e35155a7bf277a6e949151d1d2345be3771910a5b4372876d2cb887ad733987e

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 15:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc90f4f19019e3f32ae8463ef5565171_JaffaCakes118.html
Size

52KB
MD5

fc90f4f19019e3f32ae8463ef5565171
SHA1

b2f3289c81130ef06c9b579a220de73a4c64999e
SHA256

e35155a7bf277a6e949151d1d2345be3771910a5b4372876d2cb887ad733987e
SHA512

88a11208b9292762cf6b1561002261e14efca87b1a1659805daf733cfdb8721b094af674b75ac6a24bc69ce9356a6ad40d6f4a50c7d706590fb276a5fccc6e5e
SSDEEP

1536:SdtaYT//ysnzNm9F18HZksnzNm9F18HVAvQU7kJcO+SmzkU0eqRp/vScJB3+/g9Z:SdtaYT//ysn4Sksn4ELH46Ssq4NgWn0w

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433698148"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EA1FC931-7DAB-11EF-9B59-D60C98DC526F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2672	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2672	iexplore.exe
2672	iexplore.exe
1324	IEXPLORE.EXE
1324	IEXPLORE.EXE
1324	IEXPLORE.EXE
1324	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 1324	2672	iexplore.exe	29
PID 2672 wrote to memory of 1324	2672	iexplore.exe	29
PID 2672 wrote to memory of 1324	2672	iexplore.exe	29
PID 2672 wrote to memory of 1324	2672	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fc90f4f19019e3f32ae8463ef5565171_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2672 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e95d3247b07bb7b68ddf1f4001fb9c4

SHA1
a3af2ff7403259a5aafa2787011afca639b83836

SHA256
73e0fa7ef760cf3ad37ebad7ac661f615ac5183b967c9c22aca9c9b2b7db0eb7

SHA512
895b6f2e60d9326410d7d854fd6290e9c2f00878d9025f9835aed1b47865347278015f92dcba7d7ab53d0c3e81cae92faee402bcb9873ebf612fc431e60fb644

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea961d2174a4cef89419d64d82acd8b0

SHA1
e2d0f39491aadde445ffb4c37bc3822e758f7141

SHA256
ebb2a58cfb71441fa795e937b04d43aa5a88713efb5baac3b26277b6e6456b55

SHA512
8daee91e14394add060e497470bbb7154fd93c307a520bae720016069309ea6222a5e55586d446f1a3009f5053228bc24c6b2af602d8de5c17964fdd383809e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b46fd562f63dc0855d3ebc65f75a3532

SHA1
d916c4f770cc7e4d9f61cd90a30a27f411fe0e95

SHA256
ea9e3cc295b3b74a7965ac972407a57ad2478a92e257fc18c287f2c66132fef0

SHA512
98df6adbc882218b81bd2111c728fa2d13e1c6e24bea94e8666be31de81d81bb43747d291d3787cf5f29c88db62e18bb5352bd7ef028b51e26e34b1888b05cbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
957ae2d6cf40f39e27e1b57c516e634f

SHA1
65f6e3894cbd6786fda922fd8d10ba0a63fb962c

SHA256
9674af9e764db93c1acdc7c88a14c872befa762976e042539337ae4d3556e0f9

SHA512
e6b53d4ce2f91a4f902e4d2a18f37827adce9907c4872bde8ec6e38c9e5ed35d91f9aaf872db9fd4952ea797730bcc950c3f519f862c8a7436aca114194677c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3600b420117a2c0eba40d08ce833002

SHA1
8e641ed77aa4bc31dd3e5a1623a9265fd9578d7c

SHA256
c8bd587534efa4f139487c163988003929a72b9a5057bc3d98608c1c273dd48e

SHA512
7fbc77903d22d206295622f6d2d7d07fa9257ac061f0d67e5f200442d2fc158065ee5bb3f15e7b4e3d973d0789278f95eca3ce75411c7703a9aa048b0253740a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82138e0321c10f2c6deec6b26ecc5057

SHA1
e0b3baacd0816e971fc09a0d323e31602ccfef74

SHA256
4b55c773ac96a2e7692106f6d86300b1f895babaef46ff263f5a6393ad867079

SHA512
772005176b392bb7c4bec0453948583cbd073071edf5c7ebd5050515f8e4be02b2445636548627ca000f52d9d0164e15c6bb197f87cbe1a1cfa18dab2a25e44d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a83b07995de7e1a49b7332d7598169a

SHA1
54d468effd6b9771328b7121b5115666cd4b54f3

SHA256
1e2b9c5e1fd7a9e24976a9114a51f37c979b00bde34372a5e20255c9d6b9c35b

SHA512
2c42dae2381c6a4040245d9c236d0fea58512c69dd1238677f06548ac9d5c1fa616b941eb889fe0d3b83e385ed89d1c148319798642c4c1ad96c8b5ab99985a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
003906396741df94b5c71b153f482c4b

SHA1
f09aa94c519cc4cb47b80565f4729df51fe2bea4

SHA256
fff328d3c7bca58b666e010c29d6624d0b25e5b8fcb888b195f1facb54fdb9f3

SHA512
e551663e077dc3f039ab8287aa19e5a7c7fd68e76a20f1ea5d5b79dee700593c9b24cf28fde38b3f84de6b81a2929646c38dde9f86d15a37d27862974ae93821

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3e725832aa8e3396a8db4c10cb1c080

SHA1
f582844382ddebe5603a3f010f87f22834b0920f

SHA256
43aa8a962291943d0e128f780838d8bb9735eed5b656e4d2b4bc947f5c6f6b08

SHA512
80887156808b6feae29ddea4051a4dce02c4fc92f165dddffc502673335462c4304e53768d416f3bca70fafb87b86eab1e1acc2257292ccfc69c9a8fcd3224f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6d67fbe2b0291d07af975823090469a

SHA1
162c132136dbb8a8f89ae6f2120fdb80913977e0

SHA256
65b11657248bf4b7936be98cf3c1307f5a061b4ee717e052cbd7776c97ac933a

SHA512
046f235790e2672a210704691aaded2462d40fc2f18f51e64e234d8ed05254346a02c4449be3cd9ad3d30b4e05194e8e8b10f1941e5dac192ac398733793699a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e8899b11550796091313ae49df9c13e

SHA1
b9c9f905097bb4b3891723daeb8366f6b734a44b

SHA256
b7bea14a4b9acc12cf2e14bbb6094479369923e1bbc0cac3fb0352a5065e7765

SHA512
a8cfe26479ef1233c08ad983b59ff0b29470f927c7fe66d1e69964e0836c51ac10844ee87c49cc25e279a8a94f834cc887b9bad0cf9ab4096a17b3180415d4a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\56KJ964X\ga[1].js

Filesize
45KB

MD5
e9372f0ebbcf71f851e3d321ef2a8e5a

SHA1
2c7d19d1af7d97085c977d1b69dcb8b84483d87c

SHA256
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

SHA512
c3a1c74ac968fc2fa366d9c25442162773db9af1289adfb165fc71e7750a7e62bd22f424f241730f3c2427afff8a540c214b3b97219a360a231d4875e6ddee6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NQU8S4LJ\WeiboShow[3].htm

Filesize
20B

MD5
7029066c27ac6f5ef18d660d5741979a

SHA1
46c6643f07aa7f6bfe7118de926b86defc5087c4

SHA256
59869db34853933b239f1e2219cf7d431da006aa919635478511fabbfc8849d2

SHA512
7e8e93f4a89ce7fae011403e14a1d53544c6e6f6b6010d61129dc27937806d2b03802610d7999eab33a4c36b0f9e001d9d76001b8354087634c1aa9c740c536f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YTZJPBOG\WeiboShow[3].htm

Filesize
171B

MD5
57d4df52bbac8d80282b1b413d395363

SHA1
51501b66afd4af9a38f7353a85b1052e6b6bfbf0

SHA256
d9e4021adc7c405b14e031005ca8e92a4dee81ce7cc77cd3ce73261f22afca20

SHA512
bb11df92e241e0a8d9b8344c65d4556bba7cabfe88ca02561c14dbb8250befcf8d1a823e48e5e1ad56571786ac4acddaf23013eb85df1be7681cfede10310ceb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9CEB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9CED.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit