f36e1345f37903789852ca44a8fbbaafe8f359065333c1ff203207725970e8e1

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 17:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fcc85a1942ddc37809220b288ab13cee_JaffaCakes118.html
Size

462KB
MD5

fcc85a1942ddc37809220b288ab13cee
SHA1

a4d8f3a8d4bb66fe8fe5d1efb4d82fc2141c2847
SHA256

f36e1345f37903789852ca44a8fbbaafe8f359065333c1ff203207725970e8e1
SHA512

2b039633c5a317458090ccebf6731d884a392fbadd2a2728f90d5edb3ea83c1a730cc9e4c0e2a712af1dce5ce9613e81024339f28bea8cd4cb6aedb1d8c80c0b
SSDEEP

6144:SfsMYod+X3oI+Yn3sMYod+X3oI+YIsMYod+X3oI+YLsMYod+X3oI+YQ:o5d+X3R5d+X3A5d+X315d+X3+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F2897B91-7DBD-11EF-8202-7A9F8CACAEA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd3000000000200000000001066000000010000200000004e5b5bca1ef8a20426f2908ab5eaa4be7bf5441cae8ffeca92cd7cf49f1f76e9000000000e8000000002000020000000c1468ae5825bb44171be51c037c62c1d1e9f0f89425853848062e25eb1134869200000000d8a79ba25835906d46517df3d85b84ce1cf28ad637a82d353c4c9649e36a04f4000000070f02ce820f9947a41133b80b425b6962b43333b94e497dd9f59e952b2c1c542a7a5b2e02cfda663a9762639b9082f2132c6c0fcaa8c9e11f8abb1b139d25579	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd30000000002000000000010660000000100002000000093de60fefe919708bcd7407a9d9eee4d68022064a31f306f404e97cbeef5c392000000000e8000000002000020000000ead130284f4d4adfe1474561378be9af7f266b62fb93f5a5b1baaae01c36bdbc90000000f7770e59d04efa847183869ade1ec31730c107f2bd222ff39f3bcec428e1fb27e2437374602a317480c4f1c278f0f8a6952bac8a6bee5648b412f4ba500478ce28cc6395e4d5c5a126bce6e7b0c170762d293d9f0ee4068f93f47dc3d022440eedf879b76f94f13c803cb42b08ff2905668eefd01b0ae3ca57cfd852be5ed096b65ff352209585f4dfd3c05e2104fd8740000000715a7726a55ddebc382fd0d287bbaf54854e44dbd22c3deb7559c9430d6b66130c9a6d2a2453b8ffa1d83b48699ffc2213edaba5542a21aecb99ad469f103ec0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433705893"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70d99eccca11db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2408	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2408	iexplore.exe
2408	iexplore.exe
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE
2368	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2368	2408	iexplore.exe	31
PID 2408 wrote to memory of 2368	2408	iexplore.exe	31
PID 2408 wrote to memory of 2368	2408	iexplore.exe	31
PID 2408 wrote to memory of 2368	2408	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fcc85a1942ddc37809220b288ab13cee_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2408 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9514ee5b563cae012797838265b89b0a

SHA1
9596e3b253d0688df2f24face311ad045e70ac6f

SHA256
2eae5234d56c5e23fd3056f1aed1b16e90ffc1af37dea91ec03f68ef626930d9

SHA512
9fa4b11acdca4c72aaf67c3d13f1258528522ec73e574927ee7b4b04a1f82a0604e9fe84f810a8e28bf1ae056b0396d4e00deb9eaf1158c698efe3aec76b2c40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2b12d4d3e0c659849044033b228c9f5

SHA1
b033924cd6aa9e54a4e83b5f2cf285ef1399eddb

SHA256
447ff06702b50e7cf1005e73860ce5ad0f86e58d573f59d0e3c37166dbacbc11

SHA512
9e4257e148ad58925120c3d3e311f56f55fe365bd5a1a5661bf8ff4a4bc96a5d4a7e97c1db0a363824f6d644b090b3cd25c5400b41606adffd43bf227d106064

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c69777d205f42918be9b33ed310e095

SHA1
b19bf7004754e27169535d230d7f68aa3b604492

SHA256
555c9651fc807c652df4c1584a4cd155b2fe78d019be514294f72fa581312554

SHA512
88a8d4ce2daf146d8de7048aa33bcb2fc6efccf220807cf250254312685cbea79036d5061e4b5b0c5f48a349d19acf8a9b153d57c89503cf1e2d5731e13f448f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f8b737eed6232205f45e09fcfbd9cb6

SHA1
e3fc2719cb5bf96a6107a86e069682509fef5f97

SHA256
00a0f81ac9ffa599f7462cf9a5fd8af802244596edb7474d17529fcb398d3241

SHA512
ae972f2921dfe093a6e3fbf156d98af284d518420dc3058d0f31b1e8de39f3db6354a3e5c645900ad52fe4b15cc6d6922d7a77174a705fc0053543e8f084cf7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb1610ff4516306e2e4e2de6f083cd97

SHA1
12144e6f3640cb21cb9a4ccb0635d8b651cca04b

SHA256
9fb6d4fd221f4826a3e24402d1ae99f70ae6d93f2406a3dbd2cc5acac88f4b61

SHA512
753e700e4df2e9742ffba8e4375d7b372e69e9cf62cb9bd7abd19949dd80d83d088ac501a66fd39444b6ffe2b928ac5b07d6c8a1c89d857f38cde46c52723aca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c203f2c661f6d4fccbb06fcad060c77

SHA1
3925b2e9de3e9ffb436b229f788047b22335fe8f

SHA256
2b06af988a7aa47b5e9dc2a4ba0625ef83240b6eb91a71522f7d5bf4298e9446

SHA512
ef1e55f6667ec5a6457db610fbf18dca77074366033820f10f1232182cf4006dafb60f1ea52fd83eab5b1dbf04471aaa0bfe8b2cc537ba1deeac5c1a13061203

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5cc40ba8eaa5835959a7e6c4e335868d

SHA1
cf8e23e6871d92c78c292cb26966ec658178521b

SHA256
466d98900435ddb0626fb17dc011313c5d51ed43875dd8220b2d7ae7c512c4fc

SHA512
32b1fc6737dc5902d9691161d8ddb58bdbc54c217eebaded86008fd93963375a8d01ce55f05a6435ff35d81ebee80c58226815e9a5d8134e7f7b5c4ac447b7f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69d4cb2339b07bdd8bc2e18a3eb9f84b

SHA1
1e4369f83b76d137ee1fba758cee94eee43007a4

SHA256
51864f87d4087107d2573e94f1dc9b42f409343aea9138da643974624efc2262

SHA512
85c12576890ec0a84f6cd9d045dbdfe9b5c73ff809b1ec5c735477cd03e0c7884e1302d1afc14e7a81913dbcd710d3b884ce63d28ff449d0ea0542774adcda18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26081949713e2de724d1264224e82281

SHA1
ee2375bd4ccf86fca2d265c694165ebb5744fb01

SHA256
7e9b5ff17c0e2dff0861a64fc8e130509edc36beeaf7cb1dcf298778f554ea23

SHA512
8aba4170a15227cd07253586a570fe8168d5fc897216eeae4ae4850397db9d6fcf2e67efca505275c0c051657ee786d498f6d651fa125d8c26cf767ef4ba06ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b103712448790335cb614d04fd32e03

SHA1
a60bb4f1e8083e867c3ee830f9c8934599f3e982

SHA256
de1b5242c5602097ee6d464f3fe0403cd7a913a2760cfc3497c7f1de5d8f0545

SHA512
f00fdcb1f321df780ba8078ab3b53b8af00364a3968e69edf6f176d099d28a03c71dfd5e3a08e3f9ccca5ccd7f4f12bcbc8178da834ba7611638bd131af23dd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB79.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBE9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit