ce33b23d737907b53ea963c207ca56eaf4241df19d9a25da4142dc683dd980f5

Analysis

max time kernel
130s
max time network
141s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 15:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b6f9f41f8b931d5276cae46e9366608_JaffaCakes118.html
Size

19KB
MD5

0b6f9f41f8b931d5276cae46e9366608
SHA1

8ecc700aaaa617df95587d24c75fc10d5a990796
SHA256

ce33b23d737907b53ea963c207ca56eaf4241df19d9a25da4142dc683dd980f5
SHA512

257c711f3d8677dbccf182fe6e03ee32dd9a876fbb3a80663ae3b395517ce557b2549d4a488383a7c1d4a162c526be3fa2e35f56f47e2b5d2c21ae72fe95652b
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIp4HzUnjBhpz82qDB8:SIMd0I5nvHZsvpoxDB8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434046134"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{232BA411-80D6-11EF-A7A5-465533733A50} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1868	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1868	iexplore.exe
1868	iexplore.exe
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE
2520	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 2520	1868	iexplore.exe	30
PID 1868 wrote to memory of 2520	1868	iexplore.exe	30
PID 1868 wrote to memory of 2520	1868	iexplore.exe	30
PID 1868 wrote to memory of 2520	1868	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0b6f9f41f8b931d5276cae46e9366608_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1868 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5636f9bda3442004042cc2cecbc4c7a5

SHA1
e8cd2fa7fb898437c3e2b763fa195c9729c6434d

SHA256
cf03dfbe38721a10aa8f70380ee60ce306c97f44ad03da6b88df974a1420ad9a

SHA512
52f77818f5936783f46b127810372ef487b98e18530e81a876416aa454d7d3e9f49218d2e4fb17c613c1f68f7837c141390af2a474483a15991dc7772ec3f910

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
178f18c0f37edcd3945568d0f67f564a

SHA1
cc7cb77c3b4a91f36a7403f2380e2813ea76c5a0

SHA256
962cf81c98c1277dd02a286848cc06219e1957cc6cf2906f9013762f553ef7e1

SHA512
45ae2c9feab114c1e346d97df5add4dc74f6d8d765bc07eaae2680e4a80a2ed88fbac6ae10aca104aa42e41e190d9077da3fc77c3f2831380a7407b831774c36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d1c91ff29922848e8e7e88fcd31bf7b

SHA1
a5ebd7edd62319d6712be66f29fea3a4ae986f7e

SHA256
2f3ecbbc2d3778b0090a28d90737d94805da97203c33f75c28bf37f70f4f99ef

SHA512
c99757bc4b6142c3da821c6449f9c680b61a729572e846064d26be2b2f263154076ab1a23aaf6f76662c6cbb95e49bdae7a452dcb674f7fc35b4b4d444233235

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
637652834d78a32ff2eb47ae7e230e01

SHA1
05e0a65243569058df6afc1ceb5d7260b7e1b113

SHA256
d95996cc0036d5637b1cbdb26b8486166b87806b294b9a30bd43087762c66410

SHA512
765771021dbcd22f4eb8a38cf6a00a6cb78169def033c842e673e591d25a4663f61c01131dc9fbe7f6d054235c3d849150cd60d194dfd3743171860383f43151

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
814929a34f2b83e69e59fbaeb5d6a215

SHA1
332f9a02c8e3a9ac800b89be4f64fa2ac688f1d6

SHA256
d0e2321edeb0d8786cb602ee374f3538e38df8116215c97c692f3fdbdce44d83

SHA512
f036ba4edfa1b1bcfdd6f83b8c56199ff273ea19b79d1d4c56dcc7482361459f04b00449f7432ec5af091c2eb9802c06e4d3d2944a26e3d42baf4e17c7e862d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
952d4205f3a6134f6153ba05f40b69e0

SHA1
6c8653ace0632a11369666c61bbd0148c3b5e6e9

SHA256
9c932ed1f638ea2994fcd2fe68e07ec1beddb03b191c8f0a83ffa5f261520418

SHA512
3d012a119c7e21f0f3122e0588f6ed127e1d6b18ed1a3e583d93b158639f6da88d282ee01ac4a31f7b860ba4858eb60ede4eb011324dbd727e4c1999612608bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a41643fc94e58a6da91cfe6e57dde6ea

SHA1
82b46deb18d097e95db49f91716072b5bfcdc197

SHA256
9d06dc0f4dd356ef2694eacd1578da14602f5ee66503815c44c9539f0326f214

SHA512
b6c4bea32ecc35b69ea2826399fd3873991fb495d491a0ed99e3443ff61f4ec13e60b3eeb4e204d5b8c77d66abc70ee75f4d3990450e23638b27f778ff049ff9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4d23899b00cbee568291cc629c4368f

SHA1
acc9a30e6ecb2d32a62ddf095ad1002f3167eb97

SHA256
67e636d7c18725eaf86de8bdfc21208c446933d287e19a50de5b01e0d83c84a6

SHA512
e6c2f18aa6a334ed5409ff461927f5f1a476ceed808bf6d12ff49a046dd5dbfbffd601df88dd7aa3696ff6bc14598cf7a185abbce5b05a02569f1ac3099cd680

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1d2b710401b0a50603902a377aa8505

SHA1
e7b5aef62f472034baf1705656163021bcdadb69

SHA256
c9541dc04851ef8fc66e5d2ae638e15b82b6951b5f8c74373906bdb32d3f0fcc

SHA512
417d3865e2d7071b1a59c1708fcc2bc2294816240d520768979e08664b147a74f9bf63c3e45f8c350b0514d26c38015cce0e5c91b09654c07f86e5a48cd06bef

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB482.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB4E3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit