bc66b092ac1f76c62d6c57b306e84c827aa59a672214685fc234d2519fcf8643

Analysis

max time kernel
130s
max time network
140s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc83daab13da564f9f5dae4cbed7ea98_JaffaCakes118.html
Size

21KB
MD5

fc83daab13da564f9f5dae4cbed7ea98
SHA1

358b5646ef229e8a5725b4cac8d6a16d0952f34d
SHA256

bc66b092ac1f76c62d6c57b306e84c827aa59a672214685fc234d2519fcf8643
SHA512

bd768d62f241517560d9ab6dbd8e80993f35f8a7230ffef9504f71da89a5ca693ff2b66fe5c558a4146ee5a4624d2699a9d89708c40a9706ae3e738f1ece3f35
SSDEEP

192:SIM3t0I5fo9cOQivXQWxZxdkVSoAIV4nzUnjBhJT82qDB8:SIMd0I5nO9HdsvJIxDB8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433696380"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CCF3A241-7DA7-11EF-B467-D2C9064578DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2568	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2568	iexplore.exe
2568	iexplore.exe
1616	IEXPLORE.EXE
1616	IEXPLORE.EXE
1616	IEXPLORE.EXE
1616	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 1616	2568	iexplore.exe	30
PID 2568 wrote to memory of 1616	2568	iexplore.exe	30
PID 2568 wrote to memory of 1616	2568	iexplore.exe	30
PID 2568 wrote to memory of 1616	2568	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fc83daab13da564f9f5dae4cbed7ea98_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2568 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
192369898bce0b46516178123d54cc66

SHA1
590036f0067abf5a3861ce886b21b86caa09f68e

SHA256
84ffdf92751ee5352a26fe47aeaeafda049585fb5f4ba61ad1ed096498e1b545

SHA512
8a8ba9f2a2e19f381fcf658d4125b9637558ea059a7cfb132f6add734fe7107431593b639e8ebba06a00cc61b53129775f94ab508dff056b6fcfbc0290701e2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26f1312fc1d2727ceb2f7b0410879dd2

SHA1
9212924ce6885691427edb1e37b11cf4c8115027

SHA256
400029759b7ce80e55e3011fdb350a843bafa028348b881e4a2155f73e7f3fbd

SHA512
d55c0bd6423ec6f623620097f8b148111fce8fbae890ad2167c57ba81509dcb8fb7897de2b377b13c46f655303907cdfc20aba51d7914cdb7ced77757d2054cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2d309a5e5c430475e7153064b690261

SHA1
911c855b60237694438a2506a645f6b8425b6bc3

SHA256
ff5fe3439107e36f8c9d392fc758e89d3be1b52bd9c88cb37a14519efeeabdbf

SHA512
9bd7c8b492c0990e05f72e4c7fbf6525781e316ecf49ac1939e483719c35f1acfd9fdc3d3f8457917a183235d5d8f952b4d425fd31594b8430a2bda2b127c202

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c477b0eeb0b4843fd505352f0ca3947

SHA1
7f6167423abc04b4da794e235eaaa873e0033ee2

SHA256
cf96346b619cd63b084f197aeb387af47fbff506db9863aa1e3638757733738c

SHA512
9483f13e55332b569ba9f4f7d538599ddc6ce7aaa883ba8d6290a938742164566955feb80114d66393ecbf360f8672ccf37da3b5c6ec169d42d555c2e787d9d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
449c76c81a29e64e0b6918d9e351beb1

SHA1
2578be6eb69d5c4229401063d708e27068faf273

SHA256
84f063ec234efa18a21680e7a94f2184a9cde8bf7866f0158e227a81e0633cec

SHA512
6ca38d85c9f4b95cb424b630a0398b65df787e18d06aac3ddc22c507ed2c1f9e09e60235e3803ef64a51c16b77fd30c51815f061ffce3e5335d798f69bc1fc09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b68bb99902a6f2e2717f3fd69f064b2

SHA1
4f119f0682aabd868bdf90e2aa43205bf3f2986d

SHA256
d2b58148e6ea2a5159a0b6e6339cca8d2384bdcd30eccf3922d20ad0942ff15e

SHA512
02cfbc8c4034c812bd0b8a38f90a512ce9bbb2bede7ea1931eee72d6caa726f0712ad470722589379b5af370ded92aff73c93611fb3ed8da607eb32fde603e86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
443a8d38e7531382b92d70d38b81a7d6

SHA1
ec8a5b2418719c0cce09dc79d9aeaf078369e4d1

SHA256
1a1c153e30e37bdd699a99c215e16d87dc3b494f983c49c026cb9cb25a04a54a

SHA512
ca5bf0b69ee1dd2c2693466c0d04934082c4f4e387082723dd90a0941728d03c095502bd8a673aed72c9e2eced1ad3d98c3b4aafdd4663ff01443ced609859ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5a345c7bae64334393e7886f8b349e9

SHA1
028d363d7f507a595134653180c86e78f643737f

SHA256
852e88bce3bc8324d3f6fd99a5ada0dac00460741ff171642654dbfce235010a

SHA512
84bc819057bddeacade21b1adca57cf3e60060d27f18c97cd259541ba8a2aabafa73810b34ec9cb2c00ed01dd1713d39e6fdda485d09381200844213f427fa25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bcfe636799e6c46164d2d4de19bf8bbe

SHA1
d4f05a42cd5235e40873178842e725c864e23ec8

SHA256
07a37dbe56b5b1bb52afda2d1678548bf0e035569de3237b112a9a1d7fc2bf7a

SHA512
ffa19e2cbed97d742117acb26d66dbad40e7673f77d5229e03cab7ea75aa5c82c5e115f8865022838ee1db92d19db3c449ac1f9da81af3a14c4ebfefbbda48ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB117.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB1A8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit