4657adad26c68335683c98444b02e16c1be2a609b7b068858be98df8d27c5b4f

Analysis

max time kernel
120s
max time network
127s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
27/09/2024, 16:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fabecdf56557db29af83725ba2e4cc80_JaffaCakes118.html
Size

12KB
MD5

fabecdf56557db29af83725ba2e4cc80
SHA1

428b02f086c6bbc4377ddddc74648b012ac15d91
SHA256

4657adad26c68335683c98444b02e16c1be2a609b7b068858be98df8d27c5b4f
SHA512

a44f77cbb86ce32dcd70af4ddb51e611a435b28638a2cefeae83b70364bd2dd72633f2fdb69db3d81a81286fe1fe5125d51845d03e7f12b443278a103b9c7bb5
SSDEEP

192:2VVlIsr0KXyJ4VC9N5zw8k/w1wvqVkZxBKZynmrJSZ01PSbauBuLbdU8d:sVlIcDV8jzQ/gYxBKZynmrJSZ0YaguLZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{61E42611-7CED-11EF-9E5F-7A7F57CBBBB1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433616313"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2240	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2240	iexplore.exe
2240	iexplore.exe
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE
2776	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2776	2240	iexplore.exe	30
PID 2240 wrote to memory of 2776	2240	iexplore.exe	30
PID 2240 wrote to memory of 2776	2240	iexplore.exe	30
PID 2240 wrote to memory of 2776	2240	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fabecdf56557db29af83725ba2e4cc80_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae55cbdf5445f293700af003d5b7fd49

SHA1
50ea114e685987bf0b96bb3a9547fc89269e6885

SHA256
0ee1ef9e600119efba13cf842c83229b8c374e3616f9088c0480c72755de1661

SHA512
73e9875217eb08a67b1a30258907cbcc2283dd79f49d340c0e2ba652cad25626699afbfab3ec2483eb2d4713fa3c3b17a03deeae8a6f6f067c66212716ac7f47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca8a133cedc86e5392189f63c1cc40ca

SHA1
1606182ab7978a48d3029f0154dc32a7d5fd0002

SHA256
9683fd9ac9ee4c2498c7b892879ded10575c14e5e0a3a5bb050c2098a8cbe1ee

SHA512
749baae2c64ea9aa542ae6693d295270da79f2543d7312d28625fb702d109d77c4241fe42c35cc0db451190ac4923b8942180db92190401dde5522d9a9d34b90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92edd4aa3f5c94c8a58e9aa1c680e2da

SHA1
03eee4baaab967fef8e11afee2ed40b89de96b51

SHA256
531a487a70784b04f1b654df30cfc03a1cd92eedc0b7124a72e291d6cf8f27ec

SHA512
18165c7e506362769801138401f2119f22b65cd44ea005d995f41629dca8929f9bc98e131e95c389ac35c9ae276aa198d933ba418026dd1440b6e24ee2118d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04ad8f93e3189b9a2bb14f9563fed18d

SHA1
4a993b3c67e30ec35047ecee0e204560dcc1dca8

SHA256
8e1614c63320af1cb0bac63426995153fb4e98cc54c3a3deefedd626ad790f33

SHA512
c554f9a2012f383f87001b2c6d3e8b09864812aa0d9ea8498714c7ed1f09315955094cb8101408a41bdc87dab33dcccf0badad72e50c1184509ec14242504429

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dedce37fd83bbcf7d5b30a51409d865f

SHA1
3082ab4079c3ce52496187b5388cdd978dc65079

SHA256
50c405c79b9f93b8ab7d50c63a6a3f1102894f361b560fb21289005bd22e8bdd

SHA512
5895b79e8c4d1f5487b9ec3fb18297157019c689075ecbe69aa2fb20e31f4671d416a63ec4a96c86ef6390e1c9af5087e3936e5ae884c5e4df34679babb30d0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
029f953529efddd1ef08ab2fab90fbda

SHA1
edaece558f79073403235742ff3cf048ece8789a

SHA256
4680633c0c072f431f5da70be032f6c6bea071f706496f8f764aba0c2fb71154

SHA512
a865c2f7363ce702dc072cc07c2fac32f498251495a948149c6d157758b09dfd5934dba0f38c866a8b093a652d42fafb8e5f976acdbd542955fb47a6e79cbc6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fea6b5f553d825be1fff5ca3e58c0c33

SHA1
7fd9a9d95454e9a5a757cd4e4e2495dd6cace7d9

SHA256
31881e0997b2282e84d6294ea846aaf925746a94a512a3a920bfab36d102ee13

SHA512
0c2f5488df494f5fbd040f54d5450bb731d9c363751e22539b5e32b56db1b6e9ea714afbb4103f475ef4a9873dfa88bd93f28e082fd3bea3f5f896927f0f56d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55fc144e292a57e6b7f5086ea400c173

SHA1
e6e4f60800fc2c71350f9a1d8c00d6fde5c8c9e0

SHA256
b329291baf8e9a200f1d08e4915239d7eb3aa76ea98b77d0467d58afdf15f008

SHA512
be4fe36eafabec4976e7be1804e98fd264dd03ca7a31256c7d688c45b7b491e635885373b54781d2ac3ac65a4d9144b5818f3a8e58f08cd1672eaa8ee328e1ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d9b6d2fb9f4c36095e98f2ad369a3d2

SHA1
1152b61e71c215a57181e062e7b8244a24a77576

SHA256
77592b110861ef6512ba0e9f316421f50f90b681efdfbc62f8a6ae39c4845d55

SHA512
9ab4a10904644463c818524cf24312b3b0e0489da999a7b756251fb9710061f54cbbfe5542c0d8b7ed66111ca68e9ba235458a0e0b89d47d639e6a903ae1b415

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3F43.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3FA4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit