9b91478f052508b30c01f0df6c814e8501767d7ac69a4d1b1689d1086e75edf6

Analysis

max time kernel
148s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 06:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

123b9df8d7af56ebc4150e3f52222459_JaffaCakes118.html
Size

20KB
MD5

123b9df8d7af56ebc4150e3f52222459
SHA1

94645d46198300dbe51201695c94dab2bf0a01c6
SHA256

9b91478f052508b30c01f0df6c814e8501767d7ac69a4d1b1689d1086e75edf6
SHA512

3087a1c7d5f52e7dc9d5261778fa0337488ae5b7013e8199a3afeb3001514185ce938c3678bd49befd2d3edf1c5671cc23e01ca707a3e0b701375339385e2993
SSDEEP

192:SIM3t0I5fo9cKivXQWxZxdkVSoAIC4gzUnjBhUe82qDB8:SIMd0I5nvHzsvUNxDB8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434185559"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C250A3C1-821A-11EF-991F-EE9D5ADBD8E3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2680	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2680	iexplore.exe
2680	iexplore.exe
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE
2864	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2864	2680	iexplore.exe	30
PID 2680 wrote to memory of 2864	2680	iexplore.exe	30
PID 2680 wrote to memory of 2864	2680	iexplore.exe	30
PID 2680 wrote to memory of 2864	2680	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\123b9df8d7af56ebc4150e3f52222459_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2680 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18d877cbc8c25297551f9c5d3f9d70a0

SHA1
9480d4a2d5671241d8e2012d6ea9c763bd93b477

SHA256
2d20996bcc77b54449d103f332c467674e98e58f37ebd0b0b9e111696621e733

SHA512
04897a5ceb10e04927d00318c429395f6befcae8871655a080de4077782048924475b11f2351943ebae78c4721d7af2ef501184f49d63fcfe82c19ed8b346fcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
421b8ce2e63c0c85779e1ef8b15d93de

SHA1
64d05a7b1c1806167874180931eac02ba9b34708

SHA256
37e660db85228acb7385f3be9773d5e41b843d6b8bf62e8b25bf232d7f06b955

SHA512
a21fb96c31743e346f89ba5e6929ee6acfbfe991e2aa06766fa56e280dc89f602101a291e7ca8d39de47bc1694faa1074c7f86a20984a19718bb47ad8fd0a93e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0383c50dbb51197b135d10c025a73d5c

SHA1
a435f2305da6cffcb9ff092d5081c6f1ed2ce3f5

SHA256
7c8d380b5979d58e34f5944ad234067115b9e1c8f0700c0daaac16b38989e2ad

SHA512
49dcce7abe9e12b7ea29ddf6f69d9461aaab59c2480ded9ef0b9969f5f41112d2f12d8410d99a85935787018d789ddf0399f771572aaa49257ae7602413c9209

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9a6bd0d3e1964deaa56ce81b467c4f4

SHA1
5bad315f891b5900474ac0b8c8713084a58ab5a9

SHA256
9804fa1230a1ab53b489309d9e43e40d9704c1c0cdfebd235309388615502bcf

SHA512
6307553f832eb8d1199d05273341fe0654f7b1aea272f2acba72e492135f32277c5697db435664a11442cb753767023396e07ffe08f922bf197f0ae66cd09e40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97751011f3fc40b56f41550d0e44e1b0

SHA1
572a1817e416fe60ce03c3ffb3a0fda04c6598ce

SHA256
351893a60c50e755f6164af8123c8f3eaabc7472064595c4f7e03735f7c99901

SHA512
a103dbd7fed038a89936c2749222c7e08fc47b651702a675c44831f6249b7223b92f929e687fab12cbcba77956bf41e86820873ed3bdbb735aa39b750c74a08c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2614221b45b7ed1fdb42363b06d5788

SHA1
d1527d3abd59dabda6841d1f70c29895d6653655

SHA256
7e89c4a8e3ef052310bdfb110e6f55e452ead403e814ef1908681dac324c4548

SHA512
c40e42492a23118aaf4032e02f1da3542ee351f94000d8ef4d54a027af2c983601e4fb70820f5a1319321d24f97c4557d8dfce357f8512bdfd24ce4402e54570

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3767a152258247b7d9df086784ef84b1

SHA1
776f54aecd569ab084dceed5f972184ae73b5e56

SHA256
6c31dc05485cb430de253bbffcf8f3fc3637e87f3faea3566ecbc0099d99f0ed

SHA512
279d92a9779d109693328480a691c9ff23519201435a3f03948f4c05d010b446dfce916e7930fac34a43bbfacb00d7c412cc9fcd6a510dbccbb37ed13ab7d073

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a176a14d66cb6a5e984222b433be76a9

SHA1
a4ac7d5a16cdec30c23b7f8c507e369c0fae21ff

SHA256
7fdd75b7cda2001021d6e32c049b97792a7ba03aa3db7c217638deb7bf65c225

SHA512
b75310b66c833351acc702669f8cdb2e51d0c6032eff3658900a36fe5afe760e5f6632b2af96746c7cf83d81cec8cbc2cf9193cdb23d60f16cebb422507de5f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc05d032cb4250920ab318d3a03934fe

SHA1
ca886f377f71e5e9d1914ef492871c852af0c0b4

SHA256
b154228ce3f93e73ab0374b3e4d8f6a615d136e5b5b0232b90b0f35f607c53c6

SHA512
e02d7e44c4b9bb013336348580b30b636613b0c8500ba3937fd4b5059e2ba65500b30d7ec24da621d103de4c3bc598759a9107ee3fb304052a8e4f6af34ae4ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3EA8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3F08.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit