bbc3f5277af6b09ba14aac724ec464efbdab3b8ef9fb640fa4f3a8abb25c624f

Analysis

max time kernel
140s
max time network
141s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 09:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a62f05d2d0ae64dff812585ffa3e1e99_JaffaCakes118.html
Size

26KB
MD5

a62f05d2d0ae64dff812585ffa3e1e99
SHA1

ebcb81007f76cde23096fa6c7ca348b895added3
SHA256

bbc3f5277af6b09ba14aac724ec464efbdab3b8ef9fb640fa4f3a8abb25c624f
SHA512

ff8265ebce7c9884eae6a6ab4df5d819ca9cbac6413dc5b80c513722549fd2bbf9d3a3178568e91a47dd5fb7d5c8a994a9594d880412d498c3efb46b5a39ae62
SSDEEP

768:07kNDwjXILULfXgMt1GUo5kxZtHzimD4Z5pLhPNia:sXILULfXgMt1GUoSxZtHOa4Z5pHia

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000f8a0104f8a146830cde64538ee97a7a70fbad566dac9217fc7df03cc42627ba4000000000e800000000200002000000049777451f58e8848e1d88340f6dd450eb0b83331aea40a926aaa60f97bf895002000000036f7dbd5d9bab10baa3c2adc157f43b40f90a0553fec00ca08b370bd8af7476040000000efce631497831e9bcc0957a631848b5793a08d977208b1f379bcc1f84875af38ddc1204f6c537ab03e046a510f97d69170051f1023f72a3934cc29de4888c643	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c920000000002000000000010660000000100002000000061cbfd0f269c11838d72e09738f46ef1f76697362098cac4573bda727c9ae3e9000000000e80000000020000200000000a7b45fad69d217b234af2ddc00aa99e05b1311cab6bb3ab0aa3ab19d6906d65900000004b947257f409fd33b24096a3171c1ab8cf43c5126e8bda2257b467178d50473b95b3634763ddf4b136ecc7dd1baa5560a02c007169125c06aea2e033296fc763e2a6b84b300d179568ac44fa39bef6c62540fc24672175a5d58af67d10803aa23c2131216470f32950d75c48bc086af1dca094a5a374ff4695ac6fd6e072fea87001e26f2770f853745db0a1afaa9d794000000096c54be682d25a1c36b8bf531c285464de1defff18facbbe92f7661ad783c6ff3dbebc94e0438f1193f78ae8cea17d04f1643728a38a7187ce32901569f62425	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430133876"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20465e1a4ef1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{314CB9C1-5D41-11EF-A17A-428A07572FD0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2716	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2716	iexplore.exe
2716	iexplore.exe
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 2680	2716	iexplore.exe	30
PID 2716 wrote to memory of 2680	2716	iexplore.exe	30
PID 2716 wrote to memory of 2680	2716	iexplore.exe	30
PID 2716 wrote to memory of 2680	2716	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a62f05d2d0ae64dff812585ffa3e1e99_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2716 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aba8ecb8c29192462a5d6184d0ada80e

SHA1
6cdd949fa1790c70a76555a84fa4d359f82681cb

SHA256
9c069f83681181ebd522cfe2c9b81645783422d21a88af8e78e7d2e10023a298

SHA512
86bb59f7904be10c23919173085c7c82981b246f65cb29ac98df174d09299e2893e49c91b69a51856dade391fa805fb7e34fc0793a370c8ec8348ab6cd8dc962

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fd6b65743293a9e8b402dab1b913da5

SHA1
872189465ed362850d791e9af23e3c544a4bb3e5

SHA256
b091ed17161bc40e41d18c342088dcde6d24efeac32b1f5e75446331ddfa949e

SHA512
aa5a2ad1cfa5841a1f8d490206ec3493d907d080e978fdd3a710757fd38423caf7a7343274d9ccc3be51546915a3a4a30a4dbe4c39298688e9f39e32cb971254

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b3043a5c204826fb24aa3a0192f39f4

SHA1
b82215186d0104f6c8185796d05c6b501e26752a

SHA256
36326ef760223d6ad7f97058d1950226ffccda41a656958c16a1f2fe452d3cda

SHA512
5848c9d08dfe2591458c3a53682e05df1ac2c570a3715acc707a1cd6e29b086985920e9b44ef23c615ca42969800abcfad84785294853a95e3cc5493778264da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5aa04a2cc41a099520916f8da6b0c017

SHA1
6f5fc27e92c725502a5b37e474a308dbbaa7e478

SHA256
88ff33fb93714664450e8ab8bace313985446ed249a144047159d1d31ec3f6b5

SHA512
edbf12cb16ff333404b56f99e71e8ffc019a33c7b1cbe83b719531bda63f948dc6ba0610a6026af8e059fa309a9b63cac75a51e65ce641cc0f6443efbe7c1a58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b11d43964ba2240b9e7c1087697fcd1e

SHA1
c89346d010ef844914dda61d9289619bce902b19

SHA256
8798c4fa6ab413ae3e9604561b0b6a2d9959b2950861723918892ecce39420c9

SHA512
2969a742d6e028edc1b15d6bfd2569f2f8b9cbea63db8c281d14dff7566512e18921593a2b0dfd40f565295b8615c77693f2b130614d4adaa455656caf0e0641

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c360b7e64ece03d82742d9079fffa76

SHA1
b487829c6d6ff26c54de766514e60ea14ccb8263

SHA256
e57165208cea9174f8eb25a63e6df2f2859bf125813ff18b76e2e9f0b6d56b4f

SHA512
2a68ee24d6ec39144ee5b293bebc9b46d41c05c75dbbbe0f79179deac0b98944c34f04cf95fc5be3175cf325639262319cbfff08a9bb302716eeb5a35fce129f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c00e742df49cddf76eefaa118d0a2a1

SHA1
7be9354c43b10e0c56db0006b56df6cd550f4561

SHA256
c3490f9784acf81aadca304a31121fe2038a045d3526fbd5cd13df0588f31935

SHA512
d4e96ac3f94667daec4c8e96f1686072dd1927e8e5677c6534af92cebb2a905d2ab899038644427db3a52060cddf870d7a14acd338356676a2a3ceb3e3c1bc1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ea8bfc0ee4b272015cfd8462240c27c

SHA1
fd60c19ddc11da6fb397a9d99cea194539d89f57

SHA256
e78bfd7241ed8f97288fa776e3a314f713a72478e2de15d1fcf4e01f520bd5fb

SHA512
042ccd7b63cd1e449b1ddc25d8a0b8e831f13e479e121d8ac821077bd36702651ce73aaa896d647cc1bd9eaac7d1695e78e1784944842b7eb3d8fb54bb0ba2a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b767a87a27f67f19d0f18f78a99de80

SHA1
10d228bb3ba288463baf7029e59d34782b627964

SHA256
2ce998832932e3fce7183fb3f99e3263f320d7b0fc9b781972e3d5c9bd4cf2a5

SHA512
4e640d3b4fbd95940617bc96f381673738d0cdec7875bdcd4c583e0b2da969af2ff0a8bb5546e2a234733817d8d26878503cf287e4cdad591e6744fb62cb664b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
379c4e5f791acb13967fb1f24e15cedf

SHA1
8092933bf8db3f7b06b97855c8e24d0379b9c4f6

SHA256
c5e076f02fd984d572006b6a445368019b00078b41d19b092a734a098cf64b54

SHA512
a019e31f1cfcdd74538ccc10c74beb393862019fe4d06ed302dbe8f6ce1ae8c709f076e1d310dd5499fcb6f79911c169cb6b9e1925d021075a6d1fcc3d8741ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3cab36c93966e92c75e1674c32e1676

SHA1
7f8a0f9e15845e17bb918083a2037bbe96c525b3

SHA256
7b14ae8ac801701c7d2808e47ebb4e70599e3bf1c8b597a796da2fdf3260a237

SHA512
a01573b1d4521c34d8150a8b3db1689c50e4ebb4a0503eeabbc00070b6dcac6188a82a74e165bae25419bf139dfa2dc3e8004a9f4f20ef8e04b076a03130a38b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e62f7facbe09cfec6e5559d6dfa6d687

SHA1
815110658d569abd748547a261786bedfe16c745

SHA256
d9017a205c00bbe4e9d2aabea7916ad78d00849c034867fc92d123deab023886

SHA512
2f36103cf3ed84cf0af17fcfce49e4293982030cabfa08381e8508798990b6c7484858c17c3903f27871b906cf8934d271b1f92542aab6411d53fbf44a656675

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c1d6471ab3c22f7b231f835cedec72a

SHA1
677cc3ae9c4293b569bd85318b4c3894e1cf5636

SHA256
b504d6b5c4f9d1b4c4cbfdebb572de5e66a4f0ec076f748ae5b39059cc9fe5da

SHA512
453dab57540dd94d0197760148986de0f4cbdb88930213f8525564466cd9527f322f2268f3fe4ef40b9d4096c45935e370bb5c77fe2742fcbd6843c50a01ff28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
167381963bdd0d34bbec8b9a8ed9ce23

SHA1
53120dd573696b42440b64510f8a6c05396fbc91

SHA256
2d71caeca1c8424d172dbc31c910e26afe0f5872a39888180ea5a1ec6de5ea9f

SHA512
696405fbb30ca367a81a8abb124b388c2e5de8130b7a4c094cd12a4580433c903f4d21682685fdff1d3379fe1d04fce94a554d95ebda07b2a9c1692729e6658b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58dc7093bb6f881afea1879711ca9933

SHA1
f1859bf88856cd3746cb248a0ed2c85b892693b1

SHA256
64065b535d491bc7272e115803a027d069c05a606daeb0dd214935d8d8ba7f8c

SHA512
e711c39bb9db2a0448d625cdd7a0a5df92ca643bc3861ed0f7504a6b9175707a107e9b961f1081a84fae70bc8d28e9284908335021192b6ee424ff810576c7eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab408B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar40AD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit