e348235677c235b006b76385e58af4fd7831933f3b1d5a64c09c9007108f5aa0

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 04:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9b2c1e3b02238523f715b9f900410fe_JaffaCakes118.html
Size

25KB
MD5

f9b2c1e3b02238523f715b9f900410fe
SHA1

c6e032e88c5a717b1764b4a1a306b988d209c2ba
SHA256

e348235677c235b006b76385e58af4fd7831933f3b1d5a64c09c9007108f5aa0
SHA512

bea519f3089a1429d4a1266cd490fcb3dd479ced2a21ab76feda1e7adb02d40f7e82493bd9bf531bbbad86cd50fea40117135e22d059d31871ce1e1c89e6c54d
SSDEEP

384:rbOgamRD59xI9GeY3bXL4brl59iAiD8F7Le+5FRd9E8KnUmUruW:OgamRD5321brl59iAiQFJmnUmUrL

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE859FF1-7C87-11EF-B686-FA59FB4FA467} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433572767"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2384	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2384	iexplore.exe
2384	iexplore.exe
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2780	2384	iexplore.exe	30
PID 2384 wrote to memory of 2780	2384	iexplore.exe	30
PID 2384 wrote to memory of 2780	2384	iexplore.exe	30
PID 2384 wrote to memory of 2780	2384	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f9b2c1e3b02238523f715b9f900410fe_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2384 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b80808e73904254d1c1de677de136c0

SHA1
a31c1252d8bffa3c46a813475240204cedc5937a

SHA256
c6cefdd72a60a32dc5305999678568dbfb6f49a399d9247a92546bdf92f6f895

SHA512
fb7782cb7687389ca16430c09beefb7a0368b2848c5661b751453e1c84b8f97f46d68dfe9b19728344371577bb1ea11893ead5e1f21c5a9079296a8664e24589

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9cbe5eb4c0997130083eea8ecead29a

SHA1
0b596a034377d590514755a6ee1e827e6028fcd2

SHA256
2071a55c6126ea9423f883cfd9f9265779a1edf1d52bae4bc8e9c3eecfbcf15c

SHA512
b75bcf61e4a52bcf4bd3847bcc1b47de1d3f88cedc7afd26d5897124d6f4f61e5e7bf632f71205a642daa97a348676f3ea3e89f54c446b9798bc611b395dc756

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
644437fba911b506de39ba5a7807f64c

SHA1
ba284d7a8cfabae4a6473d61bd65ef106e4e47de

SHA256
7cef9da06fc68cc4642f5c950db5bed337ad40005a8df0fdbb9708fa5ea496e0

SHA512
588323d2a89223d4f2207b11cfaf35c55c5472baa2a6e45d92d61afe959e9f46ba714db3f6f2ebfb7219222c4c640c9dd6606a2b7f168b6b28f75f6c03a9336a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e11afdf1a87c9649a9cd334efc0d79f

SHA1
42f3d23ec4510bad83412e61ba6317e1789ea576

SHA256
2f82f8e3c9a37a05a4bc23b820d4d35008a158621a05a947410b9025890c60aa

SHA512
0bdeebc51a0971273fd3a83b1ea45dc3ba480850c34b6aef562eae6217a726444571fe7f081a9cdad01fab2f0ba08d5f2ec36db01c81caa3a22e9b5e0b5c2bed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
142fda82fd5d5acc016635ff4a38f632

SHA1
210cca268c3b298db71da1eb7b27470b194a0dec

SHA256
c980dcf2f634ba6c4623cfbac6d138812185395e2d2e6344c448b0a121d34f60

SHA512
12a42091c3c58862e0a0993eb91c6eba96553db93d8dba97443f6310c1b9cdad2fb2549396795d446e24ebf6d9483bdda2b3a39c065855417f3c781876ce0704

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0c804dc42bb9ce08f87eb28452a7849

SHA1
e1041903163653208149513b5ceff4d1d8f8b584

SHA256
3f0af5e86df6c65d7829caf8e3efef8d0d50b9a43a36e406a73d31e10a53001a

SHA512
5179e3671a054f03179c25ea28feb982d588894f7750aedf602671de4bd07d4c9fd000b8449de9247d451ab365f8ee7e27477ae29548884d31b849dca0329716

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c02f846e983f6c9a16ae8a70537f10ea

SHA1
73438d5d5270d2c76e35bf3735e493aadd59ff1f

SHA256
791e6b6b3a31cdd3d5d9eb19913200ba60bd11905c79392c4f0d361243ec38c8

SHA512
077cc27349c688a858ee42bd461bca0d1e60dfe63a6dd0707069bb71fe3aecf396f11f424c67d97b9a1987bf59562ce8d20a9763d4dc47665f2af3f7b385b30b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85de355be1da8ecc925d512eea326364

SHA1
7f6f5dea85dc1409bc7fd81c0752d8d46ee198ef

SHA256
a3c48756faa01e1105b3f5fcb520bf2c07a2ff4e0b472316b31ee51016a14f36

SHA512
3a0f6de323e47f49c152b6208ff81b0eb4ed6ab6c856a9c8e97abb944d62fb7b582207bb5500383e8df99b88f5a21c514e40912dc7b37f0b1fac97e1c16d55aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81f8c3d12bb865351399b9a957acb95b

SHA1
92b2d86e764fa18cd5b16538922fcaa646a0ebd5

SHA256
5855eff7b0008c4623a81eedaa2496f7d2116175ceec33bd0dd230509ec9310e

SHA512
6180f8265f40c67ce37e152805c46526955daa1b5570760ae5e5b6ba3fe410792d2afb7bcbd5d27a124e2d960570b85a5877980a8cd22b127f3cd4b83ac48532

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEF9E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEFFF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit