178adfe898a4a9287301e991249f1c49460584d60203c18242dccb3d1c242879

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 15:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fc92a9e5dac4fdcec810000ddeaace7d_JaffaCakes118.html
Size

912B
MD5

fc92a9e5dac4fdcec810000ddeaace7d
SHA1

1c6926d398f139f8de7debd239a6fc3311407de1
SHA256

178adfe898a4a9287301e991249f1c49460584d60203c18242dccb3d1c242879
SHA512

ca29dcaa460613eb17457d3225edf1a82383b16f32d0fad7e9b3c2fe54ff8150b29821ee04f30a750e562a27c12118473dc49bdd6f3eb11516244d22203786b3

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000136251b1c65ca4031ea55f55626887132c075e4640d0cce8bdaebb7d6ac314ca000000000e8000000002000020000000bfa5ead1df97028dbdf1f2f2e48dd1ddda8aadeae809e5ca9bcd7d95e62f8ada20000000b1076e36801da096853b4dd8230929129291b104ba829990723ff1985515f8b940000000911f9abef8dcde603e997df50bec7f36d3d5ad12d107158ec0635fc06012fb49cd33921ddea0e286ba93e474d28752e0a05640e7ee7430854a26f3ea6f9c4805	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0858c62b911db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000773ea1491d0049239722ed93866b929220009ede8d1dfcfa25faa1f30723bfda000000000e8000000002000020000000ff33d2c6e55267f7c8b081eafb93a95b6e15372c7eedafab76f0afbbe44451c690000000ffebeca9762713c07f14f67c4d01618163aa023102b65e57992905753507489b2aa0956e4163c02c865b86285244cc91e366863c3861c5349f8f5a54eed331c12b2e85102e3848f31cd8976ceca1c67a767014691bc214466470f3079f3e5b4eccdc3608a13607a8d250d8d5770ee6fb849581adefc944964a0b7ef12ef097d14db2239dbc7817f3c7caa701c413e71440000000ebc3dcfc217b2e590d52eb562ac16c62accc03759836ffe753034bd94d59e1feff04e8d521b44b4a39670638eff754ed5bf58139e103917a2e97f42f60cdbd56	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8E0F21D1-7DAC-11EF-8B6F-725FF0DF1EEB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433698422"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2300	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2300	iexplore.exe
2300	iexplore.exe
2900	IEXPLORE.EXE
2900	IEXPLORE.EXE
2900	IEXPLORE.EXE
2900	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2900	2300	iexplore.exe	31
PID 2300 wrote to memory of 2900	2300	iexplore.exe	31
PID 2300 wrote to memory of 2900	2300	iexplore.exe	31
PID 2300 wrote to memory of 2900	2300	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fc92a9e5dac4fdcec810000ddeaace7d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2300 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99a51320f3893ed65a534feb195c7dec

SHA1
02b7c8e57be3d46554a18ae271dc1e08a49bd7d7

SHA256
85789577ea3dabcb9bec923adfc458d20a58dc4bde468222e4629dead8ceb71d

SHA512
f8b4bf6af012d92cab232a5f1edaa8de10579cfc875c245f393c8f80c1055cc43b4e8894c629810ba1e67bca87ff12ff207084e0a42804759be2a114fea0260d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db9b048e514c79bd466ede90720a8b6a

SHA1
28e7c0016e3e54579cf3c2145cd7dcb932863cc3

SHA256
743bd66012a453980a32d27e814503c5ceced8d27920eb5e7ec55716b867bc07

SHA512
cad1974fe972234354c678a112231b07015bff0bcce4e1dbed4f4acc2c276770309e8a114503a339d39e3ef330d507c45d38105ef4bc80c396ba11793277e4ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4696c30fb9d8d5644f27de1656f9bc0b

SHA1
efbcc771ae31c365adcc6686c0715a623d5fc903

SHA256
de24935d6a2b3798dfa9d1392905e0b9332d2580253908cdea7e2440b0b1226b

SHA512
d206116a5131c3450e390cf2bcd90efa9e45d00ef1d11a63e6396eebe0abeb0e3917bcc733921e5e6546f0ade49ddbde2e1f4b8a8780c4172842c753d25bd57c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fbadf6155a0f600e07c8a002cd0848c5

SHA1
ae1d50c2d00f41895de110eef41b03810afc5a87

SHA256
5f273afb31f723c41d181a1aa8c92aca6d5e6726f9dd84ea0e5adfd87c5a298d

SHA512
68fcc8b8d55d577ea8e0a277f736184d8de97b936ef23630320f840d068e6b8d03958420ee0d1b9b509df95a299b5ad78af046b78fc605fd09cf72f834f92d23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83e6ff693194927490de37a5f58b46c7

SHA1
ed92c457ef283719860b3f3ade0c310ee4dd1f6a

SHA256
4a562efb87c912a0fa5d00f74dc509f93cc050264e5d664cfb7ae0161be56df0

SHA512
8c3951ef4d35aa1af509b0fde6bbf030a8a3d94b29d9618c32c41d127275c957f7fce54cfb482f0331657070049b52af236c12150d46c4698e2dbb170d083e3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7cedc65a7a317521780690f03fd89f7f

SHA1
22b468557900029e0be27fd9a0c36a22a555d721

SHA256
09a066233488deeea7812eeb0fb6c73a8976f331779f5b19e62a0ad184beaf0a

SHA512
a400195ddcd214c9c8fabeeb62f8e8ed03bba4a231d5479dcdce0ab69d8948819dc50009dcf2ec520ae7fcd227f65906f72446cf4f2ba3c10b634049998ec280

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87deb19a948d13a1627e855ffc394854

SHA1
004d2094a8ecccdd04f2f79cd85e8ef0d8ab512c

SHA256
04ec447990ffeebe6a3c9f57dda06a05c1b1a1f8f3d9c651b6e000fe95b7d98e

SHA512
57a606807d0df97e952fcaf3bed386c116876704d3c2fdd20d428f9f71dea79e2359d34732f891218981afe569d0c8b2a7fd004fa25144f1d9c0eb37c9d45917

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15fd5161c96507f69da2116319b99790

SHA1
2be2b9b770abd1440aa2e10e70ed96a1d34dc13c

SHA256
a2f00d701a7adc080dc4a9e80aa9f2a5f10b0e47b5619e6117cb2fdcef59de88

SHA512
08eef0a6ad6861c766d516e84c6bdace9c9c19d6672cb32c8977d8770c70f5d1bd852b88e3aac0b8a9c18f1ed84d8bb3cb11fde0f3f00bec9111526db940f6f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f11f4d4675468975c7073a6f7ed8102

SHA1
15681ca5f116af65082dd35ad50ce87c527240f4

SHA256
e64f5c751a82cf1ba17abbe11aea65a0fb9b04ce18c21a795ae61a2abe3533f6

SHA512
434f67ad038518532c8a03beabefb559676923e78b075b62cc6185221185791147d8a5c41c75ab48681a19e842fd315adf5ede36127533aeb326a95b6ff247b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
050f3ce9c8d329899e5dc9b3e05ad4de

SHA1
476d082ef675d3857446eb8ed446d0d941346597

SHA256
47c18722a9838be174acc3d5c2af096d1fd307f885a31d85b20651e266b4d1e1

SHA512
3d046754ad52b14821af8c8c41b73726e827a77898e5f19518648da53d5b21ab9ac625e76d5efd8cc67f0e0b53cc3a30667c325bf4ad3776a4ab570c2500f820

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF99C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFA4C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit