cf01847d7de2377364d60fe4da9aed0998d04817ca49abbf392548395400f3f1

Analysis

max time kernel
132s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 01:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fb3b24b07d8a5348aaead3a090aa4203_JaffaCakes118.html
Size

143KB
MD5

fb3b24b07d8a5348aaead3a090aa4203
SHA1

aadd35e7056bdded67502c6c615f565132e4da3c
SHA256

cf01847d7de2377364d60fe4da9aed0998d04817ca49abbf392548395400f3f1
SHA512

7922c278897f5bf4d1c89addc42b745007d63dac6821c9661394be6b9edb6e4d7ba8c1808eade1bf5333d229fea33e8317d39690a56a377c3629aa5be33f5f9c
SSDEEP

3072:SsukDysrox7dyfkMY+BES09JXAnyrZalI+YQ:SsdDysMx7osMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{181A1AE1-7D37-11EF-ADF1-527E38F5B48B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433647973"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2700	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2700	iexplore.exe
2700	iexplore.exe
2920	IEXPLORE.EXE
2920	IEXPLORE.EXE
2920	IEXPLORE.EXE
2920	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2920	2700	iexplore.exe	31
PID 2700 wrote to memory of 2920	2700	iexplore.exe	31
PID 2700 wrote to memory of 2920	2700	iexplore.exe	31
PID 2700 wrote to memory of 2920	2700	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fb3b24b07d8a5348aaead3a090aa4203_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2700 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
909f7fbaaccf5ab998096c4e99ccfd03

SHA1
9d24944f1e6ff2e9310427b7171bbb70678c564f

SHA256
cd3353df6b01ce4185071ffeb9aa4846186651d4a9338d69d1540fe21126b377

SHA512
25f002760b190b0c09b7b6e482f2ec9cf43e825c7a51b24443455c9aafa4d6ae1e8fa69c7ed32d25d5b5bb4dfe7968b6dae119055dfb179261bc0e75e908956e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2300a0cb9e4b2e3e4f4cfe6090818fdb

SHA1
3a925b3da78c8e537a031fc7bb1a81c7022bd1f8

SHA256
08d8a7dd5f7b4bb142c2500cb07ea5730142241f595b1fc29881a554cbfeca86

SHA512
d2e5a493889bdb4bfe6b2f58e718cedc21ae5028346ee6cc70adaccc79204774a81462dc2ac8066f2752b514c96984083eb6140f83be6c447f0788f1f5753843

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e94abf267aec8b4cc48aa95b7e1b0123

SHA1
62aa47bab2aeb519937e311483eceafe62ca2263

SHA256
24527e553690d4523c03a081459f6679f8556e098e1d1499ab3452dfe08ab5ed

SHA512
2528670a50f7157812d68d2d707764751b8727cd6fdf537976507acb0bfeeb4bebd781309a22e19036b902b8b6f6b480ded34057926b085bbb4bf4d5905ab13d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ed35e063a7d557f0bdadb137427dd50

SHA1
3e412cdd5174eaeb7775630e2f4258c49b01d731

SHA256
f593cc97d51d4bb0fb2dd4b358a38394fa4245065e472051393c13eca0397701

SHA512
74d37b4d36bdd2a057a5b8f19a75688418a51441fed0ca04db5db574d6c828efca3e9da84222faad259fab64dfb6c3044054c1fb290f9bd1ed1bba6b1c7cd11f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6d05e886307e9cf61eeb72997617b7c

SHA1
3a443615446d16cad702088d29794801cdffae2d

SHA256
11e2f7133424ca0359d2e585f968cb5ff30da53378a5cecdf116647986f650e4

SHA512
c552fc230310ddb0611ef5d8033ef7e44cbc4f65255fae06fd9396996545776f37efd5d8632925979b16a51a132cdd033ca4be4a9f74eec21f2dd95e1ced9072

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
141b80f7ba4f37248097abd03dbdba3c

SHA1
30d8931e450fd6f02bbeb84b958919c756b9a772

SHA256
d2bdf578ea99e204a61d16c8efa549770136a35e433b756fc6beb253f4de9817

SHA512
567483bf78bb905006bbc0eba4a868146775dc0e4a5999e6c023893266986d18ce51c5775e1bad02343329cba82345ae5e60fc830dff959e0e1fdfebaa38baa7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
adb61739c7b795b965e28e7d25d40f8f

SHA1
a7146f7d3b6b8bbf4360ea5904bd88ba49e51ec1

SHA256
271693ae089af290189adaf77f795500c727dc6a80d3f79e1d62e8a206e1dc5a

SHA512
5edc4894bcb715cd60e54d2b301a7f382d5495156c4a7df9aa6c14a78ac21aeb8376e81605c3ed24b6346513d3fdb74fb5261d0c15a5e7207da64af0a989eb1b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d0ce708a3db4583233299dfdb46c5dc

SHA1
978e3611b970771d8e78f4448a94fd79550b552d

SHA256
a813d700b3bf973317448a07da3949d54a27f0ce569c214902deea4569a2860e

SHA512
2098f6dafaa5dbcdef0a51e80e2073ed565f60958d03112046b08e2400205dda0f31e951e819f54a3e927ecc50cf84fabdfcf84ed7f98a0e05dd4538c9902173

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70eb3477f5bb27380db84689d8af0a7a

SHA1
ff6c855803f02e65371d9dcf1cf0253076931c8d

SHA256
3905c7c196bd32ede380dbca6b0f0d176167563fc2588e510f4708d0abaa77d4

SHA512
f735e0f4e37334ee3fc2f92af4548f3824584dfcc418f489c456beed7a5585cb05c4ff79ad94ae3c4ba582b746f5f81ab11a49629cc3e7f8d09bdb0a299a5797

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE66B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE6FA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit