3b8d10bd6194c3a9073cfee1d3796586fb455a91c8920e1b50f50f3159f

SHA512
7cb0ebcbc1dbe4d10e8f488db11fcd67559a95200c1f33415a73267c4a147b271d821c56ae01f324f3f20bde5e4e0b84cfd1e76c2346b701c9d459d0cb9c6db3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0372a7cac0b3c30fdd4a5a4f4453327

SHA1
f2de31554b2d9de81c41908b776c537c43c8e7d3

SHA256
d8aec5e4ad08a42e532e1b144ca54df49c8c5e2ed4467792c52657847a39c367

SHA512
af7054216548be8de1d744a74af93e9c684e1572f7c069e1d8400371ee634fb15f56ebec88a92d621118dddcb249325f2361ce3d299b5aa9e55b396da1e6c8b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e56034710f713897cf8ed9d8c59159d1

SHA1
0d99cc2227ddffb627c30ffabc25a5c08f60670e

SHA256
e0f9dd27b97acbb0b593a2b2b88b41ac14d9657ae46c95e603775dd76f72eee7

SHA512
5024a9946d1ea54fa9b6b507133ec674354ad605b5e2733f091f5f04410f7ecac5e045e790fb80e2973f69e93997e64433b770b505c842a99bf64b06fce17e6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab87C6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8876.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit