b3d2dc9ae493a7686c29da6cebf4e2f7f6564660faadc2dc29f41b8f9a4fe71c

Analysis

max time kernel
134s
max time network
127s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 01:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

82936b75d1c448a3c0fe8132a0760f4d_JaffaCakes118.html
Size

11KB
MD5

82936b75d1c448a3c0fe8132a0760f4d
SHA1

631ff3f75ebbcf193844358d3158355f8121271f
SHA256

b3d2dc9ae493a7686c29da6cebf4e2f7f6564660faadc2dc29f41b8f9a4fe71c
SHA512

7e395fea8aaa85abcc725bb0ce54afb9622ec64128b202a378d9d0502f7f3af9d19ffb7278ce3b1a0e0140ea88d3ecc25566ccdf485a3d6610e7905278e8c6f6
SSDEEP

192:csJbHR+k3tXqV3i7I3UO7x6jEOtgSJsvfNnxRAJ4+dPEK+M9huQpAcWZME:hHR+WQ3i7I3UexiEOiSJs9xRAJ4+dPEb

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1E724311-5071-11EF-8EE4-CE397B957442} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428725092"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1744	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1744	iexplore.exe
1744	iexplore.exe
2348	IEXPLORE.EXE
2348	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 2348	1744	iexplore.exe	30
PID 1744 wrote to memory of 2348	1744	iexplore.exe	30
PID 1744 wrote to memory of 2348	1744	iexplore.exe	30
PID 1744 wrote to memory of 2348	1744	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\82936b75d1c448a3c0fe8132a0760f4d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1744 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a704b32a8af3290b6fd61cae8062e71

SHA1
a9c040f899b0e96dc4f8a86a35c2078cd040a8b4

SHA256
9dbf98610250dcbbf126fed846d0d0d1cef547b98abb8eb16c2cdf43419d8e40

SHA512
c0e1cabf1031f07e682e23e50ffebf466811cde53c86257ac15dea1f448c2c21c9a7f65723bf09ad4e1a00eae87b2503d393d2b56f5395beb2444ae4d9b9c485

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
decb964e384b65e418eaaacb93f45fa4

SHA1
da11dcf7e7fe7384c596e98d9f4a8230779e917e

SHA256
bcc02f2852fccbf2a6f45f3f2442975a088db031c445a459f92f4fd50efe50f4

SHA512
2ed1cfe53f569eafe97377e166a05cd77c20e2e9fbb15686676feba28269869ecc3380803decc96b536ae172e4e78d3a15e845dcd663eeac2a9db65ea9b771b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0cdff7576f99ba387968d404ec9a1ee4

SHA1
53be702f1601e5e3a1e6ae3f6a9b37acd55a146f

SHA256
5da4fe80afa37d5347b47f6f7f3181360ec706779281b685840a6b25a8a9dccc

SHA512
0dc7b5cf94e1e4af4f457560e875bfa43c2707f1592178d0f0d9776ef8000278c4a23b003a8bce94e94295b5e35bcb9c5153c72d9e1938c9178ff3538136d2db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93ff19455cc12215b27ea5af84f2424c

SHA1
0773273a3aac764d050aa61dde5b7da06f858f33

SHA256
08f95ce6d2128be2a073890300ec2b7bec432deef990167280126f230fce0cd5

SHA512
cd0ceeca999c0fc62d06b16674022ccb833ba0a148f85bb4bdf880c076baa26c133707eb20920de242e5dc2771e325fba0fa36eff666decb56572a55186ce438

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62b342e9d2645c58394b9c20380c67b4

SHA1
944d75b293bc1037b32b400ffba54f3c05032fb6

SHA256
a66c3a2970c4bd6d8a8c3b339b5706500fcc032166a2d19d6d849dfb38e836fc

SHA512
0aaa1c462e300acf582c4168d9a19343772a2d2f52ef7dde080af9f7fcfd63ae86e12b14d5e2895ab34fb6cd61ddf0ebcff0b7aff1ec91f26dc94ec5b2cde16b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d7d338a3c8f9c7f0ae79673a9d1e27b

SHA1
77427afd5e1d0d12942d4cb4c4ece2faeed4166d

SHA256
8aa456af4459c3766e61b10fb7c119beebe1f37931e877dffa608a31e9a76e93

SHA512
e4db34a80be158f1541873d1fc3758e05c5d64b832677d50067c9a0161c0e9830c9bd93b888590c5b30e64b433caa855fb89fc9cf79c447eb14e8c6544757dc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e82edbfc54c47b291960c6917fc0d6c

SHA1
a4b399375716e7ab31d9485dc8e3e1ed44a30974

SHA256
341f7084b48d0ae0db8979b618d37b6f909d421be9942793c253425a1ec7841d

SHA512
ba9ef0c61235df50733770bff2bc055f2bc0bccbaf913ad95f8b1f767ba4b0e061fb0ddc1b69101029837a8499a1b5d8427d19e3744ea0cab817f030265eb7f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1fa5ec9be2afa65d0bfdb218205f8cce

SHA1
203e920ee11c581e95b46aac41ca7d15a4f3274f

SHA256
3e55d08487a7f21b41ce9c8e96dd259c72ebdacc5438a6f411929c5c8c31149c

SHA512
9e7c37bbce8b718b6700711ef3ad9f99f008b8965613cbac9fd084acff9c444dc33e58503bfd527c40797760fe8cc475a35dd129f2a5516ff51c599608d6a69d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e272b390e03f56e7a2e030fcc636cff4

SHA1
0706744af0db01b6acba9cf26f3738ac1bebe522

SHA256
788ecbbd06d7ad3667f42baa9007ad7e96dcb91e60cb2334de5803f77e39aef2

SHA512
85f00f2af9b01b82282070f2caf7ebd4442e086eb3b5b2636e7d8e667d58f035de58ce26f88dcfa57bc28199df77121825b3d21848b9bffed9867e0b1fe4da8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab81A0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar824F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit