ef15103d58010d8e8c95201e2a9ebbd4f1a334f2debb1e9ae1e80336b075cfe1

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cdf06a5f55538fd655f638a01ada873a_JaffaCakes118.html
Size

23KB
MD5

cdf06a5f55538fd655f638a01ada873a
SHA1

8c6c50f2fd6d8ac9fb55d1a2435584589e2fe0e5
SHA256

ef15103d58010d8e8c95201e2a9ebbd4f1a334f2debb1e9ae1e80336b075cfe1
SHA512

a6aae740067de57e6341f463dca2946f177dacd89eda64bdf2cce4d4e73ba532ed0eeaef95a509156e76983cc36232e929652f5b42491403740a89d3ba968478
SSDEEP

192:uWP0b5n0KnQjxn5Q/3nQie+NnEnQOkEntRRnQTbn9nQACnQtswMBeqnYnQ7tn+Yv:xQ/GMa

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B506CD51-67FF-11EF-A5CE-F62146527E3B} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431315210"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2672	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2672	iexplore.exe
2672	iexplore.exe
2868	IEXPLORE.EXE
2868	IEXPLORE.EXE
2868	IEXPLORE.EXE
2868	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2868	2672	iexplore.exe	30
PID 2672 wrote to memory of 2868	2672	iexplore.exe	30
PID 2672 wrote to memory of 2868	2672	iexplore.exe	30
PID 2672 wrote to memory of 2868	2672	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cdf06a5f55538fd655f638a01ada873a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2672 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a49e915fc010610e62b9613eb276c8d0

SHA1
5c76f45d3a6fb267ae440db0df3e0b3be4320b97

SHA256
c7d741293ba3f7f2bf02fa924044943213b56c503029302f514971461e7de4de

SHA512
01510989bb7d7a6f168e488bfa6f18606dad6db1546ef3e394e81ac6df083ed64d05ee6fcbe199e7ca17c93d6170dc69263eb7931126c14855432cd82174e221

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e8a0166977c64b7525fd36b12791aa8

SHA1
ceb9b48f94818e99dd779f09a6aa52da1df7c64e

SHA256
889f1fd33ea447cf8d1fdb14607a93928265883e75c0f4dd6c2e121a1799ab8e

SHA512
972e51010105dfaf2393ce7d0ba2e1b1140f0a672ca80da13377a5101d7f1eeb1ae7d3e68ff03fde8e5248166e18b74ccab3053f0b7a86d09370074eb48c4784

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cfc0663038394fed518aaa019235ebd2

SHA1
ac868baf67092b1dcafb54f703df95252f43238d

SHA256
0672b0347d3377b79bca7f21c0fcf3b9dfe9bc7471167dbb84ef441e3fb11d1e

SHA512
51fb7c1bd0522225e46534881e3a1b47c2177251ca61a23dc5ba5059a2e3eaaedb05e59df1416fd3a629683d3a7ad59fb7e29ea9898e807d7852d5943f35c376

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c34405fe95db1add02d43b033219a53f

SHA1
cff658192938fd91a2239d7b40cbfa83b8961d27

SHA256
70cf44635b9a2314eb1ae6f30474ee8ecb8f60126bc4615da083056d376e901e

SHA512
bb57f4e4aeae651dd8e4987e2bca92bd560a6011d9068e712aa26677866d6e256049dacade876fc3f9b152719a38682edd315665c79695c30d2ce694f77a6b5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f31a0558b2a0fe3d8a88984b1f93d34

SHA1
57471fe446b5d1889b0a7485a185e7807437e48b

SHA256
c06800dffa9f366380df7624a25d881ac37081729f346b49b7892d1eb1321b89

SHA512
50286a3e97f29c4c8e4524681e835dcce85e5eace1ccdfe4be6b6f1bec3061240fd37e4c10289e5fd5dcf1feecd9a2f589e59654ac65302973a9d2deffd37f7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9dc4ecb3ba9d3f39fca02b2faa0b1008

SHA1
400f981d86e6a1de2e0bd9d2f7aab9a581ebc1c1

SHA256
0bd6a06b3dfb9f82c06be79c58d2d49c9ae1f1e4d7854f97737282ccabe3d596

SHA512
ef2590464201bb250943c529a82f564dc5d058c22fe7d14f8f78e70b5ec503b9cd99051b584b5a5f1fefd79fe9ad0a246a09c92f6b152d75fbe0e6c2bb62922c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47df66546552a8999b0cc0323f3265bf

SHA1
176c012d7a1b5066f1b5a0a1bc4d845c962013ab

SHA256
407eeafd192ce2dd5ae9b8cf3d6f0476143dbdf6cffe26dccd6c4d5b58ec6bf5

SHA512
fbbb2c80d3973777d84c6329e8df41252b07740261adb061d9720ef92621f0067f49925b9f83aa9c7234f6c8b5b9e3645113437d7178f64555724b3a219a12e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cba2a46f20ce712c7d2805d3bac7277e

SHA1
779fec987696de9ed4fe0a054e70201b7ee263e8

SHA256
54cea833d392ae0d15a76f4baf6aa308d587bf25189ce0ca27b847076cef70f6

SHA512
60012933b39eed8b2aa5b3f5bb3d7fc304915ed7b99908298a4e081c9e4e4b082b03ca1cfb5a39ff1ec6f8c1e09a6855d979ed594b41b93f5c30d896b5fa74d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7f04dd11fc729a380909c73db954ae7

SHA1
2733d503cc954493c494e1c4dc6185fc8edcac5f

SHA256
213d689cf3d1e39538634233abcfface03a08ebefce1fcc9b76f40941092513e

SHA512
8e32194ddc87a2427f29e531c9bf515ebc126406918e7f1f11c334a57a96006fc72bca86d1c6e47d5bfeaf8d1749266b63027437379d60dd7639c34819f04eca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab23D6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2457.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit