fc0b35459f3b1fbb34406593e734e121b87bba9f5eb101fa069e7e44d5846215

Analysis

max time kernel
141s
max time network
143s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

eff4bf35b0988b8b79800dec87f3ea73_JaffaCakes118.html
Size

33KB
MD5

eff4bf35b0988b8b79800dec87f3ea73
SHA1

b9b609c32c62ddc91438133cfe658d3522a9eb24
SHA256

fc0b35459f3b1fbb34406593e734e121b87bba9f5eb101fa069e7e44d5846215
SHA512

6ac24379906950ea43d61194bfa0ffb9c426db38cd19b161156e44b603df5b961d99645a8c0c6c7a935ef022fe6bf0d051448ac53b7da80b3904132c2876a5fc
SSDEEP

768:p333MikzoBrofn0+8ra9meHetnxxWjTYL9HiQVBaN7k:p333MikzoBrofN8GweHetx39HiQVBaJk

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{749D5D51-7822-11EF-8252-C28ADB222BBA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433089353"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2416	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2416	iexplore.exe
2416	iexplore.exe
2572	IEXPLORE.EXE
2572	IEXPLORE.EXE
2572	IEXPLORE.EXE
2572	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2572	2416	iexplore.exe	30
PID 2416 wrote to memory of 2572	2416	iexplore.exe	30
PID 2416 wrote to memory of 2572	2416	iexplore.exe	30
PID 2416 wrote to memory of 2572	2416	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eff4bf35b0988b8b79800dec87f3ea73_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2416 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d75280be32d66742920822d4b67b4a5e

SHA1
f72b3dc3ac404f47c2df143b75008d39f9467a5c

SHA256
e61c54a7e461d30f5dab3083f2c76d54cd1efc2b49e2639bbef01c139decd408

SHA512
7fc91d8e9d5381fe713ebf82bafba4aa7a8776aad06985eadea8b3040fac4a96b7a2689b25f71c8e403d6a8b5821205ab7221d5c150eef17a2773a761c059319

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3266729e5b5c5574e3b5271ee6370fdd

SHA1
d047593e9f0932c5bbcd3c749d6e5b3953090e4f

SHA256
3e1aa51857f7ea945fb6285488d06138bb1c6015ecb849784548b64aee39decc

SHA512
177b2dd4e36e9001c1e395f9f8df59af020aea3be3bde47f3e91efd9c89a7bd86f01687500d4e6c5bb12c121794a0820023c6a4a311313c73ad18453b29dbf62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
885a57a63ec8c6f352f46b71cb2f1875

SHA1
5b7353b5fd5d39380e2035a6766fe58cc967c40d

SHA256
676a16ee9ff6d0eab6ee32f4ee7e3d19f885bed0361e28411f7ca4dcc670b56d

SHA512
ae349c99da20d4841b826bfaca270926d5e39fa50b8310c0f0399ae9e89624bfac1adba909991c844e9139955dfafbf08add3a23e5ac2bfaf188e74c0b87e369

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
203e4f852cd0220ac61eb5f4438381af

SHA1
10d3fe0f26f4e3ad98073582f2c9eccff01c08fb

SHA256
2bcfc1cc1e7ccd084bf6644d748d808c52fa56abf0f3a7f48da81c977376fa81

SHA512
475c9cfa872210b8cd345b6ca095fba9933e02052c849f59c57cf16e49d5bd8e1accd418eb8e0c8705aff20e396fc475c0111533f98033c8b6150c39cbc742d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb5ed0480ea6693a031ebe5959c8da1a

SHA1
7c94f63db35acc641b5a1f6f35fc76e2e5d8cc94

SHA256
7dbe2883839af6556d744e0067f0504c439e156af5042d4925b6eeeb1df1e61b

SHA512
588d73d37f8357083a3364556f956f8c6f387c3d8ae1bbc3265bf112ab6416552049bad632a840559f8df848fe151f03e5405a7e352f08207344756e5d9e4b9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
614b99d6d967243ad20d8ae870e1b33a

SHA1
7b4d94be58ecffe57795cf73254a833335512c86

SHA256
66ca8a9317837426a9e9dfd2235cd4f34e20c88c3edf91d128b1df97d6b006c6

SHA512
adda0abc0e4d7defe42fc9d57dad7f2a0b4ee33658e6eb67240ece68b1c0bbf8d54ffc2a649ef91c81148fbbf013910fe6cafc3a68eb1c737719037e3c655865

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ffb42bf2b22eb581ac5195cab86010dc

SHA1
380066143d15deeb66b4342eaad47ae52b893148

SHA256
60c15d1812734b2886ae5ad5d032b746a4b606e83b6d6baf859ea0cc30efa3d6

SHA512
0c6ced76c3e834f9e286494f410fd0373be3050d11b548583cd2e43be28131b64603608336883dbdd29cca0d7b22e8edeb922d13d3a388578413d55ffbd08653

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f93dc5b6ebaf26a9903bd58b58155f12

SHA1
104d26da7e3d46e9a71a67dad585f72c0b5d79a3

SHA256
633883dbbf3887e078120a58dad39bb7adace00d88a5ad3df15b9c54c7b9b038

SHA512
be0826c75d3e8381cd00fa544284d4a555580c84bd675e433f0ada320a6e22c079dd3044ab996f6e6a244c65fba690cd833fc4d785de7d1e1e45b3727296b918

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7368faf5917b3ad7b03ce184d0607670

SHA1
f405b2f9215de4c827c60a01d4639cf977d82c79

SHA256
a1499d6aadaa944ffc34d5ff1851d81baa1e7a31e85163d8d314ccfcf55ad2dc

SHA512
c4e291fd3eacc3f0511bb9ab1ef257f1751d8ae70d5f8b10929a6ec6f2236bc324f19ee9fe3a6e8658b0bab996d6ddcd96fbb7f9a4b86be4bb321ddd9aa85eab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8d2028beecb6f72d5297e0c312f76bd

SHA1
1a807957d03e3424390cbb86a6c362c7e65d4657

SHA256
5cf2662607963748c860b53eb214644621f393e823e498f8ef00cc0dd2a78f67

SHA512
740ad4f376a1191d1ee7ba204871154c5dd89698f3e3352e3540489a54efda2a281468640ddbc4acb2949afc70b5e71cd7a89788bd27847ddf63ec5315eab05d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a7e590373c98c78bd441e50e82188de

SHA1
b1ed41f50491b5f4cde2490538fd79c8269c52ba

SHA256
aaabf1ee7b18258a894a5b040161a1ed13d3aa2037c7d136049f40a9a95e7d2f

SHA512
52fd358c9eebf1c3521f959856d80bd59abbee37957aa07be095720c146e5dd42b8554c5c87757341cc47dbb27dfb2def58bd5fec204273790256d917445bba6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df6abe010e4f879ec69b2085f4b2909d

SHA1
ce16b9ec80a634c6475ba4d6291fc380f5c86d93

SHA256
f27a9dada91035fd47547cbb14a48ed139e5bda5b0a6754617e7184c6d7aca0b

SHA512
97f1b93c1d483fa73f2300cedfca5ed7337a4e35bdd0e2be1b31bd50d9c4e43ef79620b3b5741273691d0cc16476980e41847553c609f12b66415079cb2665b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBC01.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBCB0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit