103d2fee50d26f1b887dae80ec880b16b451e39ab68d216923b74dbe0841b739

Analysis

max time kernel
132s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 22:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bd60bcee619a1c768b9144c3b5af2891_JaffaCakes118.html
Size

18KB
MD5

bd60bcee619a1c768b9144c3b5af2891
SHA1

e63ca7a4476b99199f6627b9b8d1195566731797
SHA256

103d2fee50d26f1b887dae80ec880b16b451e39ab68d216923b74dbe0841b739
SHA512

e0dce43c45295e88709bc164f7a53d7a26274bee1927c4ebb8f6c34f653ce96394527124f75046aaf4b7fa19295cb15fd1a98f49027accb5ceeea78ec79340f7
SSDEEP

384:W4lI5NHS4bmmm7mmmWJ1eHO71rn6Z7j+1eHs1eHb1eH81eH9Fi1rncr7j7mmm3sE:WLNjbmmm7mmm2euRr6ZQeOeReeecrcrE

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000fe30963565b803a2fdbd882da22557b488714e24808c102cf567111e92f09dfc000000000e80000000020000200000004347d76949f792156f7bc01894c0f04ead0b2a2adf4c62c1c47ffadc72ade03d200000002eb1e10e18efec737671cd7826929ec2b0202b4ce9353443309ed6675270fced40000000c362fafed590f8beee8858a7a838090d2941a5f444b04f49ff7ddc31c13111a35e49561a72781178fe94cbc006b64ed9d787242e83691cb5a43a320c07363dc5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 907bcf66aaf5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{923AB741-619D-11EF-83D9-4E15D54E5731} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430613354"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000a22e4ce1c1e516c1c6a54ac41a1100d0e5da9c74f9322c2682b9c6c6c5d69d4a000000000e8000000002000020000000db555b4dfde3a554e513007672089e6955c47906f1225d52f1c53f030359a4b090000000759c9efb2f57ec6672016d7b215029dc76bfbe6939d7918b7ce1127f6149912ba4bf8f8210ceb8707d5ca88d7ce8dd790dcc6b1222568a583fed16e5a36a6f62fb9af10e9882d2c2690df021955f135d735cd16f9188a9ee94fdb3450705b660a14f5fdf04b2024de231521afda0cbd563582b7c0dba719fa0e74fa00b96900cc4420c5b893fb430e412baa779b5e5f740000000c9f2f1ccbe9b2034f2881eba030f5775e00e986754dc3ddc3505bf68c07642c74fdb191bb8599f10450e323cc458ab5a45ad0bee5f95899eacb94486a2873c9a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2836	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2836	iexplore.exe
2836	iexplore.exe
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE
2660	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2660	2836	iexplore.exe	30
PID 2836 wrote to memory of 2660	2836	iexplore.exe	30
PID 2836 wrote to memory of 2660	2836	iexplore.exe	30
PID 2836 wrote to memory of 2660	2836	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bd60bcee619a1c768b9144c3b5af2891_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2836 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1c5e35a2e08292bdc1bcd233f1b544d

SHA1
281db5219b5fb3181093324ba3795561a6b39b4f

SHA256
f4c89dd07131808a18886b3b21f930b18eac7d01d17d4bfbd0bbd2297531d48c

SHA512
467a93703b90504ba853531ece8839746442ce159190d3ae72a42683e0e1931d4cdc2f27ddc38905310b165c5b8631bce87159e30e4a91afa6900147bccf2360

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb2db23ba4e68a144dbe40df7d7ff000

SHA1
db1db59d59d0c7c3c346d8022df2123a2a9add30

SHA256
2666f396337f3433af3622aaa7fe10f8fadf5ad3caa7eaf388697818547b3b5e

SHA512
1f2be4e68ab1baba81510cbb8bd9b05a33133bfd1c0a358a73d44ad8b3509b5bead086befc5707043e2b4755507f8c6a77d9283480271331001522181469e998

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0a1fb086690e4eea8835bca265f7c8d

SHA1
68f2c6229ff363a9efe440abdbbd46c4576ba3af

SHA256
321f9089a113cd75fa4cca4a7f58a8648f3e2691fc5ce84fbd50f7596a83829e

SHA512
13ce647d3dad19bc8501ff855c77cc43ac20b2cff41de74f5199951a0c95d32555883a0e9555ab15e21e901757f05f27e6990e32162fefa55a7c085d6afa7f19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
280dd8c16e13bc5412ae267b85b8f8e8

SHA1
981edbf8cf4bbb8fd7742bd0c99338fb1beed6a1

SHA256
4a4b1003eac040ea7e83a4c4e6c174f7e6181bb8912c49fd8a9e2189bb6c62ac

SHA512
bba505905f4dd7f7edee00c76797f9aaef80d530a47e2643a4e96ac0056a3628cf682f0ac33d13f5aec0f516a0461533a32c150e44e2f49023d1c2d413dd6ec6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5cf515614c647f2acffc154417dabe99

SHA1
ff82c58531e750e9a939621ef0cd50fb6baf7599

SHA256
3fe1254be832641571960c7d0e05e9c33bdce2cf32788b77b6290dfbb3da0a2c

SHA512
f20456d420dd48fe5a748675a3052750f52effeaff023948cf3be7876c73fdd50b2ddb92e2c2a5f5d88fd5a7320f5739fa3a9f7be99836cb010209b55194e87e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e46ed53d1cee773d31326bc740d5d4d

SHA1
045374bb10b37d4c50e2f1a5167eda4cd55dc9d2

SHA256
f1829195772112c151e0fe46272668d1beaf1df337b695987dea479f979f62d8

SHA512
17a70c7c1e9d69a4289688d2bedcf1e56b5dd7cd2947cf5050f94876ddda46687e379051030f71ab6c7a4525caea05e4299c77b8a5159eeff8919b708333d9d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10fd46f11b7e6004e3610cb5e7b75f3f

SHA1
cd8a0eb133d99af1b81435f34433227ba522d102

SHA256
9af38377c81beda38e46470b54be70d6ecd682e52c15231eef8b96a742528cc8

SHA512
549a8de48f8a5656d836205624ff9369c9013af427511de8a0e9c199265894ced28406c6c80711690d1db474ee60d181a526c894dfb4a46f6ea34c67b95cb5be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1df785d4e25a5489886e8a798237af35

SHA1
9fa871ea9dbbc954c15b45fcef2240958974eb38

SHA256
97b16687fd6d6e41b4260cf412c1e891520c1d977ceaa6cf51a9a489d7d367b3

SHA512
3cc9126745cfd20efa2db577e6c2a8684b9353426d59c0ddb6ac1bac52ea24db11c2c644861dfe0ed9aff71d5d6c65b1f144179613e6db7974aa23df17e5ba41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0677925420b06287d46dd43672be3cd8

SHA1
47e76e0528c98380e4f54789dfef8b63b754a27c

SHA256
f4f9cc49ea942a4f66f3e756faddb20a7b0523013f5fd03279668d7c5ce396c9

SHA512
6d6bcdf413158f1be061d1344c1eff8cc714c379c1b9a7e5c13472db7e8c72ce560a20790e90a04f5531185d003119f9861e208d999c454d6a1fadc97032a6ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a9352dbec552bdebbdbea34917c6d1a

SHA1
68117900d820b6c020b0d43df8468d5b29f0ef52

SHA256
9a636409a2d64425de74697ef170791bfe778d3a11a1edc734d9af1f10838ca0

SHA512
9eb63b1a4ead7972504f34bd64966e7b38c2eab8faad767f1b63b51a7607b5b7d21edad06270d243b8dd8525b424d548b87b40ccb36a12fa3281f1458002991e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d06d0d28d16fd745113b9ef0a03583ab

SHA1
1a641319d7bf4737fee34ceb383ee9ec5d882392

SHA256
c7141cc8137151c6f002e3263a7c258d67972db381b90407d9f4029b66d276e9

SHA512
3f41a5debb13d42232d7a99f342002a37854deccd829615630c7e2a00edacfb0d542afe3b532220b9e596accd927c0ce7de06ba8edae33b0a9d474b8ab61d672

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
422287291eaebf3f3421da37d7537822

SHA1
b55ec928f2c6e88844cb74b1b5837c17475e0e12

SHA256
14a9ebf967e16c88271439ca1c54b0b358a9c80a0865ce1a7ce5f1807940b154

SHA512
eff0fc2b5a06f8fecc2a61618c897afaf7ab5982e971c064c03ae5fa99ea323363797432bf755fd93ef9a9a57fe55ab1d0d721b652d0fee886e9d0a1e8ddbed1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24ffc76f92834436c7498988108d72dd

SHA1
186a13b9b872069307aafe0afa55b9db028c2278

SHA256
77e922b3abe869d5246e171d23dbe74c4539a4abf3ef39e0f99378aae23a07d9

SHA512
52644d724be5af17d25c2e3bae2518dc7b4c2b8d482d339595bb32ca320617f1a144da0cb2384b7ab07e296c8f31a464cb86f06e449743cbc1851822fca98536

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6caa6d8eab21f407718e5913661ee43a

SHA1
ca6dd2830185c4c39e73dbad264b9daa96ef9671

SHA256
18ad764df3e284a0a6049050d6998383747f1974d3a3a81ee0fdbe8bae4c4718

SHA512
44fef5ca7c2da77fc6449b7c4b1c3aea8bad6b2cadd4882dbc9bcf6251baf1c24584344b2f462cc3346d9ed9cedf3888e0ea11a80f52eefb717e6487f678e290

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
398114f9c24556c71f29a8b5f80e398e

SHA1
c9dd0e8439fb199b39ec2593bcd3771e0fcfd7b2

SHA256
18431d0622451c4b9b14be842a0fe65bf415b1376f554b5eb7266d5e5789e98d

SHA512
4be36263ad8596e85dd4d91035e032aac014f12e8c528eaaee59d3cffdd9661e919e5037ec2e3acf825a2c2b670e4e3a2a572a86f97151dcd48c743df5516bf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec3e62bbffef2340e9a3de021d190306

SHA1
886b875176ea1e8a9d38362e8197ecca879e6633

SHA256
ad7d75507f8ae3304cc315094954f8de1f3e3fadeb26e9b6d9d4292dfe8fb57a

SHA512
cbf4d14e797b530ec5ee09bf4a065fef4a987d8b054b9c42a97cf1149fc511187f5299af6c801db7af4dcd5bf60788389bc6ca26428e90677f360ce6adb599c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6C8C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6C9E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit