7cf3b20e28f200a1f040adfac08d5fc6fd71e05e9d8a4cb4071eaf525a3ceb56

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 05:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2b970c48ad72f9c1cef9b46854ab2b10_JaffaCakes118.html
Size

85KB
MD5

2b970c48ad72f9c1cef9b46854ab2b10
SHA1

e95ac90df5ab6cb9ccd9fc14400420a14250979e
SHA256

7cf3b20e28f200a1f040adfac08d5fc6fd71e05e9d8a4cb4071eaf525a3ceb56
SHA512

e0f63b7cfdc7a3e22ab9af2ae0b2fa54adfccfb16470dd1c5586efd29c251d00c34837c9a048e2acb547b85591c8ff304bcb021a8a734ede60e8910c1dd7cbe6
SSDEEP

1536:2+ipVn1BUNqvLKvr7R/JnVsWCUqSo0mjiMpbqqvmznhKv++nPLB1Vl:2BvLKvr7RvCiyuznhKv++nTB1X

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D272DFB1-8653-11EF-83AF-F2DF7204BD4F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434649871"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2664	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2664	iexplore.exe
2664	iexplore.exe
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2760	2664	iexplore.exe	31
PID 2664 wrote to memory of 2760	2664	iexplore.exe	31
PID 2664 wrote to memory of 2760	2664	iexplore.exe	31
PID 2664 wrote to memory of 2760	2664	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2b970c48ad72f9c1cef9b46854ab2b10_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2664 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a0e4ec099abfaed8301e71fe7e1596a

SHA1
dfbfadeb6716d9a0f88cc29f60bc9d86f7b09464

SHA256
83e731dedfc87f3c0eda7d9b871b5c531381653409a77be3c80b06d66a174e36

SHA512
40543ab21ab1fb2720f83b77c7d2f514a565fb650a6ba4056c1f13b7883cc924f6168d37f564564b3ec8abf2576164be62a1ef5a99c28b71012706bb74e6a2f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae2e1b2c97ac417940fa86638bf241aa

SHA1
fb0659e529414d2e57e53c03929c62212adbfe12

SHA256
f0350da46049e22d25f2714f2b075e21af09251c657434f23fd21ac591963515

SHA512
60e63760e6acd466dea65f9a2f8ff5016382114142348a634bdc0f3080a60b3bba69917b40bfba194e63e67d93e7501f3e5d3c0f6215174874a09cbb48af705f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8770dfcbf8042524c6bf652ecad92fe3

SHA1
87911444f5341282c2ba10dc44463cbf8be7f49e

SHA256
5448a7e34d7e8927043418cf8da225fa3bdbdcf9197fce73df8b100feb01944d

SHA512
751e22a7dc7b964e1ee76e81dfb667e5a75a1e578894cb625f9e5942259694d65babbfc08446134884cf5cbd6aa36dc0f3268bb11883cd4d5a0000ca61cd7010

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78700c209da6172d2ab9ce8d8515ad4a

SHA1
70ec027acae8c1770b3b170a63020513dd75031c

SHA256
342be9e1941eaa3e3aba3b8dbcae516db07c55e5cec4216ffa2a86649acb5170

SHA512
e3f7c2106635c804041d13db49bef0b049bbc61233fc7cb226e8932c174aa09dccd761955c97d99600315a8b7481d42dccff58e5c2315d026d5946f9a1313c6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d189d5ecc8cbcbc99f80d3fe93b89f13

SHA1
dc49c7c2558e30902a8df620aba99c06021c01e5

SHA256
51886259ac150c9abeed8e2dcfd071b0e25649fb95357354390f8a05a9091348

SHA512
655fc299a073c153f6d743626f14f973a7e6a54aee4519e5ca53a51d4b99cc1bcb1ca1dd26a4571bd04318e9e9e10c659758a09eb3b75a69a47279e582903144

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddd1fe8abc3b533d781101730badfccd

SHA1
8cc1d638fbd29302e46adbba677b39994a75dfad

SHA256
4c8130a32a92ba367108a53a97e3f5ae8369d0ca0781260afd865390fbca75be

SHA512
75a34853fd7e56fe071b4080ad3f00694936d512a37f0479abdf2df671db2bed15ad75efcbddd5afcca5f316aaf15b2a9f6dcf9a0be54fca71f16c5111970c14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed92cd44a1fa380788a2351b09ddff18

SHA1
01b0901be388a75e0aa9ae543d0ae68eef733aef

SHA256
3bddd9d4b6f0433c05774971edff9729b191dc54662dea3d75ac632397685019

SHA512
b9170fc80b9ba42ded37fea3b9265dcef906d2607803d2e716c03f53795c2144450faeb2896318afe5fa089d72d58e24bae996f5cfb3be722c8a8b32622fe9b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47ad201b0e49b7450e1322824e0f49ca

SHA1
39adf03c3b5622f674affa0d81ddb33025984adf

SHA256
7f2b86571b38b323e310a6afef4801262330ced7efa24ee887ac0f9c8ecd8509

SHA512
0634f81138e3f76548aab48f10dfd818f4aeece8287198763c987bc220081ce3516855f779b0ec19e0ec9028c8fe4fb29eeaee88ec689b19b5c2624df7e4bfdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
139cb5b7771e66ef635af15a741c6f80

SHA1
d96ebfd6d7f5e956eddf424aa17cd5cb132ee3bd

SHA256
ae80e12a8c0a8da494b5229bce8e2c542b24c476e85b29f073aef14c452693c2

SHA512
37c45f598f1347bee8741032bc76725763dee56110a1eb0ac3ff478f9f19e31c2c6eccba627ea6ee133e565b273aef576a4f826ad030789d69adbb017bbce1a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE948.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE9A9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit