b9413f14101041e433c510a316701fed914b4034da37aa6a55d31600cbae58e8

Analysis

max time kernel
139s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 17:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fcd56f290e56e56581672a478cc86541_JaffaCakes118.html
Size

134KB
MD5

fcd56f290e56e56581672a478cc86541
SHA1

0286c03d8d779b7a674ec65c1efbfe81efddad95
SHA256

b9413f14101041e433c510a316701fed914b4034da37aa6a55d31600cbae58e8
SHA512

6266a590e221cb9cda0cb50fa4b02e8929c18783686fc1d6761dda3daed47f9e20f202c2207c4d0a3d5658f99522dc5bfebab6e3b69235de9936686f69a3977b
SSDEEP

3072:Se+TJdbCSiS/5a30yfkMY+BES09JXAnyrZalI+YQ:SeiJdbCSiS/e5sMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{64547231-7DC2-11EF-A444-523A95B0E536} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433707801"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2528	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2528	iexplore.exe
2528	iexplore.exe
2408	IEXPLORE.EXE
2408	IEXPLORE.EXE
2408	IEXPLORE.EXE
2408	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2408	2528	iexplore.exe	30
PID 2528 wrote to memory of 2408	2528	iexplore.exe	30
PID 2528 wrote to memory of 2408	2528	iexplore.exe	30
PID 2528 wrote to memory of 2408	2528	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fcd56f290e56e56581672a478cc86541_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2528 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
662d5f0e852d55bbfd4d9c3f12e02938

SHA1
d4e88c0cdbccc29e62ba720970c2960a706cfe4d

SHA256
7868bd07365f1746a9078405091efc29604228b2ff7619d697ea3c0388547eed

SHA512
0676c594809434657cd36dd0df96143863a77b3fa3a771e52565f1c0d138d57c8095c9ebabfe1b10abb36e22df99d11eff04c1153389ee0f24425dc538990113

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7d4380ff2bac409a587b949dd32480a

SHA1
73718e03df9c656bc36f9044f5879b8499371198

SHA256
fe83d8dffa0ec5fd122df166eabde609e5ab2a3027e1b859341a033003295900

SHA512
47a5b0fddea4a7065de57f566bbf351ceb48ee399424d77dbe0ed5c6ff11b78846e840f42ac36e9f8416d77bda001b8f5735051841a7c16d68149b71e9b79ee7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2483c066f10e49ca4fda5b83f2886813

SHA1
5e09bfacce8324960c42ac70ff5c716d080941c1

SHA256
79a10d8fc384b22779d5edf8a17966aa8e968c9f8cfb5082603618f551e92035

SHA512
0826ec28f7ca02df74da361faeabcf2efd6934f66f95af5e1fa89348c07fee3aa0d91650f8720c7ed314e058876cebef698c0554e1d571a21ccda6e000547ba2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bfa14b902907b4c80b1d7c499cf10885

SHA1
8ffab4b7aeeebccf02380246b2bd685f6c3073c1

SHA256
1234fca59884255ca25dc508bcd9a5eb1d67c1a4fe6eaf4a2091fb88eef21f2e

SHA512
c1c5c723368f3f5c5a22ee876e16d64e43ad9d448fb39736a58bbaa93233ad0e59a412061670a14c88a46429604edbdbf975af6f3fd806c7cd9e1de61fd8d4d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3827eb1ce295ae8cce036c740261c5e

SHA1
0377ed73abb1fd8ce7929aa14ab4d257aac80dd1

SHA256
5c96e8f3cfee7ab030debc09c515ef5552080cd9ff01e7d9b2632594f4d7fde1

SHA512
976572e5c4b84f30cfa17acd8d305a6b8cf66ffa98559fe73efffa1b5482980ad6e0354f7855bf111a7126c30f748da23317bdb4fe678e4b6adf17f5bfc3da03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c67827eb2f9b8d48d9e122610f6f9730

SHA1
805022d6e314e5151f07435866c0ec756d4b5744

SHA256
a5f752a3bb7e6d860946c42f00f47fb21a8fd10b31357e87c95294db98a081b2

SHA512
f2db19073a37442118e3c2c457458c9f47f989709b4a58b910e4ff06844e29108c15b5d48efbcfd5a5febe6b176ae8a7b715ad6595e136745b9783914d90c51d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4a54b83e7a4b1dd4ffb5ae86da76842

SHA1
953152bff1627635902cd4ceafbd7ccb15624001

SHA256
3b403ae101c89dbd94d2ec16d55fcd632d67139b1c53eedc7c264e45794e727e

SHA512
344f69343a8347588cf37535b22bba37865ac7a8ceb0ac839811c8b1e91589fea33e240d2a1d2cf998b84f062cf92046b52bddf3030571f76dcf02ed050c6573

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7fef5b012a27d56379840b41929f56c

SHA1
cb178b48602b68f59849688845ed21f27aa4d840

SHA256
019a4241394e99e9853131594be6dff9869e31faf8d9e3f465e6225d96ee27b1

SHA512
bb922df9d1d3cc956a38afeab0cda5589e68c298d5527eb55b954025710d4159127647049d785539f3471f190fda0369f2d1f63b1a33dc9f0cc631c05e502f83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19b13be3a271e76174e39c4f9a73a720

SHA1
a9e3ec293a18b3906ec79d06773d52a884ec0a92

SHA256
e8c465cbf94467f254f9dd3e12bc6c0c2f64a3c9da91df06727ab010c994d397

SHA512
101718d18187df2e51dcd453ee0bdb52e982e50d13bbd6d64d9a1d55a34748384cd39821d92731b5f5289859369d68ba8606c67476e704d300c55b1b577d6370

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d11f02a507140905fa1becf0aa5bb7c9

SHA1
9709c560fde7b0030b512349cb6f049f2100fdd0

SHA256
fcab264426553ca6519648451000b417450dd56da15c53d7df4e5024dfdc8b7c

SHA512
36862d2281a51bb41404f895ff25f81b74b60b74e5fda8ab49db2760a3f7664814146e83e94bf0373d8a288ddca54427e369f5a7d2b71b8deaffe32586009695

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBD87.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBE26.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit