6f6c270f599bada535898c61ffa3997fe61000acb8a29e7816609e49a81d1f3e

Analysis

max time kernel
131s
max time network
141s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 01:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cdeee8986c7513e7e567c5637467f3bd_JaffaCakes118.html
Size

23KB
MD5

cdeee8986c7513e7e567c5637467f3bd
SHA1

5c051bd0d621e7b5abe5a690f1add16a068f8548
SHA256

6f6c270f599bada535898c61ffa3997fe61000acb8a29e7816609e49a81d1f3e
SHA512

2a91fbaad3b8f7c078a887ba229ac0640892fc4e3d368cefd693550bb7441244589e4bf66a8af1cf38100002fe42462dca3c1d5c605c72f9d70c7b4fbb09ec7a
SSDEEP

192:uwHOb5nLWnQjxn5Q/inQiehNnbnQOkEntOEnQTbnpnQKdjFvMBBqnYnQ7tn0YWn2:wQ/0STsr

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{02CEA811-67FF-11EF-8BBB-46D787DB8171} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431314911"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2368	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2368	iexplore.exe
2368	iexplore.exe
1396	IEXPLORE.EXE
1396	IEXPLORE.EXE
1396	IEXPLORE.EXE
1396	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 1396	2368	iexplore.exe	31
PID 2368 wrote to memory of 1396	2368	iexplore.exe	31
PID 2368 wrote to memory of 1396	2368	iexplore.exe	31
PID 2368 wrote to memory of 1396	2368	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cdeee8986c7513e7e567c5637467f3bd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2368 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5171f14ba1f637ce1e7e867f94df251a

SHA1
e6f4ab327aa3e038cf13079b9d56b5dfe72f1103

SHA256
2d000deb6117277dbce824f7d3b9f228aae3a1ce2a06aaaf29f2f80108096ece

SHA512
ff83dbed86b7c860c847594d2c4bf9d3b053c33f30ac618232226d38497ff6c0d4497abc7e4511696ccb66594a184e7eef1f6ab6e27fe43dffa1c3b1440ba0e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e353ef153def350d5d0ab7bbfcf1b37b

SHA1
d6c192e6ef1d4b07ad063c36b40b98072682e728

SHA256
a7932d316a87a6aa198a2f71b800aabdf55fa1fa7207d37c371efbe0063c01be

SHA512
4fef9a67c7d6b95d72dbc26ae44f9c181f2a2805a5c8e2be58ffef25f2a81f5a4f1cfc196c4e01fee55b910a23beb6c6f8a1e0f126009674eec409335595a577

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb90968479b4978b954283014aa2c6c1

SHA1
689abccb628d7563f39b13b873693909257a28d3

SHA256
54777abe2fc6d0da3b32bf247958caafcc700e86aae0044964c0075d43405e84

SHA512
15af7bf92a22e64f2a815f32245b8ec5f26d71f5803fca56f4a404ab2a46caa2942e0d9c8dbb38f7b45562ddb2bef42e9a67ba9fc9b2676ae3ec7c68974f26c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc4b29184b14f4474070a14d8087ad8b

SHA1
266eaf317e16147f0fa661729fedb86d998632fd

SHA256
1151c02b99d1beedac2809a21c59d84db806c7f922a6eb4c034707eebef8cbc0

SHA512
f2953d0cfa65191868bec7c0c0b2ef09b4f5c53fa741577bf3f70fe0671a501963c0ffd4f1b7245eacf0ab2f30f54a5e0be3aa2c2f355bbca9ffd942c76186d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b6236505d03dd5806b52a9e5bf3cc23

SHA1
fa04a300b4806e079e321f7c9729471d971a096d

SHA256
0e88e41062e8bde82e216568173e3b21e0aa63b66f561a8e647f7d6f05a5a45a

SHA512
97cabe8df6c6ad35a2d8570f7b5c2c82b99a091a08d67a47d8cc3a809231ead825e61a20a931ef3cbfd63e686caf49253f969dd83d8496dc591d4a71c08930c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94e7fede8abeb0a662cb070420956633

SHA1
79f3133ce297ad5ecc7dce5048497058e4fb75ec

SHA256
7456d1cdccdea4c9b1ca4fa97e8d1fd34a99f08d54e3ba0cce7e6e45cddd2475

SHA512
2a34e4bad74b85113320fe626ba0745621c138a27fdc2d134eba8633d9508dd68403b93e3575a2fb5cbc35576d301331b1c97d09f72967ac9e0cbac62108fe01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2678194b9aae11cedac4b1780bc472b

SHA1
fea4ca2aba604947c64f653c4018330a2e378842

SHA256
bbf38d8382dbda1296a5ed077ae88366c04f8f39487c52f70182585c525dcf79

SHA512
d31c1f1bd4f4dfa3485ebdf871b559cba174130f207cf5584dab1b6997689d42dbf44494eaa5997eb5c284e2c42ec51b01eb395e1fe40157e9d6fe421cbcd8c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
116298b382a80999f4be04b93043dc04

SHA1
f62dc5384931f6e581cc6b41c12b7fa1c91a75ae

SHA256
cfde0f62928456cfceb7d7c03955eba27226080175ae982c4ee17c9e9e69ddc5

SHA512
30aab2bea106e98311c73ee9bb500f90636389a2e5aa57e454a0e42cc88376de4eacd74cf3857f3ae1c852594aa8037bbddda8bb21f320f2b91fa0b633895319

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1313959493853d5aa81194a085ddec8

SHA1
bd2ff91965a8f75b6452fd1539c3dc2df0ddb79f

SHA256
c6146a2b5a6ff4c51f3f2e02f1996968979a49625580e5d4c65b04ec372af25a

SHA512
01ca273c0d2f057fcfa358f4c54544e7c9811fe25c2b667eb2764ca5308920ab70c44fb96664cfb3d1cc7e51c1b3eb66ed74f9d980006bf9a4c7d3718b74731b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDB44.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDC02.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit