49878af1c4b87ba9b47ef81615546dc30d0b35b9ec86ee6b8ab88759adb69dbd

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-10-2024 14:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f35612909cf793e5cf0cfb10e8d7100_JaffaCakes118.html
Size

34KB
MD5

0f35612909cf793e5cf0cfb10e8d7100
SHA1

416d00bc0021765c35269ce6d95839acccf47084
SHA256

49878af1c4b87ba9b47ef81615546dc30d0b35b9ec86ee6b8ab88759adb69dbd
SHA512

815732bd1eec8ceac5225f58852bcf991bc1fdcd47f3ddd4b185da1e72204e7eba52ad7b054a2d7a19eebc435553bd300c71c0f7be9abcde9817cbc38d889f2d
SSDEEP

768:AyhoNl4gN8guwpjgwkPcaBbB3UQa2y27KCZBQ+O/965lZMXRMtk+GMI2R2zbLihD:ffOFG

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F20D70A1-8195-11EF-A51B-E61828AB23DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434128516"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2672	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2672	iexplore.exe
2672	iexplore.exe
988	IEXPLORE.EXE
988	IEXPLORE.EXE
988	IEXPLORE.EXE
988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 988	2672	iexplore.exe	31
PID 2672 wrote to memory of 988	2672	iexplore.exe	31
PID 2672 wrote to memory of 988	2672	iexplore.exe	31
PID 2672 wrote to memory of 988	2672	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0f35612909cf793e5cf0cfb10e8d7100_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2672 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
222566c883621acce9e0b1f94ad1c3f8

SHA1
e92cbb9ca8bb5b559bc2b1e9929578485d4c1d8b

SHA256
800a0ab05fe3ced5795991417e1685008b0404622e63c7bbc429f41b34ebb932

SHA512
46f01ae66ae40e494ca78de5af6346d2e53425e19594e00656b533a26dedec82c0c86c3ae8753f642a52d6b9ce12a59cd784de3b04cda3cee49eae86706b4b52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c557c60aa9ed6cf4e8c899c80233e33b

SHA1
044e9cb2384f88a37a6945eff741bf1abd3106d2

SHA256
22193d7c43161b8e8d0c17c35ce2027db43647b7c9b9aa5948d5ad678b74c22c

SHA512
d38c58731e5c5b6d3f87a8f66106ae3f4b42f1b934113a303a63a540fffc08ef4c5e207ff308540f7b8527f412118a085aa523639d776a9fe426432227c3344c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7a938b8652f663564e225bde81e17e2

SHA1
b80bf75ed1899669a26bcee23047e9d7e2c29cd1

SHA256
5b39cec531d46aa62d50467a44d20b4490287c6bee2cfa044f684e20057c0c86

SHA512
c9f17c445994cf943b06a74cce12a345de41a6d3326de677faf9dc1199e02affcdf1ab51a74c9ae5570260bd38660df2a8c66ebfba4e87eee4ccd4ce1490605c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25b443ad97f18430b7c718aca65a5ba2

SHA1
0d824a709047c863978a569f42c4ec09fb9d0e84

SHA256
c06265ec3ef8f51e2d62ba40e5c3900d13da67962d14e865511dca5c1b9ca846

SHA512
8973744b41e6714d39749550ccfe66146ff64717b1caee1f25a10f02a1c2f60c33dce8ac6d4a49176588d199140071fc6763cb99b74159483d17bdfc339944b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
635a369c071d7bd9ff264aadb9f5c85b

SHA1
58e877b971fa167abc5654a4218e5c5f744d542c

SHA256
95a5b8ed66cdb84aac9bfc912953cadb39d64c0f28f82d16d50256add2efd734

SHA512
13dd20ab2241416f96848990c1001d58c4e32a72ab9a2e12ad9de2560d2803d9aa788b90e0b8e34195e972e84bc58b2ce1abc49ee4d40e8ad616e3fcdf9216ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c57cbdd493a7aa366a1f132480602d27

SHA1
5e82fd7bdbd7fc0a7a30d5f23e7f1cc80289cb8c

SHA256
9bb67589f79d255e00457afa6bc96eef5b373615c3cfc09e8d1c4fa709827d40

SHA512
2c94a410b94551f8dc03fcd5d5e015fdd28c71e52632daa8072e31d3d9aecbc3fa0b17eb169c642de20d0b2b2e946ddcf15416ac92915e67f08981f0c89b75d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ff6a7e5bc8c543886f9815bea9413d5

SHA1
0ebf7796c1f6d3b2afbcfe8dae68d21687e6d223

SHA256
ec16bcc82201bd0686387f87bfc2a45cf667499e08040a65830cfbac525bbb0c

SHA512
5468696bf42f68cb8470646d74813b1b4069f90df655c4a9a9d8bfb5b5f192c1308a02f467893c2680d712960b7369f3d24019c9a42e28cfdb42f928b0fed264

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf39505befcc1199d9980d154a97ed4b

SHA1
ca627b4b4d755168f29e04fcb3ea64414b546970

SHA256
726f6d1ad328268c1246bbd5f7d235a1a045dda4347eb59221f89fd05d5f702f

SHA512
f8304d408acddaf7b9b4e80f5b291f0e0ccbf818e5581f9b2eb488d9de2d9270dd973fc2e72df748811588651102d701c240a771df0281345229e8b8bb6b8f7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b1916eadc02dbb2a524444644fb1189

SHA1
87bb6e2bb20cfe3918d8f14b88c7e0e86e60a012

SHA256
5d8666251ba78d22045eca75d60a17c0a38efa261b7acb0ce9d82ee26c6ea254

SHA512
c1be6839a7e2f404b3fae54066b380a01678f20c3422f85e8da4834949e364bf5f28acb92b13a7c079ce6359f150bbc842094a6b77c3e0420278e172054c856c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE63C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE69D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit