711ba5f037c43f0fe022a2ac961c10148a66efe6d89af6eb1d2740d937fac331

Analysis

max time kernel
119s
max time network
141s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 11:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d1dc4a49699aff375e517365364507a6_JaffaCakes118.html
Size

201KB
MD5

d1dc4a49699aff375e517365364507a6
SHA1

088dba21ca0887edbcbba57397464abc1abb82a7
SHA256

711ba5f037c43f0fe022a2ac961c10148a66efe6d89af6eb1d2740d937fac331
SHA512

f6ed6cd1bc4f4509b060985b25a556841bb812497d2429687ec1f7b08d4fea6d819488a9c9560f005dcff6990b14a5e3e602f69a08d6df186fa561feef3e3c77
SSDEEP

1536:ka2p2j8YM+UC1K0sd4raazdbXIiO9d6pV+tl7qSjzbGGGvM:d2obX3UB

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{098A3BF1-6D0F-11EF-8BDE-523A95B0E536} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431871555"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2856	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2856	iexplore.exe
2856	iexplore.exe
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2700	2856	iexplore.exe	30
PID 2856 wrote to memory of 2700	2856	iexplore.exe	30
PID 2856 wrote to memory of 2700	2856	iexplore.exe	30
PID 2856 wrote to memory of 2700	2856	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d1dc4a49699aff375e517365364507a6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2856 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7f631d2bb67b6f4176efe38bfaf4527

SHA1
46bd5a68979678c49d1f6869e75930f03da0fa87

SHA256
f1890b393e74a55c240e10ea371ffa8919f1d33e8bf0cb62865a99ccdc86008d

SHA512
1a56e8379fba41502f832c8f3569eb3f62d05ba5b3faea7b77b7f95568927349f6bb3c108a413c69d63d55d2a5dc8ca2df2c17c45a4c27203f043b4d9fd1b55d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29a9f35ed9ed6aad39be042ea4247817

SHA1
cc0e6521d63ea92ef661eab3d5abb5cccdaa57c0

SHA256
3373cf3885adc34526c1d1d6a66c03050cb2ae08e00b1a16c49111043158a8bf

SHA512
84c40d6dfbf48f11fdc24cc1ea5f5e5d7829e7425415740c2567a8efd93a0b8bde1acca6fef10408117912e0ebd2a7523a42ce5497f890459d14635c8110930c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ce6bcaf1bfa85b52872bbc29ccb0294

SHA1
9c6c04b8aa1a3e89e447a50246731b4d21a4eb7f

SHA256
a7404bc36ae41a7ab477af6ee443b25ea355516b51cb69372e964e488f17b1f9

SHA512
75574f75a9a8cee8ea335b87ae0c0dca2ea9b49156e5b6b2eebc09e8b28307bc89c05b1f48f8e48fc1bfd5e371dbc9393e4746cbae65675d115acc4336ebc3c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ea206e39aa5c350f38ffb2a46395fa9

SHA1
d08ba5e4623e77ffab81ea4c93edd2382b41f483

SHA256
e7537fb706a06dee91110b3acd7f41ab317caa27667984cd09757c58166310f3

SHA512
decaf539e762e0b877f2dc2631a29871bcfece0695b3dd4b473351f6ba3b52eb7bfd25f523b46170d14168efdf6bba380e0077b53f3dec90cb8ac56a54ff39fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9405583b4758e8e339bee1b7fba94a86

SHA1
fbfe01969930b73b51dcf8c34939ecb2a162d75b

SHA256
409826758e988deeb0269988675bbee83d05be13d754ce8324f49b47c0463b60

SHA512
f5e85bb3c4aa0f1f3b496b2d28657d3dd339c831b7f2ee66b22f670cc619051dff3d9799e6328a72242341193b19f3fc361f8ef90703339db9db06328fbc7b48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39eedbfc471f505e48f4b578cbbd9402

SHA1
41be654fd5a1949cd46f0d4e8c39e13b6107f5ef

SHA256
b04e36abf51a830a06781ebdf7aef39e618ae6051f4374b861af7e93b047b749

SHA512
40ce99950e9bdcd4dfc1efb240329b3c39635eacf0cf1e5835410217db588afb76152c03527defb2cc90c40b6a90f817d669064df0d3292c3734a88464d4231a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8b26bb8dcb034b2b4aa8a6710fe75cd

SHA1
7a11891ac7a527529b64febbedf3153f4040d37d

SHA256
c4cdfebd2682faa2a364a1e5046405c3c7219b7034333fe33bc505231ab61a98

SHA512
3c36f280d8061ed62dbd7170b8e6e3b82549e075513f058401887e4ee8528b08fd887bb41516665ddb28b82688d75bab620ebec31b452120ca38b5a9642e66b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef297f793343b3c93a9301856887de35

SHA1
05bf7e82cdc66eb49c269d7dc12b0b595ad63890

SHA256
08310fb882c647e5853827b258f90122161db56189c4002de7be91b8771c0a7b

SHA512
5e52a1b29027b39c995e3efc2eb42481e06c50a05c1fe226ec4b14f41044e76b846fdf32b36d55a70f7715d1b9a824da1da8109f89e0c92b6a4ee9e6ae5b10f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
faf2794853e5a113b71a2f2463829df5

SHA1
e5a8b90329a5d47be126047247233e8fd2699d18

SHA256
8c372eae70547b87932b5d99ecdd0d5932e153cced33db9cc332190f91938081

SHA512
ef8616109b2f739628fcd852e410b821b63b42a187d140a8f2f514110aac13c10fbe0bf4bf3f44e19d281567d614ed38017b1fe5766d537c9f4a3e294449d547

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7B68.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7B6A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit