5cbe0348321d1e05a3acf23d662d5a8b204969e543f839e795f5eacad7028740

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 16:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fabc6d75cd72c499d11eb1517e9c583a_JaffaCakes118.html
Size

13KB
MD5

fabc6d75cd72c499d11eb1517e9c583a
SHA1

edb3a0be11316f9bfe1be13dac85db21049d5e8e
SHA256

5cbe0348321d1e05a3acf23d662d5a8b204969e543f839e795f5eacad7028740
SHA512

26781cc6faa3fadd645083802148e876dc90b2e5f3a33e6899e8e92e41f5ba438c84760092c838a842b256f0efeaec5b278810b282ec343478599d9f2f916acf
SSDEEP

96:fTCopMrvi42VzogluSraKiBwv155U9uNYPbpzdcCJzhXPLsqLuY1+YObFKPcIIOd:W0fl9rXia1Y9yah5JVgqKYwYmtKT

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c4000000000200000000001066000000010000200000008ef611799c328b7f0b15a55cc8a7172ae8b531e7d2a5e69c0cf1b5beeadd6efe000000000e8000000002000020000000ef76da1055b75cc7ab1303b172c49ac2fcf42698b22c7dc57d04b4eed51962dd200000001e072e4a0f85fb97d74ae87016f773f8317fddcb850121878f43bda5cc450e0840000000aa0555731ee3d7a8c1003d09adf39ff89789e0e758da7ce093066966d277245aea4c30f7a832bbbc63224de6ea23f8ee3d5c1f6049563282fa0b6556e7e090f2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433615973"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{97421841-7CEC-11EF-8C8D-7E918DD97D05} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c4000000000200000000001066000000010000200000000b45aba51dfdee5f4a24865ad4907c44f6578b2e5c0c8ea8edc3b98acbef869b000000000e8000000002000020000000a2c1a98c301dddcab88e6f846bb8388105eff59b64f203752617edde17ce487c900000000a14cea21bf5401690b28720c1534f3e7e04f4a591a3a8e39218f0a36835ad0eff356bf23a5f5d96213fa2754925a8fc9ea67ddbbf41a267640b7efee23ff7fec0e423184d8d27682b58c82f2d1699d9ab8a0bc5013605884ec5191a9f69a3c792f2d202bf3e1c2e041b5ab778a89a038b519c46360dad3258ace7c07b445c0a005e2b259561a9cf4f276f1cf86b828a400000008ca3c2a70c287b0a40b4133effb1f60cb5b498012b9f8a740663e772ba24f81b906a02dba372cc78469e0cc8f697714d661de19b8bd8ff289ae8a0237278c1b7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 806c686ef910db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2872	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2872	iexplore.exe
2872	iexplore.exe
2012	IEXPLORE.EXE
2012	IEXPLORE.EXE
2012	IEXPLORE.EXE
2012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2012	2872	iexplore.exe	31
PID 2872 wrote to memory of 2012	2872	iexplore.exe	31
PID 2872 wrote to memory of 2012	2872	iexplore.exe	31
PID 2872 wrote to memory of 2012	2872	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fabc6d75cd72c499d11eb1517e9c583a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2872 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfbc6049bba0f78228e6f8b9c20710c1

SHA1
cc2f2124dd2af5ab3b015cfd2cd55bf542caf4a1

SHA256
811b0acb73b926c09ee0eee779f08406978d16947e8b69da5f67229e261634be

SHA512
d383ce50949dabddd7dc237ea2e6452b9ba78739dddf1d6e8e444428ae17b5e81a438aa5a1dc1496e33b1d89623fe2e1ecd8ad61b4b4fabc702d70c750fde682

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3020db6d4eb4b7c87903a2ad544ecc6d

SHA1
6a1fb3aec1bff504220e46dc4bf073a6b91f7bcd

SHA256
88234cffd504261d72630b76ce76eed79fcc2705b60a86bd839548d4c999c37e

SHA512
cad71dae04664b29b20d3cdcbb5a99b14b09245cae19d3727ab52635e2a03a61e99a8def4f779884e8dfbf1e08040386629220a9cf3473a2036749434ba7d84b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5392ff0afc844cdd096ebabb7c315103

SHA1
09ae0e87b66483c41f77769f35e9d32c6c268442

SHA256
032a109f7cf31feafe97cfd1b5dfafd6156e5db150506c42d1657fe77e467799

SHA512
be1dcfb9e8008ded4242018909e2ca2b6745d495f9c688dccfe597e9bb55ea988874ff428a96050484ac006a42118de06b0bde2c4c2ba8fb8a1905678a023410

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18d8bc92e27c42b670fc6d6e102cc058

SHA1
b68e65e8ef21cb0ad1583433e96717ba8dce5261

SHA256
8ad616b708d8aa650415c3dd6133d22cdfd8bf125d6d1d66451277b76492b104

SHA512
2ff476f6736422f4dd140076de949fd9f01708baff69c6ee0a243180450133e69154f103cd83d3cbe744bb2f058d9cb503475c029ec9ad96660cae69ae1a9aef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d372ca4cbcc3383bf3d3b0ae7e488d13

SHA1
b2a9f2f6e0120139bf1ca94c60cef1f38456ec56

SHA256
d26af2ab5f874dbcdc76626b06f3cf99b277a726d1cf7007bb11d28c5f15e39f

SHA512
c269891f36faab0ceb0ca404a558dafde08ea403992c0a97e7262b28c89bd906951aa780d1d06570962e5f0242c1098994c172289be8e59b1c24a181f2539dc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0140aeb0d4b70a278cdaec89d95eef6

SHA1
4b8427c3a4c3d54a7e146cac9577340e597099fe

SHA256
6bfc13af23b3b0567ee88eddb7d8d959f7339ac388175a80ff3a79fca6eaf737

SHA512
caeb37cd3e78ae9fcf16ed586f5499d25a7b0c7746c1dc2c81fa48620946b8a089802eb93cf841054057eea41a3355b96777e0b6ec14e8d79ee4cd884db8dd20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9275b8be2b912efa1238ca70e4b93466

SHA1
a39e2ea0c18192b6247a6a3b54561fd87e24ec95

SHA256
8731383797c5a309e9444671cde306607cd8c06c5acba4844f126b84bab69174

SHA512
59632fa090b103921571bf203cb903b41f816fbd9e3195d3a2df862dc2d3bbc35f8e412cdfe96197a14bc2f6e4e25c8881cf22e483c75a4b491044fbd00aff9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7cb76685a2cb094dbff6aaa2fada4dd

SHA1
d52de3e53635ead92c6d73dcaaeb134612ab0962

SHA256
8f064312ebd0e05b7ea453c23133ca096338738b99a3aa93a88d2fe0868d8183

SHA512
8448e0130e38fba21c6c6b1250865148c98d339f43e01ee02d6e89a2f1f710d5a4be1d60d6c7c6805dccc7117652ea20a82b86a0851fde2fab9bf15986321ef1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6d38ba9f9997a05664956468a50887b

SHA1
e18f0b4dd02b799f83ff1c1595329819936eff32

SHA256
27406c0acd40b50dfbd444b7b2ba67bebe194c88505c08ed4c46ba8076270f24

SHA512
b3572b2cb0e5b3ac0e4c4d7d6b4a76196430c20f2decbed8125c7ac9cc458c858d83766c21399ffd4da7e5e66bc3091ab4e31349c3f3939c907e154261f728d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8bf3a523ce21dbc6b3745dd2ce553bd

SHA1
237eeae7c6efbdec94ddd28d37a72c87d069571f

SHA256
bceb10c467835ec31751a592d42171c662802a8fd9e28d327a7b6128eb3f74cd

SHA512
06e16f419c0d3e08dcc8d53600c007a05c6cd873fe42b90dadab0972a6d3e6ceb9d4db5be450be6118e6d4ce196b37b10837e06e63317554fe4a586f94233218

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56bac445b572b824dca6ccc5dfa1bfcc

SHA1
2e92e8c99a1b200bb2384c51e731551b45185175

SHA256
0cb8789e681446f1bb492be2d0d19308e2a69a7ea36c3d6340430efbcdac80a6

SHA512
74ffeb415a858d3815a096077dd63b81b28776aaae4a90c22aa6214ce4be0f439afa6362e90249c64fc7e16d39fecde260edf8762ab1f59e45dbb387ecc6e480

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1871.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1874.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit