657d938c6c826ef1225520c6e9afe8894b390f01cbe661124d19900c31ce66d3

Analysis

max time kernel
122s
max time network
134s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-09-2024 20:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d50c8de8700cd5dc4c9ad5b2aee48cfe_JaffaCakes118.html
Size

13KB
MD5

d50c8de8700cd5dc4c9ad5b2aee48cfe
SHA1

545fb86378af8b56efd22880e3efd8c1a8d9a840
SHA256

657d938c6c826ef1225520c6e9afe8894b390f01cbe661124d19900c31ce66d3
SHA512

5198033d23cb91a77f0477a898da6afd2febbd40c012a6f2f8bf0a5fd19c7d99017f728fdc6a9e9c5235474d63848b58d2b5692a5213ea24f285b1e6841d68e7
SSDEEP

192:VsP6TtRpUP+3Z5S1+vgBHoc1+71+R/pR9ryrsCvbHr1p3+FLh0Y17G1Uh:VsyTtvsE006HhW6VyICvzrbH6

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E8B6FD11-6E20-11EF-A0E3-4E0B11BE40FD} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431989182"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2692	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2692	iexplore.exe
2692	iexplore.exe
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2688	2692	iexplore.exe	30
PID 2692 wrote to memory of 2688	2692	iexplore.exe	30
PID 2692 wrote to memory of 2688	2692	iexplore.exe	30
PID 2692 wrote to memory of 2688	2692	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d50c8de8700cd5dc4c9ad5b2aee48cfe_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2692 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69c856425353cc0742665bf8da919a95

SHA1
addf6342ffe442544e054639efdbce07dfd1e6be

SHA256
66191d4c1ce5cbded9ed980e531023e3a23942a7d5ba3f198e45f5667cd6311c

SHA512
95fa476524912d96b09a3c3482ec4dd1296e2ea8e45f60197d0dab1b42525bb3cc8a2b3d2593c076ed6657544e8c6ec75d0522c687dbe462ef913d20bc5fca85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6336c695e2dccd18ab48d5040538ee0

SHA1
17dd9aecd27f6d4d97fa2e656d17301d7c87047b

SHA256
cb6421559cb39a8ee09e5d541be96170f584db3c9cf814a26936f65210f571f3

SHA512
44a7f27aeb25672b38979758871837cb5da3ce48701abd24c4c7d58ba5f6373e4c003d78ab3ac77a8474fb5ba92399f8762804b2447e850cb36dd1010173168f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51745d015884df9f0b7dab8d4a783d5d

SHA1
6bc0ddcb3b858f9f7bd0712281a41e6ebc384528

SHA256
948ca15498eb2ebe43075a38808e27d62cf4bdb978dc1e72b44cea4654bb6f7a

SHA512
25f6446c2859ec53001d3342470dad8ba8e02612ee5e5797db0d9e3bbb70b6fdfda89db644c04a7b9885e8a20803c6d29547caa69a12892872d87a6379933df9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0494bece003c2c7cf8b1c6e16657b4f

SHA1
6638753c738ee0d96541a4f0da5c1cfa6d1cdbb6

SHA256
9e3db72e06b0667fa4a30e638ca320ceba09c717877e48f39897e5faa431bc86

SHA512
36bff5ec00f0fdbd42a7e8cab7587de218f9db08ee8e6552d93b053e37f2a5056db7969688c5d44f021336c227100843acaf81c6df67c8dc4fbae3f408e25010

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22d61ebc869980c2245b625abe02ae5f

SHA1
350227eaf62f4e330bdb2c946d75b935e034b045

SHA256
122092da15e00a86ae7cc5c48a9d6d9a345003ce27048ead178a7efce6fd403c

SHA512
0933bc7dbb894316c6103063f4a88829792ba8959ce1b34ccbcf30ddc7291d83b156f4de73d388f919f67aab70c1ef913a1ab3d6701d1c1141b10a724b2a4e12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88e9ceaa73d87b501227dc46d696cb69

SHA1
006d5ee58f50c7de1f0a4319c8f69d5945443bb6

SHA256
049f1c76f52a97cdfff1df04b4da13c333e99f2b604ccabf0a7af827b33e8b02

SHA512
27e4a4238893658fc7633f0d3c4de6486659e678278675a8491ad924fa32517aad6e36918cb9e93e72f6ec4164ae880d388e618a74ea5abab729c555ff6e4896

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1dc3d847f8cc98e386bad37e9fafb05

SHA1
6f0c19f978690d8b563a8e9fbb115327770fa4f6

SHA256
6c6fcb407ef72e095a286178278040cb3fc2560da328fd2be61c52e2a2c1f1f3

SHA512
2b95d2c65ab58282a18c56162f74afb6adf4aa382b9bb9dbee4b7309900ec9fcce1cbdc09724117a8c465be0a9a7a5a201f72d078160dec01e916ba2237aa130

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f952b5486fee5505941d306af459bcd

SHA1
9dd88d30c85ee057c675db9745c6ee7cdc79e8bd

SHA256
8356d02d9a085377b05f05fa184e8e83b4a135c878a36af59a74d337c58243f9

SHA512
26ca03e66c001eb361e1290e2fd3b6e97261a99635b476344af677ad5b38e967719b2bf838b304340f4834ff848aedf4cc4654f2cd3c22d518198ae407c8e876

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e2367041a07483e9d05e066e4d04942

SHA1
9ca449887468c442ad4f84cddcfcf88043915866

SHA256
3743b78408f142a81b50f1a82cb81f48216a7f89faaca2e59f555a2902822750

SHA512
e17dcd26544ac246fa8e7cfa786f4070d20c0c19986fc08ec1de58c379b286591632624b045ab329a85eb175713d742bd92c7b24cfe56fbeacfa0b025887ba39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BQQODH7V\f[1].txt

Filesize
39KB

MD5
87589c438a13a514081c8a6065cf438e

SHA1
0232902ae6526adf4822a40b0d5cd2c1949e4708

SHA256
ddee4df85256edd5f22a70f1692ade0f06d129fea8dd6d539be46ddfd8dd7a91

SHA512
123c5af5d99ebb96201364f7f207e550f4dfe364761f0e5162c93747d83fc6c831262876328435bea39eca4188cfcd9fc37a0b8a992b33f8ae0691b4b39a3639

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF152.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF154.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit