1f48a04217ecbfb0750dbd72e754e7a3d011d356313cce003b66391559719a6c

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 08:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fbdd8d25bd917429b050ce823d8e6c6e_JaffaCakes118.html
Size

20KB
MD5

fbdd8d25bd917429b050ce823d8e6c6e
SHA1

0de81f72d9ac22410b7f6be00f7d6487c7594942
SHA256

1f48a04217ecbfb0750dbd72e754e7a3d011d356313cce003b66391559719a6c
SHA512

57aed7b7f7fe6ce4fdcb89c4fed5e807371b6a0f8978745f7067730b837b2d0240f4fcf363f1b63c4693e7d2fcd7bbfbc369ef04020f230ccb9ec9df5b512d51
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIx4ZzUnjBhnJ82qDB8:SIMd0I5nvHJsvnixDB8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3B6CF6E1-7D71-11EF-B6DF-4A174794FC88} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433672944"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2656	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2656	iexplore.exe
2656	iexplore.exe
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2616	2656	iexplore.exe	30
PID 2656 wrote to memory of 2616	2656	iexplore.exe	30
PID 2656 wrote to memory of 2616	2656	iexplore.exe	30
PID 2656 wrote to memory of 2616	2656	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fbdd8d25bd917429b050ce823d8e6c6e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2656 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52a73cc848ec134d524f55369c1d161b

SHA1
109451cc9abbf2df94f179c6e2d6dac3b91a4615

SHA256
23b373fa245b3dc7d7f0eb16ebfedf14262e1a6c4c9e83bcf6f1322c37a88d68

SHA512
cada33eb38bdc5d4b73de94bae7f2ceedd2508431c76297d685a9b3e5b6e2072112531321e5b728a1aad92b3d55da16aef49a248dde896ff99c8a07b81b662a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea26a82bf5d970d8a652d4d7f831c637

SHA1
215269ed4cfc09ab7afdfb1b7e1031e8b201c94f

SHA256
dca426ff84bef2bc9d21b9e82adf895e289a25e5b545eec359e317b76be1190f

SHA512
d8d027e32cd87fc5af99e57ff4741cc4c094c7d47abda3a152ba7e1df59d67c0504c9cbf5458f35ed9e42d5210d35685871e31e43e59cb34004c1ada95d342c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4eab288cf41f4c2381b60d98217dc0d2

SHA1
d973f76daa89c3f78e21b9b3ec2c7a838ffa2b98

SHA256
04478623b925650cf6c8de7ea7dedfab897fa5c9f93f44228b53590acbbc848a

SHA512
0556c0830f3046182a67df6b7070ee54d701b29401d4bb508d89027a9a421215e268c3b7662566dce7a861dcce2627d481d40db3c80f919d7919753aff614f24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc2952e0b47ca738d2034866ae1605f1

SHA1
e209f8be7d9e8b5b5cf02a1437d0863a8a66197a

SHA256
8e2cff2611bc3746f811f0a5f8bc28ef147e1b26359a3e0533fa2a023f671a46

SHA512
44b8a4fc35a861f2f6514e5ce7b0b5cdab242265120d2122f0dbde8ef559b8418b82248257778225226fe859885cd21490b7c8bd6ffc5ad872e5f7de88c1c185

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e67da4dffd9d0ea46e2b3b88612855ac

SHA1
e086c51fa509cdd05e58c9d481dca68b3b2c40dd

SHA256
d70bfe630a364ee9dc75066136258867e36d78be99e9aafe790a6af9d640c2aa

SHA512
9bc2f072ff723aeef2f5aae61d62ae8c5489fa88839db238958edf39d834ccd417cb1da1f40cf7f1071f63f1c321ec81b5cfbda0ca545fe684885e4c8084115c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8423b65cb0f160c0064eca97d95fdb76

SHA1
bf7f621bef29e597d03c5a050bbedfa7e95cdd33

SHA256
cda5a050feba5d222365317c5a61885d3dfc1480c8ff8101b42eb792c5a10b6a

SHA512
c1ad954972272be12a10f3429f2a1dbdd842189154e97c625784039b606d576eed3c9787b179ca2bb149d517b270fc31786a039bbc553f049ebd3870f2dd793a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c2940265ff0eca8215fb38c2d4a500c

SHA1
14822bcec33800f3b791a36e819d41e2713742a1

SHA256
ac2a1f1e20783f700e8adfe439ddd3e5ca585d6e9ef855b0087a89cc7a9d82d9

SHA512
12bb72e624f798fa10fdb2f63a39c183efb43f51c9da351a9763154e7618648a96602c68190bd972c840d1bd8ed110d44ce6a28c622f3b52196cd6e08929647c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ba6a20aeffca769783e50cfd4854ec4

SHA1
a41a879e9856628a80668e9d73373b64d5ef96da

SHA256
a10a1586513f74beff469eb5df2b28500b3f93a0bd32960662a942bc68505aca

SHA512
9b8cbb89c017682227dc709c846178ce22400d6ca5f0441592f5fbc799f65926c7ac3f19e13fec99078f2bf8ef7274b21642c15220deaf90ee515a527bc3a349

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee05e313ef6fa5f736113b99c3044436

SHA1
c2c9f68c5541920bef6cbdd6b999b6b0b8357f7e

SHA256
e20173d5ee79bd4df347cd474ba5a8c72de7972f689255ff7282cbe9f464e10b

SHA512
3b50e1e38a737277b88cbb74dcf9b4159e68be6177305574ef8c974b20fa2d30a486e3a15ae547b3f62cea9068c03b521d3a50c16b0b392b1955b97efa812dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4AC8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4B77.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit