dc1b9894d15b18a0b9d399b7b7bc7c36584e1161c93a7aed8c49ae7a7be16f18

Analysis

max time kernel
137s
max time network
140s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 07:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fbc0d20f55ed3211d48ac751eb517b1e_JaffaCakes118.html
Size

71KB
MD5

fbc0d20f55ed3211d48ac751eb517b1e
SHA1

0d58b83836a27d6709da62a3a38d9fc0cc146489
SHA256

dc1b9894d15b18a0b9d399b7b7bc7c36584e1161c93a7aed8c49ae7a7be16f18
SHA512

afc0102edad187a422de608d5d71ceb5f1e4d2a5b0a883faa173d70dfb308db84e735388f2c7d718aabc518f4ca6f2fb8623d690babd7b89b6863dcc7c10ac44
SSDEEP

1536:SHVfsvqCqRm9/FJaVgmoAQYhB9/v7RwjWgmetIO4hjI/9KFGekSx:S5svqCA8/LaSBjOzdgRtIO4hjkeGekSx

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FC810C91-7D67-11EF-BA23-C60424AAF5E1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433668972"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2352	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2352	iexplore.exe
2352	iexplore.exe
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2688	2352	iexplore.exe	30
PID 2352 wrote to memory of 2688	2352	iexplore.exe	30
PID 2352 wrote to memory of 2688	2352	iexplore.exe	30
PID 2352 wrote to memory of 2688	2352	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fbc0d20f55ed3211d48ac751eb517b1e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2352 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cbea78b1d3e2c8dce910bc6c5bdfaa4

SHA1
02f9e7d7ea7adf03bf4ba1edf64182b3d557879d

SHA256
0a6c349a7fdbff7e8012da3ae2a0dfee8096a265bf8c63efc49376940ebfa172

SHA512
2f01712621260f87ad6e90e8f2beaf9d3f30a35825fcdb48c59f7773fe6f00bce9b3e1d225f9067021168724b38a28a06e650518f2067c144fe1bc50d6cf5a45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f231b47d6a8dfce3e869789fb3ac0e5

SHA1
338c73d009151beb2024a00ac45ef8a5f6ba0e77

SHA256
c8c19486f43b675772d79bb883ef8a227cab0b11ee9e25b7aa4c64a408742ba7

SHA512
bbfea16d3a3d046c14b399a65a50f2de492554b2ab66ef2db9c95107cd287b1e8fcad1d73bc28e7edff2806afb791cd34e636a28ef0ad4cc92062d68f9d066e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31bc7d6144300ca52257d73fbaf57e63

SHA1
48e3c78b054d53d55c00a0748fa8e6895644603c

SHA256
d76620f5c4d956686185b1737819590700f6115b9105f5193629d48ddb4b1949

SHA512
429533b9c39cb8b35ca4df6e8f746ca4edd2a1e355f3f528f5c9a344ce59335c3c91a7efe7e65c97c2d1a02c0221e76c29bbc99937e961c3428b0973a824ced0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
421b128a2e5524947df440fd91bb56df

SHA1
83c77928d616c87f85ea6bb7cb46d1bd9c965bbe

SHA256
96e97dcb4ecfdd61ce7d9df56e6f9c3929073ac9a0e9a0d0ca1f17507372a31f

SHA512
92be4e92ee8fcfbd4c60bba61b2caae4c37c6341fa45986a031f183a6b3dd7645dfb104157812871f2fa37789a65cfe98523db3b10f9ec47aab672632b9adc82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58df3e437103cb9f09f84d2c5df6e248

SHA1
ed7a9221227f5727ad072f63410d6a1c68bdc978

SHA256
591a7ce614a89bf580d1ff934299462895fef948c10455b2146d43fe2d167138

SHA512
ec0557c70eb100476417d2b4b8ee89df0cd3bc2aff98dcca9a444e907e66ecb07c0e4a1d422a71cff8972689864e87fd195dfe4d9f8102bcd0eee2cc26fbe94f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1aed0ca29229b0015f98d7553c8bacb2

SHA1
8137608e35445310a40b53e89a533453961cf14f

SHA256
c4743daee66f456640d8d0b5b59317cb19f5becb8d8bde2f679f1c977d812945

SHA512
15f8642fabca2a4232f53274235fb4e35ec9098adfa456132c5045830f30c651a0afc6831290333765df9e5a0e725c4682ae4203f399b8f1d3cb0ad84a48390e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b643dc8e0d7830f3ccf5609bf619b0a5

SHA1
22d9f24b3559783e6157c2956237ef0e8f349960

SHA256
3e4ef3d526c3a9f1a2418ba7cce4d38107f4191dc258eb2d21b9bb4adc0d35b5

SHA512
81f55fb195b8a5799a1795a5d8310cc2048148fa105602ecae5fd866b7fdc007da3076a78156bf27a8ea989ce49f6a477c65d834c3f34a8747696e5859216bb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e907dce2a4fae398c331f7fb0c84bc5f

SHA1
40730b764669fa77af5f7fa089f7a063942d8b9a

SHA256
3ea6ce8bd7c9447fd9ca7740bf4edb59070895806855d170c96914ff26c2ae09

SHA512
2e59caa5e075ae8cfa56a6c7a0e6b4f5161705c89d0e6e026244a2acddea34817d34b9e68dd6e847c3e3a8a88d8335cc77036983414423566527211b4b7a2ca0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d79dfec07bbff84606598af7bf107c2

SHA1
0c0775ce37f875f0c4bf156807a9a6ddf2da2788

SHA256
2d2507193bad4af610e4344570b426c6dd652396474b02c16d1baf5c3b30d608

SHA512
58611d05853722f3f273cecc2ba46ad7a1e00d027c84673f86881a443e4ef55900a3c399b522773d6a08e884106f63193b81977fb1b0f638164595a2da46ee9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA537.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA5D6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit