c32b58b7cd928bdc69f8fb7823f4a2dff1f8e2f272e8849298dab1f7b6ef8905

Analysis

max time kernel
130s
max time network
140s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 19:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6b3082b6ff1c45960ab85ceb477678a_JaffaCakes118.html
Size

119KB
MD5

f6b3082b6ff1c45960ab85ceb477678a
SHA1

04cb27565d5a217cdc6b93a1c20f9d0bb8106134
SHA256

c32b58b7cd928bdc69f8fb7823f4a2dff1f8e2f272e8849298dab1f7b6ef8905
SHA512

dd4bd2f89a7db80ff1bf510ed261328484fa9eec2c0879b76ddc34a00c3781b500abd1901ec37a42219a1e6d40174d95285b7a0dca49643f4e8d0d0fde1a77b4
SSDEEP

1536:Sg35ByLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGL:Si5ByfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D0A069E1-7B73-11EF-9BC7-EEF6AC92610E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433454150"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2572	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2572	iexplore.exe
2572	iexplore.exe
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 2148	2572	iexplore.exe	30
PID 2572 wrote to memory of 2148	2572	iexplore.exe	30
PID 2572 wrote to memory of 2148	2572	iexplore.exe	30
PID 2572 wrote to memory of 2148	2572	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f6b3082b6ff1c45960ab85ceb477678a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2572 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10f51cef1536005679b7b098fc725fe2

SHA1
3f04fbd4e7fe05323ec18a3827a0b8660fe039fe

SHA256
a24caa8d5ad846c1d0f8eb4faa229dbd97599e0ec4db031c9885979a55e02c8a

SHA512
7b26c3ba6ac0649fccd7bd2ef70eb1bc2a18a162329dd30ebab2e30e24edc0b51088e9294ece343911762c1f47e12b702f22627db18c9245185bf57c6adb72f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f348a197905c6f148e66b4c695b9066c

SHA1
66551aa0ef51650645b1a39d1e43fead2bbe35f0

SHA256
09619730e0c44a13a85626b4124d23dd22257f5c7697510b13705931416f4d93

SHA512
eb58a98c2f8b079d664d75af220fdc133d42120b9e544bb8f96e22dab9e822886723166fc273c2cab3b3e3bdffea8c07b1a126a14af3c6b6051b8d67297df314

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31ea46d2cab98693361acfc13990f723

SHA1
00a61372a204623dca6b8215eb4eb3b094b0c258

SHA256
7cfafec6e8ca061712eb4257035551d11c1fc15d7c4f380ac0c57dd613f19e53

SHA512
113264e14b9b6a46d9a19c67e553ffbd78364c7595cf8bef8f5ce0752c9ba6f51a355c2491eae537c4a2fb8de6314fac67e5b53529cc36329abc79ee4e74ec26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7738d75fafb22987552acdc074de9729

SHA1
32f2338b5107ab0ed39ebc5f00c044562f19bdbd

SHA256
86fc5ab5e3718dd2bb63405c2a7ca18ea8421c864050ec8eb19387b7d8c8670d

SHA512
ab7245cfb75022448767d224dfa7f5b6af3b31264e01bd4743341e010e2caeee0db7305b3ba7d4b7923ae52543e0be860bf9106e3950e95411f3eea8009baa15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42fd568897439f26998db4322e69829e

SHA1
3cb9dfead78b13d4cb4c6368b0cdc5199ffa61ed

SHA256
5dfea304cd83e7ead5d91b17f1ac05f82308743c6cb159529ea194b9583273c5

SHA512
84ccf421a3569073653992e237fb9b2daebbd59979f34fb276fec801797b0178f6c59c18fa5fbd5b88c89e00025748933b38765401bcd6f01eacfc945aac2dac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08ceec344248ac4a52c3eb69744fae77

SHA1
04eb061430eea2f79658d272ee377c0ff666f643

SHA256
9cf4d4694a750904797f8f334d720b7e9680aa71908347cfd5e6d5aee42c3974

SHA512
ab71ee8e17544c787317bc82e6790e2f286860163ab77993d1fad59113e74bb6ebab572cbded806e1e92e96c512c162d1af9612d43eed7c7a47381a1f034d2fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a710b30a5f57195cd961ba12d938a825

SHA1
5e194ecb559c9d94a8e11deef512f18aa30c1ba3

SHA256
283530501db943e62d435075d6a33f2d8cdb0580d0dd075533d8ccbe5fd35992

SHA512
8008fa1d58cf5a1051ce67d022a221b0c9212b8664464dd6dbd06b09a59a5e1dbf12b7cf4886e619cae7ba6100d03138badba4501ada76c2e79733effac6642b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54f514f2aa7d38f326dba0859d899b54

SHA1
9718b1174172bac17214c96a3fb27200ef4a2b18

SHA256
3d014e1d160f21cc354440aaa9e378e73c1f48e7de9fd055d96a1b90dff69551

SHA512
9641b9c2a9f885141c48b5aaf64f8d005b6a567cfd704b85d4078c42103c840f7924ae8bcbf1ccec0b2a82bf34cd92ab8d2c9b6f0372c59f56b7f681a7113be9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0a95594791107981befa3824f4ba6b8

SHA1
6070eb1df3ef9056efa2a4b8e6befdea10004312

SHA256
2033ccc12e23c8d8ca5f4f0775dc69eb0b31f08c64d26c59b7637f56d742292d

SHA512
634e8286b4ee589c3e24f0c733f6a7d70e96defe2eb5d53ae9c3a512c8c9028ca08dcbaee178d63c05bdb5070aea7f475f0a7b4f2027dd1d25727a08faa3ec8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC10E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC1AF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit