1dd2f2e6a3fe0b5f8ca8d144121ee4798c728b30a78ca09d075b17012d0ce83d

Analysis

max time kernel
132s
max time network
144s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-09-2024 15:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc8a959ebf8d03b494a1c0b0e8ef9361_JaffaCakes118.html
Size

124KB
MD5

dc8a959ebf8d03b494a1c0b0e8ef9361
SHA1

4821f040141b844b65336f8273cf86229db67cc4
SHA256

1dd2f2e6a3fe0b5f8ca8d144121ee4798c728b30a78ca09d075b17012d0ce83d
SHA512

0d917209500716f9531fb6d7e164b9ba163c8154130c3f1c2c793b4307bfcce6b660d60db1995a54ebf852c5b743373ed46cf9a04c9266feee18d893fed18dbb
SSDEEP

3072:m/xPvTKmE08Ety0wV0WSTIJVl4GJcfbJYKnseqM4tB3LSUE7Va81U1sTkromeMDD:7mE08EtyfVyMSGylApLSUE7Va81U1sTg

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3750D2C1-711E-11EF-A6F8-EAF933E40231} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432317873"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2012	iexplore.exe
2012	iexplore.exe
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE
2632	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2632	2012	iexplore.exe	31
PID 2012 wrote to memory of 2632	2012	iexplore.exe	31
PID 2012 wrote to memory of 2632	2012	iexplore.exe	31
PID 2012 wrote to memory of 2632	2012	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dc8a959ebf8d03b494a1c0b0e8ef9361_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6fffc9a165134a8f516fce52b6dc337e

SHA1
cd22561512c9002aa16c8b91563de71f433ecf04

SHA256
4fc8c0f00b6dd7b06938981cdf6a648788b40690e6bb27aa63e1d91a108b34b7

SHA512
8ccae4ccca53e02e46a9844392acdcdd6aae32ec1f694ff710b87389beaf87994c1028168f8771dd18c19d38f55f0ed2ff76a6b6143bffe030fccc68c812725c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7281c27df4f04856da36663d5c58d27

SHA1
733426178d804149f8f888dae9f7f7e27c153196

SHA256
daf6f43117e1d7d79978f051a82472900f246be7f0d17763ae8947a80af0975d

SHA512
898d6b5cccb5eeb60631901dabcc3bb4795e287b6b095ad3be5fcb63eab3e08e96610320d262a5007a74c0e2c4d5e8310cbc0c6b29e6f43d8c3183a3a3508587

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f731b1782cbcc5a958744e8e4ef9478e

SHA1
66185c746a5ca614d90eb82833227e2fb57f507a

SHA256
1d4cfa8648545d3a354b266a3d26b1f88acd10c8c48ad5872a5adc11469a9bcc

SHA512
555df32a4e6ab964480a0e72a0bb6c3ba84f7349d0e01fded777233db1efcf9b2e7da4aa55f350a8548345b12c07187bbff69ee9930b2419632224a819061371

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
890ec19ac2398e5deca673448dc53b96

SHA1
07752f5affc120ccf171fef72a297e35de27db86

SHA256
d23c7300e0561c6236b00aaa96a7c4c6d9729e86ef7d44811fc8f110615cb3f7

SHA512
3338c8c1f94eb5984cbba48cb5baa3f4738769b3fdd1da54bd671487a64c40e78ef686a91c1320ffbf291de73a26c0dded89235138f355b46f15e4271e5ebaba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6644680e23e89baa23de1b91253bc15

SHA1
8d56ed2eef6d1fa9f58984abd863b6e6d92f95dd

SHA256
c5ee849822c68a2ad6410e089c46426e67a54f593313574a31358c1bc212cd0f

SHA512
9f9e8446fe1881b723944015c1044b4411ff1c0048adfcd40ada2835c190fc58d2858daf1fbe140aac8f3743db03a926e900d66272e2bcf3aee8bc7c8e70381a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c12d151f3d0e51c4ef232171ae27dba3

SHA1
dec226d5d662a278f9e3d548c9a2e41dc54867f4

SHA256
3ecf220671efd26d5b7d55c159f9faa0bddd7c3480fee3f92c8f634d7592afe5

SHA512
f1c0d22cabffebd35cd5d5e54393f4e157f0c271e7fa146090f28880cd2783253e8c98484134f69864df0cb8165f1917bf1f34339ba9eb87ce4490c87549a303

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef4c5ec8b4322b27cb4b4883d56ce423

SHA1
95a68c2786003d7b0ca6d8205e6d2d8ba237d12d

SHA256
f196d58f3b1140b31148047e82fb32b503c6269696ce13ddfc2fe9eeb998333a

SHA512
b46aba29d17e766348a1972b20c949853916ff8bd817631f99131bad1ca007a338d4732f2bcd02b7cc6f209097315d2e49dce08adde5adccb6f194aacab6c92c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96360ef3d229c27c878771a57816f6bc

SHA1
10260a54236ccc15f89256088fdd44c353a9fcc6

SHA256
4cfb98c43ef2e47597c5775099ba1321cdf6fbad7c818d499f275a1d418a1da4

SHA512
bd161fe388b9ecae2fd753af8a4bf995afb96d7b7013ddb4ed7a1c87bdf77e01336ba97f336f3005446ac9541524a606341a9f081eef82497f5755d635262a9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8555b24b09f256e393188c86c865752f

SHA1
8460fc7304bc1dc58cdeef8b405d0fe777860789

SHA256
3ae3f7f129c2ed1fc581cc21cc458da5752774009a25125f7087d721fb5d27c7

SHA512
016bbbf95cf9558546b218e009090843271ef7e8c5757a3bf5d885d3f486ba7bac18bb4c6f02fc405bafb58ee083752ce380d7344c1c75b6a77d4efed184ba1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e725f240bd2a3bd27971ac91b8f1c11

SHA1
10eed2531b2b07116b706d7bf76b179a2161395a

SHA256
f0035bb98a3edb18036da498e64703414b504464b95e57c8f1c065dd75dbb00e

SHA512
f6296ca49118baf565d53bf908fe0599d1d44c32974cf7aa74e17af872b0523d7201792fc69099f359cf11b813a53df251bfde53ace4e701be971824345cf83c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2149117bc94713c41b00f1fd9fa07f1d

SHA1
ca1780643aad1744ae0e7a0c07b615377fe54e2a

SHA256
1a19fc6844541f8d9876abe2cd1d7cd62af9e711c871f8f13c2541d87061af4a

SHA512
346071885a9093c8fa7e2b37c38788257481c5a493744761625b7acb1e3708cce1ebbd33f532ff65421fd5f03080a2c8527258b91780a20caacf66ae1b7b292b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE535.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE536.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit