91854a1d58a5ec617066faf5078aa7bd64bd9ae0c73b375076ef4d4c37b0054c

Analysis

max time kernel
117s
max time network
133s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 09:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf31a95334a26e3b2613e63bb9529ccf_JaffaCakes118.html
Size

11KB
MD5

cf31a95334a26e3b2613e63bb9529ccf
SHA1

3c8491ef09d974e162b6c74789d2faca166ca62f
SHA256

91854a1d58a5ec617066faf5078aa7bd64bd9ae0c73b375076ef4d4c37b0054c
SHA512

77873c1b8a39aaaf2b483e63e866bb07955f8694f79efe1fb2b1bf43e061755c121f0ab561af6e235b589d09cfe9b0651f7c0e6eda78fbcf7bf01e751f6799cf
SSDEEP

192:2ValIsr0r57M4axarT8Ii/w1wvqVkt13auBuLbdU8d:salIcIQ4axazi/g83aguLZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0E2330C1-6C30-11EF-81BB-F2BBDB1F0DCB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431775779"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2532	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2532	iexplore.exe
2532	iexplore.exe
1944	IEXPLORE.EXE
1944	IEXPLORE.EXE
1944	IEXPLORE.EXE
1944	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 1944	2532	iexplore.exe	31
PID 2532 wrote to memory of 1944	2532	iexplore.exe	31
PID 2532 wrote to memory of 1944	2532	iexplore.exe	31
PID 2532 wrote to memory of 1944	2532	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cf31a95334a26e3b2613e63bb9529ccf_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2532 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff1ce994870805f241d212f9fc18983b

SHA1
bfe27c81eb6724a83024420c665ea2067a38ddb5

SHA256
6f612d1eba31244976ff08c2efc5b10e0a856834f4d1d77680b202632a2f0cc0

SHA512
4cfafde69af7f79a7333337d41d2d5a55bb6c71f4e13598a10f287792f0c12350cf5ab9a5d081c43b9bfa3fc9f99b742dc4dcd8ad1f8e78c937a679061752c5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
160cadb71bf9fdb20c0e942fecb403a3

SHA1
65f8cbe7d41d3278c0892b095f9d98e27c0a7974

SHA256
bb82e03d0c4f52eb93f1767fd85a055aedb03196910e30fdce841e85775cf19c

SHA512
2728063d40c51f1f46982030dd621a4d812cfc894648c67a6870adb777b8058328cfa7dfdc58ac506c04e0cb71d9c87274cdfaf27218bc55d861c1adcc29e609

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7a13f5e84ad327b09e8256398671a92

SHA1
73f193e04190478abc218370b2ddc0d7c0a4f417

SHA256
ab724529aaeb6ada8f2f5070189f2ca25d9457fb579ba0f6b7e9c562f37990b7

SHA512
4e4526f836fdfa13209bc70dd703dd15829d9765ca8d36e021763ed264149a1cebf8d0da601ff649d0385fe2265eaee308a38536afa394ba6454f0952a401461

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
297e2a8667a28d76af979fbf3a516ffc

SHA1
12bf12a38160d4020544a2f63b4abd9a9fc61292

SHA256
8b651641ad6d6c0fced1ad4f4be5a959174d3205dd79e6b466cd568783f39d8d

SHA512
f0c291c9da93570b34fe0dfb292a3cb1bcfb314c0f114ad19f5f33fbee759ef8ff850a775423e6853037d2867a2a07edcb45957c76e409a673cd1c66cc2f09ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c56c64a2d59c94d33e77d985f5e38e58

SHA1
64e6c7f2fcd860767b43d9b875dcc7ca525ed93c

SHA256
45c77a13c44d1d288aa5a15d31812da951717f4dc58300559ac7c0f274a0a39d

SHA512
41cb390024b7d4ea28b149b62b456277fb434d3e2bce3ac6123b6529edf9a82f9adf98c9f89094eac867d96d3981100d40237f6866f6c6cf5ba0fc246907b922

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4cdf3d77824eed9dff9615b961f62565

SHA1
8f23020cc3acf72750f5b3aff6ed72c6bbbc73b7

SHA256
206869fbc186af7b70138e8bcb24886ae9dff759f069a5401c8478d0a19570cb

SHA512
a22d7256b67e151c6dd472874b0da21b4075593bb4e8d2eeca04dc4c749fa379242d1da3345b9caa1a6332dcc2b59c6c156d7c2a8d8d78ca5dbd582e24c036cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2474180e712047b4d2470f619dc8d50

SHA1
91f4313d536613cd9fa7ac13719c6d1314c95a6e

SHA256
976c24582d4d72dcb0757510d4bf9c8719aa6997d10df40636c32ad94e89b955

SHA512
4f9623bbb97b9ed724e9b1d469e270088dbbd5d29fef6b7dea59ae548088d797aed8c94a16b87a1288832202ee8e7f2cef73ea5df7f69e54d4ff0e1c41a0754a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d18d903b3eb41039f5384ab30bf3479

SHA1
71d735bf6717619d990d4276a34f0ad7bfce21bc

SHA256
0017b3a2a891309d1dc313439b2770ec28f888c0830512892f728492f000fefd

SHA512
c6bfc3bfab0d5933ac5c6e2b921ac492b0b1a80b1474dbd8262c918385cf69eefc6caed82de572f1331c22ccfe84abaf1a5cb6d5cdee76f364655ca8c3b18c6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ed8f7b77e8c11d818d7e2485be1065f

SHA1
8c99c2fa4d55d14fc0c4315c7b9c3899d42df0bc

SHA256
f7f461012017a076b372cce7677c4c261a1c21804c3ae386b9d5e74a3ab12c4d

SHA512
25e72700ce823b5a37d15ba769ac74e22e12d5c9ceccb3d2a3f1efc1815930910e2ccb6f230fc1a43bd35a4058229d3233c36cfdf94eae15627d411a2e04992e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCE59.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCEC9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit