e1f0aa530ceadfd22342f8661e286cff72be459892bec69f997711994f7a31b4

Analysis

max time kernel
130s
max time network
142s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 22:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb0d509561ba1de8c9081d0bc40b29c1_JaffaCakes118.html
Size

19KB
MD5

fb0d509561ba1de8c9081d0bc40b29c1
SHA1

b4d7f5a8dd75df42936465bf1981394c984b8dd1
SHA256

e1f0aa530ceadfd22342f8661e286cff72be459892bec69f997711994f7a31b4
SHA512

7326ae4b2da236672894d4caa050bfa358060011a5c301652e4e1673f3dae80c28816be38553ea7d4e4ae331fc0fe0053000261b32c046e28712a0991e86e55c
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIS4wzUnjBh8282qDB8:SIMd0I5nO9Hjsv81xDB8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433639558"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{80FB7811-7D23-11EF-9438-E643F72B7232} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2436	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2436	iexplore.exe
2436	iexplore.exe
2116	IEXPLORE.EXE
2116	IEXPLORE.EXE
2116	IEXPLORE.EXE
2116	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2116	2436	iexplore.exe	31
PID 2436 wrote to memory of 2116	2436	iexplore.exe	31
PID 2436 wrote to memory of 2116	2436	iexplore.exe	31
PID 2436 wrote to memory of 2116	2436	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fb0d509561ba1de8c9081d0bc40b29c1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2436 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
303a538cb94fa19e58d6000c07e542f1

SHA1
102ff3e7f2a4bafdb8217a9dad79cca8fcecef93

SHA256
4c5f8ecc32e465ba89ef17c42c8e6632860bc9f4b52f2b492a5a6c957a6b64cd

SHA512
f0d030aa40c327bb0549aac45f18c1aea0bfac9debca968be9833456bff1a921b7308ec120fbf396a679f681d6731ce021684cb48a1859a4f528acb9ffa833e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3430058a480b6c898dd2e375e69442e0

SHA1
ac0670c2b6490cb447ceb26b28d1eb33bde3c80f

SHA256
45e31717c50f46b44dd069e0f77a08e85fae8158fd730223ea749ca7a04c5bdb

SHA512
5882e37c0bcc47bb146b8327566fbc2b3ebf1889e7f732d68a559c0193d2a7d342741c4601213cd81d15e52bae86847c1339c653988a9fd63cb177b304f23aff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4135c060a671f4ad6b20db7e3b71807

SHA1
dee070a6e586ccfcd5b273bda1dd0852a257149a

SHA256
924e61aa0056230079d6d0b05a52173d80259fb7bfc803051ec8d991b948618d

SHA512
65c1f9909bb6ede488ca8c359f46d7992c333ba4650646a8d2e6590490eee75345228847783782ebdc9105366d0d84bba7f3895b7bde73dd35467af97fe80286

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2aa08250f2ba67956b359b6153f1c25c

SHA1
f3ffe30a9fff7e24ce123c492daadaeb6407989a

SHA256
1e4f2646e4efe50b24eadf59d24e3badd5316fe92292723b3eb38992e79e8e78

SHA512
cdd46b5f1219794214a21ff736be050e9c02f7116fcfafa8a082517e8c7f026ff383c48bb7639cca3c86d3fb46ea81cf196dc0641b08e1bbea8f11a74c44beff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0daa0d042644fd8ea1c52e25acf1fc7

SHA1
5f0a0776695910ffc20524ea024d3519c02ac80c

SHA256
5814ec86815bcbcb12eec47d6041160a86caf1d48d77c63599cf7b9af6238fbe

SHA512
bc75d7bdacb31debf0490323984836ed671b34ba63dde1dd830a1eaea945a886860f1ae1ee4abdef61cd9b7843e49903af1d4381ba6e965b553908192f4ca809

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5f755772e5e8f8b9b2cddde1bf35a67

SHA1
76f6327b0ceb36a54d6b33f3dfcf95da3051b157

SHA256
7885ba309a0118b5b9df533131ce9f7571eb0b5e4c24b06d9fcb9c55bf8d1d8f

SHA512
0557b4cfa592ee569cb7b3e7b2d07c673859e1bb1672358902a36f58996f26124dcd30003ba083af359a92a05bc036e7135306eb419480cc8086f013595aa75a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
770cc95b0f5a9957ce78cd2f260482bd

SHA1
bb7004c8a2db4ff5acac7481d1e248bb121a0be1

SHA256
9acd381eb5b743af13ac6b3642a0d050cbe39bfd0583333ec272cd2c0dd83f0f

SHA512
254c6296ac7cbda3d678d11999fda074d02196e318bd192230b8811b355ccc0116f1869cf0716096cb3e601692a60d4131930135c69241f684d18d6c2e4e496d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddacf3ad034a18242dc4b03393307567

SHA1
dbd1dca317ec2598cc3d666e1a7672b278a35b8c

SHA256
cf9e4d586562e5dd6538c56d58085faed304b8356498a79b187356fd229df84a

SHA512
dcc754ab5db4b15e4c1c82cf9d54445adf6e47ba0dcbb3d041bcef7dc97c00bf305e3f937f95b159d4f9b8050272e781f926f7dacd5921af60d3cb8da0518913

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7509ab17871e8ecb243c6f9cfa5ef95e

SHA1
c52a45d975d1e9c253c61198b333a4a07335e0e7

SHA256
8f29a0288a9d3a726a3e7833271c8d83f060bf65b869ea26cc32b824b9ef5d22

SHA512
704ce1170b3e4ca29c1fd9ff6f7415984fe7bb7be2dd3f5b78c1abda7b9068cc04727ea2715d540d819df4dd65e1b1daba897692a15daed400ebb4014d1bca43

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEB5A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEBBC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit