27ea7ee15fab4b76161cd875e3666ef5b3bd6046711299ff696ec79aa2663e54

Analysis

max time kernel
131s
max time network
144s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/09/2024, 19:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd077aaa7420d4dc930db76a0e046fd6_JaffaCakes118.html
Size

125KB
MD5

fd077aaa7420d4dc930db76a0e046fd6
SHA1

f8f82d48774d8fc7c53d02f7cdda6bbcfee390c9
SHA256

27ea7ee15fab4b76161cd875e3666ef5b3bd6046711299ff696ec79aa2663e54
SHA512

1e78aa8aa39bf9030804d77f2c7f23fdb886e0f184c149cb9530f9e5e8ffb050058175fb3cb4588027eb7b8f8b9b9660029132fb69982cba7c4926987d95df0b
SSDEEP

3072:cpntYHyGrHJGuH+GPHdG9HAG+HDGpHTG7H7G+HTGyHTGoHoGrHkGsHpGnHYGoHRe:cjYHyGrHJGuH+GPHdG9HAG+HDGpHTG7/

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433715018"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{321BD901-7DD3-11EF-9204-FE6EB537C9A6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1916	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1916	iexplore.exe
1916	iexplore.exe
1920	IEXPLORE.EXE
1920	IEXPLORE.EXE
1920	IEXPLORE.EXE
1920	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 1920	1916	iexplore.exe	31
PID 1916 wrote to memory of 1920	1916	iexplore.exe	31
PID 1916 wrote to memory of 1920	1916	iexplore.exe	31
PID 1916 wrote to memory of 1920	1916	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fd077aaa7420d4dc930db76a0e046fd6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1916 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dec853563fa19de06ff46de8eb7050bc

SHA1
e6fffcfe3d762a214cbf5abe980d07084cc31d79

SHA256
79d6dc48bb8b33e865c51688c0e8fc10c29887a47d1416dd4edbfad5201d7466

SHA512
44dde843c435002eaaa5a525a1dcd264797696ef3b6ac657cdf7f7ad84db87e0ab3fe3f6ab7447ee75847e5247971e1c4a7759c00a8cff14d12651b9a34e1847

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73827f9a3766b3c9919b5bafb6aa2908

SHA1
59d39eea4eb8df3e061fcf456d3e1c37184e4d19

SHA256
081dca831488f2718d18d97530df763614efe2cdcb71a8e9b5b67ad311aed5e5

SHA512
c7ba5e1af8d2696829608a3385662b9094a648e249aadd6f3942b89c2b3cf043c04e70af72c71504de2df51506e3b155fc43cc697bf5cf0e544e4eb8edfe1eac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3822664c8f89e651f2d426b5fcc20a5

SHA1
5f0be408efa1173b5738cf9d424591e4daf3411a

SHA256
7e74af6126e29d50ca40b01e23aeddf07e1c4f680349d969ac04943eb5297abf

SHA512
65bfc90b7407247873119fa530767f2016e88b52bc4fdcfdd1b4e69bcde4e1aa423e311366b3cad3cbb2154f7be405f1b59b39a7bb96f6ca19418fba70f6bbd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cdbc4200f3325ac382c9aa17bd7c0e4f

SHA1
079a32d9dbff9d14bacd693ad6a0b62c84f3bad5

SHA256
40595432f9692ddd05152cefd7466333dad399edf52e7ae89b08c3f15cd5ee5f

SHA512
28e9aa3a984b4c9e78c991f926ce6717ecf4cfa28c7e8dbbbd0876cf2d5f40e4d1c2ad198b6391b9ee51fb2cd9d3524f13551fb70f2a34df1a719bc497f1e884

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a631bbb2909dc61b0cdd2cfbf0e2869

SHA1
08d1b6a1f479e777f9e71b382d770d3f79387242

SHA256
a86901cc8f59dfc42fa736534841e1dbaacfb204b23c17aabe0640ede2f92833

SHA512
7ba7668ae4e14f74cc4d1bf6f8475e68a7caaf4a80ef51e5d00c48d832fc6ad64d6948b30d0a3c198b8e10027df1ff5f5629bbbf495aefaf3b1295f1baa71a86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b687b42ca1c8c7bcc5b4992d7e8183a9

SHA1
3a2e0e1acf1e03c2490d5db03a5fe1962054f6a5

SHA256
378ad7d146ba21fb52824927e8039687aa45a3856fab8a6064136b470013e583

SHA512
a73e5e8c453cc601fbaa2723a0c51ac3ad0be057c6d59ff4818734922344a19438e678f627225189084bc8cd212e6348a6846b50f32660e14dea421716dba796

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7f1cb450ad009e00bc6c491dd73d55d

SHA1
84484c97fff694e5801b83c430c9835d3fafae21

SHA256
50004788d29322f3af76f26c4f98aac82d902ee2e8d240d3121ffd796e26451f

SHA512
658fed81cb61539952552eedf7c294d00efb7e0199b3e05d0c522f187971bd3b9771866140449fea43000e0ef9cc78f4be7194946b166a33089877358da4c4d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b1afd28294150b02f48761281c603b4

SHA1
f5688b01660468e8805789b6a0f192c71b9e5d54

SHA256
c236d8e1d124f08c815d01bb0a60a319948f3bb1a3fd4b1d5965cad6f87932be

SHA512
a52b6077e5e219cf2db31eef1f760a5034667b694a0a97c1d4474284103c0fd1aa685943ee9de9958cd76a8ae2b4f396aefce96ec49f2d2bfe5828f540fff16d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b69373db0c6bd06ad131fce0bff3c7a

SHA1
6f6ea31894cb3841fe332fb4ce573cd59db0f789

SHA256
c26b2c1bd2b386175dc9e539f554727734415c7d1bc233d827484eebf7f18191

SHA512
a6552d3a44410e133e442a673b822e1981e50cfb0d07940e1540801b4576e591c713b149b8b5b02def9ae18353801c41335f5c0b1d74ea87ff36056d634cff75

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE908.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE97A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit