716323399cb3072cab70f4ae5b3d2543744756ffd4b888de93c8a031e3163dc1

Analysis

max time kernel
131s
max time network
140s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 15:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc7a284b5f112f6ee0692989972f7ff6_JaffaCakes118.html
Size

19KB
MD5

dc7a284b5f112f6ee0692989972f7ff6
SHA1

d927e1a4d2c1acd7e85323d371ca80decc9cb98e
SHA256

716323399cb3072cab70f4ae5b3d2543744756ffd4b888de93c8a031e3163dc1
SHA512

13412040964c6dcdb1899f6c704e2a46b6a6e352541b7807022e753aebc530bd1a78f5566f832bbd5e3e6ea102b90abd6e5a0657cf9e46c008fda6d5ca11dc07
SSDEEP

384:SIMd0I5nvHkmKKA+000yMzKRjsvqTSWxDB8:SEnmKKA+000yMzKRjpuWA

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432315323"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{46CEABB1-7118-11EF-854E-7ED3796B1EC0} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1668	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1668	iexplore.exe
1668	iexplore.exe
1048	IEXPLORE.EXE
1048	IEXPLORE.EXE
1048	IEXPLORE.EXE
1048	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1048	1668	iexplore.exe	31
PID 1668 wrote to memory of 1048	1668	iexplore.exe	31
PID 1668 wrote to memory of 1048	1668	iexplore.exe	31
PID 1668 wrote to memory of 1048	1668	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dc7a284b5f112f6ee0692989972f7ff6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1668 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4984e53f7d6889f54a8e8e5b40323701

SHA1
5a50c0cd2af7178a4564350176e45e19ee1cd67a

SHA256
11d510b27d853a977f4b315f2be4877f1bab7dd4f7b435ccfcd4b12f0d1d6bfc

SHA512
a001a1d1a097366f37de51954dde0c934476f2e139c169c53d7613671b427ce9876896bded4061fe7c864b5a7fbf70c865fa4576492a5da60bc46cbd26500e64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4cdf74a28efd437dc3c2852be7d50a4e

SHA1
11326276958014bc071cf58d071833ebd956248c

SHA256
5a8fc7dece55ef9685b5a487f0c1cfb8b74c754a8f8d556a4b20a6ef3898ba89

SHA512
47cd5f6720d95e1280a1e0861a39e2130fc2e8d777d464703dd278497e8fd4aa03f9a921e56b6b0b2001c1b3797c108fdf98d1d0522ea792a5be2fcfd4feee5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
719f4b791f8df6cecd1b6ee22614e222

SHA1
f5bbf86d2616899a3b6438cd18b6966156896678

SHA256
6b13b1fb7e917469e66026b5ed870ec1143ae5c10f8328cb74f881cfe84e30a5

SHA512
7340ea6685d7f6012eba462562ee2ea2798c9dffd2c9b1d53ef79a6d0d56bb7c6567093b0ee66eb3ffc691c31fd40f50f6319982360ed41269d79df3631a50b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ed82a85a13856db249b054228aec731

SHA1
00a5f1fe6d9c0f11d2a9328b2ab1cd65c2fa61bc

SHA256
c034b4b2ea781bc11f58122c0b64093d7d8b59aa7b500d5548922a168a387a65

SHA512
827ce7c053e69686c7f914d632e278d36f1660a07d6964237d69e9bf49467f40908db531c6214a69a50ba7c368138f579774c7b30ea603982c34d2842e6bb6af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
082a8676ae7db9c9d89f38fcc154a0c1

SHA1
5e9f9634aff6a2799ec7c4184768db9257c286cd

SHA256
66c8d2d79e6135be8d2dc33c35b509b7edca5b0bf442b97905b1c4957d480be3

SHA512
b129389b7195951c958cb39bc89612854f3beb70f49e61a1e9467e284324c32f6129e026ddc81d6a52a08965e2d7a8f0092aae67092fa06b908b11d6ab7def34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98a85ec71db4299cda5902ee30e328f9

SHA1
9a9fc63b3e190980c482a5255fc45accf552424c

SHA256
f46a526cd537b81a1ce4abf77d012edf8562d71fecd6188bce0355b97640e574

SHA512
5adfdd56d5ddd5b2f053ca6a85f634518a8d0e1c34b245f5dcec3f3572702930438dd68789a6144452aef992d6382a70dd48865e4e129bfb77326a4ab862ede8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ff072ba42037eb733e58fa845f0b08f

SHA1
d02034abae630391c778ddbd6da52903e516d29f

SHA256
9f32fbc00a20a1332837613f95f2fc2512fa86a162b5fbb3fbbfb17847058de2

SHA512
e1b614c1c9836dab97b947abb0f14c283331f0ae5bba718409e816a145da1c0c232e20e40ca88d39b0fbd389d54277e1daecbafac8c7a30367c8a7a8c1c78570

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5192913fcd5f6a0a69e862c76de4b0c

SHA1
252ab8ed6c1a2bd0008a4ab9a7f17496e6d27774

SHA256
6ea8b70f5b2e96c8ec40e88ff9a0daa143c4e7aa4586e840eb76397d5876f2b5

SHA512
8e69348f95101f486c539984a48b4de9c691a15b67e6358dca17bb2ae625432fabfb3c9f2c5c330281e9ada97a1aae53338096d2c7c96ec5014eaece50fd85e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc564d3d67073b8ce18a7bad548a0926

SHA1
3940dbe38422f23d4f261dc68309220564cc8028

SHA256
dc937248e643f6e4f90f26bd7e9f40a2107ea80a3c716f5e69759de40b5597c1

SHA512
bbf077b6a88ea991245841f4c93bb538641c41b7b24823b5845c07125f332fc7c45782e97c7a3a2832a41254719844a883ed87b9a3ab93f462c311dc9f0f2ff9

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCF71.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD030.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit