93aa396afa98c950961b445ece2d4dcff65b9e926114085b5535dcb4ea26e34e

Analysis

max time kernel
132s
max time network
146s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
01/09/2024, 01:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cdf3a7eae7e2abe58788303e825b0087_JaffaCakes118.html
Size

37KB
MD5

cdf3a7eae7e2abe58788303e825b0087
SHA1

3a005821c00aa257bd4897d93c2c9d231edfb074
SHA256

93aa396afa98c950961b445ece2d4dcff65b9e926114085b5535dcb4ea26e34e
SHA512

74b982e15659553a6061738aacdece47e6a75914ec7296ef2f11210cdea937ddd87d7e258b53d206bd23843e902e684874630f85f058046259fe150d3710a1a5
SSDEEP

768:Gl/kUGlz8mvz7Rvz7lp8/rzVWuxaE+1uRCSwvoOSRxDwMFCSXcvNyb1Siy/yA:tvoOSzDwia

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431315911"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{53EBE031-6801-11EF-B5D6-E21FB89EE600} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2704	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2704	iexplore.exe
2704	iexplore.exe
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE
2556	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2556	2704	iexplore.exe	30
PID 2704 wrote to memory of 2556	2704	iexplore.exe	30
PID 2704 wrote to memory of 2556	2704	iexplore.exe	30
PID 2704 wrote to memory of 2556	2704	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cdf3a7eae7e2abe58788303e825b0087_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2704 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab1fef6582ec35bc0266a4c92d18c41d

SHA1
87c9e58779b449f257aa96428082b936ab498118

SHA256
316234861d9998840a37ec8b41beac741a4dd26aff0f7ba3911aadcb4c87bdbd

SHA512
fcb28486ab0a6ea8a500352298271efa6a9072b8009477372e65f28729f340ecfaf7b03b3774a231ce46df008e03977fd33f12dc4cbe6e821466d25c243bf7af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d203781decd5a9d3c9025d984dc50d6a

SHA1
6874e28d906b4682d3f1842ddeab454e3c9e4cba

SHA256
ad27c802e92fd4cf5d1ab1da06e533759c798dcb48c97fb28db51782018af19b

SHA512
aed9d4445bb82151be038e3ca16d00f9e0fd497c30aa705fa2422b712330da952ec974b067f924551dcc6b24b55cceedb99c4b534677faec934a22177f402985

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
203605056a0fc24ab75b6106a908a178

SHA1
8b2e248fcf54e02d0e6592d53f150b64f7c8b721

SHA256
eaeb63cb0b28d99c58f20b6ee31e95a426e08e0268c2148822880d364ff52aa0

SHA512
1a546fdb0a20c83829bd054b8fc8949573f714686fe149cdaf4ca955ec0b062784bacb961d31c5d520103524e86870a2f7d7276303f1e1517e8c225a61558d98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e81a27379189d0bc42697328c3113cc8

SHA1
218945492dc3946bca85eacb1a05526b1a784f54

SHA256
4113809d7b6787b5607eafb4e5a204c0d3e656f575831c74f224dde1f41a1470

SHA512
e02c306b6db633491d82f4bb4865fded490451071900f06fdb604cc03acbf339fb2569f3f67f9689cc03e181ea68430eae45168826d9264dadc94b6ba1906a04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eee94573129f41486d0079ccdcbc16eb

SHA1
75c299706f99b96ff883b29536d5a844709f0a30

SHA256
c442f6aa4f2add261d3b03e32d5c575e5cbc6ec81fce542526d20524fbbf8169

SHA512
22e02f85af48cf75beaec248943459c4eaa2c1473d48191e88df4591a83e9f30523a595f7c4bb00e1fbdcc453faafdb6247e552970beb5c7f4b6490382529d97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bf1cf5244b67a0933ba7f862a27df37

SHA1
39b677f249aabf080743ab6af49f38e0d7aceab2

SHA256
427e0ebd82da47b72797f315047a33edf848f91c2d6b62de872dc2a0ab4f63f3

SHA512
66c26c295fdac75f5476626ac4d2f54237259982c05fe3a7cd4b7d985e9939830e95899d37b5751bca4a076e14e48d792d988634d8c4515865ec568210eb1598

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6661781664012668081b278d3ca7691

SHA1
3e8e7c5cf1d1dcc8faea80b25bbc0d844367270f

SHA256
054193f349cf4ccd84195b88ba27c3d26040e679894c112689b36691dbe73245

SHA512
73015a357511ff662cee0ccaf50f77788474d9052374d45ef995fc5e04b699d2e51de07734535149fbccf530dc09a41d13c947edc8d25ab1147b1ec9aa9fb717

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35cfc29e9835ed174a428a3a6aab88e5

SHA1
03cc2239a0be514b72c0bd9ecaa05b49c7aa7c24

SHA256
ee579374a9601546206461a8db195fa6b0b1e7558e54b6d55dec837ada8671e6

SHA512
09302fb0afdd46137bc7d1ec3ef76fbf8861056a520f06edd5757751f94f21de47a7fbc45d1eaecd88e6407f38d8f06a2d1beebda5ffab6c341bd1d7d22c3eec

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBCF9.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC566.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit