df9c8ff08f37f29b6f9144be8b1682d74d3a9144dbc64964f4b8144098bb3e24

Analysis

max time kernel
146s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-09-2024 21:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d075929f4a4f01060bdbecdf6758c92c_JaffaCakes118.html
Size

142KB
MD5

d075929f4a4f01060bdbecdf6758c92c
SHA1

6bb1ea9f33ac2818117674e24bddfa4e7641c5a4
SHA256

df9c8ff08f37f29b6f9144be8b1682d74d3a9144dbc64964f4b8144098bb3e24
SHA512

7e767ac5ba24832e64b47a8adbf24673baee2be48a3714afc4f80ec4ec6900ac074468d0b63ddc21b59be0946913a1ebf49eaf92f1b836ece1b2160cb2518eed
SSDEEP

3072:SYHF2E2x7dyfkMY+BES09JXAnyrZalI+YQ:SYHF2E2x7osMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{671E66E1-6C94-11EF-B1BD-EAF82BEC9AF0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431818882"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2060	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2060	iexplore.exe
2060	iexplore.exe
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2368	2060	iexplore.exe	30
PID 2060 wrote to memory of 2368	2060	iexplore.exe	30
PID 2060 wrote to memory of 2368	2060	iexplore.exe	30
PID 2060 wrote to memory of 2368	2060	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d075929f4a4f01060bdbecdf6758c92c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2060 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9fba6e187cbcf9587a4bbaf38627d823

SHA1
48b6484fcaae2c6e2ecf67badfc15c074c3e1784

SHA256
d0bc0e7d806d9cd8ad18d0d3ca1f490fb77e1a5890c6cbdcca20baff5e36568a

SHA512
b71638e661e3659911ec5ee1187d01d7f7d1b7c9b10b441c442e059f03874adfc7a957d361d82362ffb816b07e11b83211c6cc2d8a38fad524ccfecce8ae69a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b81cfe3e1ded8f53b94eb971608b1234

SHA1
3a9e916b5634044c74a866c1133e16cbe837e73a

SHA256
ada144e6bbd305a0e706543fb99a329292a64a24f540124a56a67386dcb3bd07

SHA512
29f759f8f6efec6c40b9a9a6875ce31ba30fc0b9ba98585b04516962e07aeafae60197e50c11c3805051b056f7f17a97091595010152ba4170a1d1ce242c9f4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff52ec23f61206d11c694dde552f531b

SHA1
4f2fa70d1c67bbfefb552f8dd21cfbbba99b1929

SHA256
cbd0fb6a247b9b96c69dabdabbef528865693d4ea75bb7753fd130eddbfc8d0a

SHA512
ba90478e7dee68599aaeac13e561c5c9c259c51686f9f0a6e119def71903a24f28edc05d6f49ae7b95c3906cc73db092258b9b9a1d52efb24b773ff9863b5a0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1af3022b455c1a7870577a195a094a66

SHA1
8ccd861ccde79725a8fb569d922f84c85e85c700

SHA256
5eee2580afb37fb3793f271f522b006fcc54fe3972715e657bf2ea9396ab7b66

SHA512
1325671feff8b8395212bba5bc22d838018963b26d3a53ed76164ab92492d9cda3c67f7373c76589a43802c25985b524b96a281cad3b9d1713996c33a0ae11dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31a55a3a68427cad15be31e009367548

SHA1
87c54b6cc59b2552d86aa8c73f787b400a91572e

SHA256
7413c5702185a98a124cef7028d4ba78a8e61628ab5a6da9892936bd42da4b1c

SHA512
66bd86675ab69c462f123552e63adb27c0220ea3ac2a74674ebc42fa146471e1defc3e58d1c8eedbae597c29e66e38efc9c88f010493acb8e423ada017f9ed04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
acaf186dacaf0da1e72d67ae4b8f25c3

SHA1
aa0bf147499f153cb4aee0d7468393c6b739bc3a

SHA256
49e934b2ee19748e4dcfa00d3b39f87f987f5d5af4584baae5b27eead0799863

SHA512
bdb1e89861624b92bae839c00b82c0b2185853859d5f1844daca7f0c13acf99a27c965bf260cfc72a073d90ca15b4deb63fd8e5ad984eb23ade8f1ffbacfb7c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
092c2e62787a20a3bfb180e0af5f2452

SHA1
1d749aaa611eddfba0ad3d8f4a930ad42bdf183c

SHA256
cd9f5cdfcf6f5c875cc9a16132791c7c77af0f04f99f6dfdfe9eb9c95c76ef98

SHA512
fb54b77dba663ea09c203046227b7a914ff01205aa4fe23c9b615841052acef29dd30f2bce3f16bfb3b53a4fecbbf203f48b522e1396ce29369eb9a56cd1c862

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cfc144cda2007cfd1cc94d06b635dd98

SHA1
81af5e089e7a3a921d385f9220662c4289573e19

SHA256
cbda904b2d4aecc9cc74206a8ac448a6d6fa5620f25afeb1a4b892a6506270b1

SHA512
286e9195d1e7e7f09fb24e55e7083276af9ca658a20d689113cfd89f90153fc223a191620d6c940d5453a91072205a3465102be9c0ef41b3659593e08284a167

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e93917caafa9e024ee9ca7d9cda0f57

SHA1
3aa42cf2e1391bdbf580f42efdd171fc1534a257

SHA256
9c9163ba1148ca8ba97f54618414679be6e50bfa5887f7469a47461083ed2ea8

SHA512
81c8b75212aa41364a8bd84e98d8d3a17619900f2b6520f08d4cc81269add86a7197fb3f81e0def38b0dd225a6869483967b2f1c5250ac0e4f821f6e5904d1ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAB6C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAC0D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit