725b2f43549a9d05f136a14c1a1c2f06e74070b2c9b26acca1e687bf7092c04f

Analysis

max time kernel
135s
max time network
144s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 05:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

049544f0ca2751074dc20221e8dcffae_JaffaCakes118.html
Size

142KB
MD5

049544f0ca2751074dc20221e8dcffae
SHA1

b604d656188680eb62f24fe328235c0208a114ad
SHA256

725b2f43549a9d05f136a14c1a1c2f06e74070b2c9b26acca1e687bf7092c04f
SHA512

fcd3e95fd924c033912490a510ebe621fbb6f3acb1dfce11967c7bcce30e323c56c7b910c6ed8c895661368c867e8be0a9180a6a1c0cea3a944afd7bd8ee06cc
SSDEEP

1536:SmcaBk/eCGx76vuyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJA:SDeLx7dyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433923586"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CE459781-7FB8-11EF-AF9A-46D787DB8171} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1820	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1820	iexplore.exe
1820	iexplore.exe
2068	IEXPLORE.EXE
2068	IEXPLORE.EXE
2068	IEXPLORE.EXE
2068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 2068	1820	iexplore.exe	30
PID 1820 wrote to memory of 2068	1820	iexplore.exe	30
PID 1820 wrote to memory of 2068	1820	iexplore.exe	30
PID 1820 wrote to memory of 2068	1820	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\049544f0ca2751074dc20221e8dcffae_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1820 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2fd529791fbca1c399ed2d4422b08efc

SHA1
62ec83643e8f632219365a0d3991e29e3eef10e3

SHA256
4450951f9246c71f952788a92aa8aeed7eb6df2bd32e5b2af412c9130edbb189

SHA512
3c2f474b502010be496fe26a0e5df7545445f4998293a07ca402748b805979b9fb4040fedc503e1ce968f6b3e9c310869c86aa1b8ef172cd1fb6a04211b7f2ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7fa756ba9ec73800992aeedf6f79a5b

SHA1
41f8b1d08b24017d9b6e4fb2f07d943b59604d69

SHA256
ce45a1588f06568e3d17067b3ad5268a471c5aed353d460323b77d1ed93d3d09

SHA512
1a96fbb5d12cfd398d7cc82dc27f7ffbfe85127797ba1d4c9623d7da3402154cca193ebf150ab5c697c3c50f535e313d639ab42da8486b1ec55b2d72f3feb38f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc94759a1a833cbcd851fc4f007df271

SHA1
9f4e08d7e8ea4102a73ea09070311750a0e7da6b

SHA256
8d247fd34b2f799312ee0d653420125aa969d1e130fabd51881ba547b72a1436

SHA512
431616b98044bea3e5a3870f46e878c1af30d45057a54f5c7026fd0170b3663ceb6c0470ed0e16c22060076ea2094643f19618936b90c0e485e6d1acf9e66665

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4f65d3903e0effc9187b203c86d7115

SHA1
96d8c89335dc141b47f94b64626feb16ec8b7b7c

SHA256
b24c0eed64dd676d5d03dcdf96652c881682fc098be1496c2c93e8973a08ef09

SHA512
7d905e2b35e569395404306e862959957e2ec7a4457a1e9630d3a181f681a0d5f9d6025259c7d3eb3c391b50f6b70bbb19706afd63889e5d67eab367693451e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aff609f32514a4ee580c7c1e0e943c7b

SHA1
745425b4fa290ab96282d0ca05cd0948ef569b76

SHA256
1f2a4d4de3ff6ddd8b665fef1b73b563d28970e0720e7828c42fd2b3d4a5d0ce

SHA512
af41b425f5de311629b9d3cce5c45cdc13e6653fbf172ac80a1371a9bcd37ea893d0d2113b3db01688e3c16e4d976906a92c673715ad4cb9aaf1aa3c4beffa3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d93f2f28e25b03d4a41a4a611dfa48a6

SHA1
72b50d0e9ad4255a10301618e4e8bc058c098126

SHA256
3039446a0dfd8ded668667b4b635298503a18d79b3d21fcd3f785b28ebe978a6

SHA512
bf358c42054c0851119db9ae19247b114b868a29d8d531a5de82920caa7d53781ef045abb87964ab480fe6c184a63e03c8c39556e3ca743bc307b96b34cbcfd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae2fd6a01075e60c5d0494cd6970feb1

SHA1
3079708ab105a2a7b55511aecba1226eea127471

SHA256
c25d804c3e8df405dc1efbbf5acce5ca48bd39215e231eefa7d86fd9afd9e449

SHA512
1a458ac40ce98ddf762d449d94a3393cff0ac198f6eb8e9b4bb6f925ab5f0bc7fa3457e99bb835d28177ec85e44c006d9ae98855faf30f2eab22bc9dcaf690ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c3ecdc6bb421538dc050742d57b0a7c

SHA1
51f9db75b9a8bdbb8f06cd343a3510a1ddc913e9

SHA256
0691038b85ccd6592b2f1e5324e7dd78e0e7081a6366b5b7c071d51423888e18

SHA512
01d6e5477ba363bba72ae2a95f46e16782d9380bc6899ee1ea15612677af2bd1b86ab75753329d0505c2c6649a68955ab771f21049085d788ff3f4f3f24b88fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ad15b12991e678a156a31b66d65e0f2

SHA1
d97b8d87ea330a91ce053e316821c4efaedef7c7

SHA256
811237930d1839b24ce9d1c99d15f66ca6882d8527d931b66773db311e84c41f

SHA512
d67ba639612476809c4d5c260eeec84330cf689008b0547f9a20ee42786827eb460ed6526d2a1b779cdcc118680e1f5aa5ab19977db47dc3ce1dba736a6f3270

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAD30.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarADD1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit