7f760cc9d98804b5479fda9b38fe45728830b4238d500d63ccbe9473aa9eb9ff

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
06-09-2024 12:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf8ee5b414beff5228cee5538e818612_JaffaCakes118.html
Size

27KB
MD5

cf8ee5b414beff5228cee5538e818612
SHA1

4e30871fd464c357a7f4d39a238ca3b96f9931f7
SHA256

7f760cc9d98804b5479fda9b38fe45728830b4238d500d63ccbe9473aa9eb9ff
SHA512

21853c879643eb50fc2b537d1b74d8d108cad24d648d0ad6be441273cf57d884259934f258d414b7ab3cd27a90fb75dfc5b6d9c451769e511444c60fe74d1886
SSDEEP

192:SIqRcEZXnhh9y8b0X/JKvkjoQo8ofoRoGuWuFotIy8GA6a6UiipVakht:SIqFp/W/JKjfjgqGxv8G4ht

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431788498"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AAAF9511-6C4D-11EF-AAD0-E29800E22076} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2688	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2688	iexplore.exe
2688	iexplore.exe
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2944	2688	iexplore.exe	30
PID 2688 wrote to memory of 2944	2688	iexplore.exe	30
PID 2688 wrote to memory of 2944	2688	iexplore.exe	30
PID 2688 wrote to memory of 2944	2688	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cf8ee5b414beff5228cee5538e818612_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2688 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30391ab3190d6a706d6587054c8d4e03

SHA1
1937c00b9c86739b48ebff424d0037d4026b439c

SHA256
eb548fd48520b9c8eb190e27ff3b1ad31c37786c5992c5f803ac71afbdfb8a06

SHA512
c6f773b974b664eec13aef76116a7281e0329408b876e5a9767bfb86029f07485e1b9c34ab1b79586a278d0b84acb2b8e25e4998ce35b5bec0576ba835b9a567

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9114029e45758aa56b88d22423bde3c7

SHA1
eddf4a8e9f7df4bec8e77060b33fd332054cba23

SHA256
1ee689377490928feeb9fc353adf4b609c2c2da32fb34da28c9a01639f734275

SHA512
6368903c69b9321fc9e1e017e2f2e3cb340d419ae275dfc786f7e65063521f580d0b513d7efd8a444a17182a87a24540f56a3a0f4977f5bf173d412396ba2f72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13508670b699b72677bcc97a4be66b3c

SHA1
78288d8edd69184c0ca3fbe1957f58a6a04706e7

SHA256
61843f01b8688bca80261de2dfc3f972bafdd92033f2f33298b11dd31ba31308

SHA512
8f68af30cf79a2428a35f29755222a6718b4029fcc242af9e3a7461b2f5fa281526f06c4c3a9b5a6381dcb6421677104a229a9b458ca0870a5af1d2b25afbe09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
909259f74e1cee7a0a93815dedc74986

SHA1
c25f1065784ee418e2830a55b6fea06a01fc69c8

SHA256
f46db0059c9801ccee11009bd70d4013d605f172d9f1c43ca4102feb2da34016

SHA512
01b61736a77c4929eaba896834c427348f2e4919472b49b9d3ecfe65d0d34734f710db10bc5be96db421f3b3f9c0f05606fc70a0dc9597e0203277aca708a9c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
414e7cc68cafd16887b423b3ad9b3bfc

SHA1
683985408f05c2c8e36100ac44f3f7fa97b2a6af

SHA256
57f36c8fc04843d4b836885e2a7386776870f0076f61b156c2ebcb7d8d934b94

SHA512
306fea38b6a10b8604a316a91f65b3673df198f5c17db131c6cbc6d81856fd96628f0f80eb7face077f6fb1457a342c682b1aa6f2efe4ea433be7842c739f2c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38abdbb85fcaa5bce730656d7823701c

SHA1
9e0d81b64cb3e5ac7e9c5609e511cf871324b67c

SHA256
c16cc170531dd1f4e2946108b825d90516959c7bf4d7228022601bec72701cdb

SHA512
5a20812467a183ac636e7c5fd17a1685d9e4ed4db2a83de1895a229e5e8cbe2ef80ea7ed907749f72fb51d1668b96c8fcbe33295d3050ff909eee03084047388

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76d287b85f7e0009fc16fcd05c8f1109

SHA1
311b5044b431cf899d3d8a3205d158ccff96c26e

SHA256
f1fd3afc230b231cf6b97556858c7ac634955271cd0ddf7d0ebf4e98c717e7fc

SHA512
9e3cc292fa733257f3a584512c6aa3d1da991fe982ec7a7c5baa12f9368adbd380e0f1193af905e4b39c3fa729b92222283b4633d3e9dcdc6fdd81e984add584

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b83666e4e8dc0a08e4289b6b57096b9

SHA1
6eeda36b18f178b22273bf402c5cc0a02379be8f

SHA256
ea32749de57004460c71af707dcf0b2b2363a993e01f062ac31b2293e5730343

SHA512
c7eb00deddc0fdfde9c02d6534f9f4eae559a5aae66f3dfe12efa8822cf5f72656d235f57652e62696b1fad82e6c986262a0b312e43dd53070522fbb0dd7ffe7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c516fbea5319bd4f5552b7bdf7d4ec76

SHA1
de810d4321fd25df8dcf5f1fd1586787aaf92c28

SHA256
4a5afd32fbde067c1eb995b858a6069a7cdc0283efc4cfe6266ec2ce0fb75eef

SHA512
575955d4332e1a33cad9c8e9efa5c561c4b516ad104c9965f3debafc1ed16254764bd19c273b1b9a3a32b1e287a53cc4ea59321374c1df7ff561c4ddc8364899

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF2BA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF378.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit