60a79e6ce9da9fa25c21aa90b7546c69a841df5fe3d739bb6bcf93fcf32635cb

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23-08-2024 07:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bae21814737bc3a4c8acb740dec4f491_JaffaCakes118.html
Size

247KB
MD5

bae21814737bc3a4c8acb740dec4f491
SHA1

a9a745ef9b679cbe116f2006a832e903ee0002ff
SHA256

60a79e6ce9da9fa25c21aa90b7546c69a841df5fe3d739bb6bcf93fcf32635cb
SHA512

c41be7337758a5cc8f46923e07bbbd34da747015efd9b38697dd92204ce1d35a9283e4919678ccbf2d8500b8c79e0dd08377b73de643fbe9f04c1a8971dc09c8
SSDEEP

3072:6xjBkHAtirhB9CyHxX7Be7iAvtLPbAwuBNKifXTJ/:KBXqz9VxLY7iAVLTBQJl/

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9CB768F1-6123-11EF-B58C-DA960850E1DF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430560973"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2072	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2072	iexplore.exe
2072	iexplore.exe
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2908	2072	iexplore.exe	29
PID 2072 wrote to memory of 2908	2072	iexplore.exe	29
PID 2072 wrote to memory of 2908	2072	iexplore.exe	29
PID 2072 wrote to memory of 2908	2072	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bae21814737bc3a4c8acb740dec4f491_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2072 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
b0cacd3c62c48c84359fc6d3f85581d6

SHA1
9ada4d2f19c3ce02813b7ee5dea27f2075f01dc6

SHA256
17b91f47de8739112b5154d450297e9ed2faefc36130afa24a57995ca617ae04

SHA512
5322c5599fe2112c1692459992cb1fdaf42cc48449f5bbae6711be63735a2fa491515071a4d9eae3cb0e5f8f73cc107e1e7cf6fced559b9c380e9803e04d3691

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
579a2d26a147a8375b85e0f38cc83fb7

SHA1
5466ad767736d4625793f005fe0fb5897c14340f

SHA256
ccfb2a7a4ebe4ad83a4a4a98dda993ab7205ea10e7c560a9ba68c1a23970ac54

SHA512
fb80b87eb2585af467d56f3bb664e35d7237f0ba6e79a8094e2cbca3bbe6203fff4ac88ff85e495b8414579bed3ad2cb10d72168576decd3a2864ce1b4853b78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0badeb04ae83b388170674f779547b41

SHA1
fb047b5486a8510d48fd771d85738f2374998cb7

SHA256
d48f20daf6f7b96923411be9946eec096b3c3774e07b114d39c5aff8aa840332

SHA512
901002e0ee986c366298ac94a96c5fef5ec46a4e575e8490047cc91ec8bfb15dbffb97895bb298122a1a016af4332ac364da34855d05da801347a094f57720c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23e47a01f471c0f1c8eef22cf55e16c9

SHA1
5d5f96cf6c25132a776daac2c06e48a5ef582172

SHA256
d1e0b9d60cebf882ea1562313d8b36919545d48dd6b408a09cdc85b2a201589a

SHA512
65435272ce3cabc630516b64c851b713aa081a0b0d4d48eca25852835bc4ca3a38b550ca3f3b06fe66ba3a07672c5efba2a99745228c9098b882c18911a6d4c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
560cdbed4c04de1de951a39b9114f480

SHA1
5ec427301c57be268a883049189b314d6867255a

SHA256
06282ce36a31bf5a0ad43280728971ffd63c61a920d366158b0450631cc8f3be

SHA512
7cf3eca42194b73dac553d943f0821f54ab84878f73d49a4d04bb5a226752fe53ed59d3cd40ea98da58602dfed02dbb8cf9f94870d25a08899aab4dd5af4648b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15c201c9717ff041fc50a29ed0207175

SHA1
b2ad74e28385ddc173aa73835781e7da4884882b

SHA256
6650c8bd577003c8cc78edce016b603dc2b65940e5f8b2b92ff275309f02ff07

SHA512
dbbe36a578e4c378c17ba431ab2ed21dc653d3d36ce85db9ee854cf1d1d3d6398d9fb0a5d541e1ad2ba64e96e70ded5d3ee84a1335c581daaf4bc386f0884b80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
304d9519a64efb47d07c4e885a47f89d

SHA1
8a7ec2ff907ceaf9cc425018aed1b68b67f3d09b

SHA256
d26bc3ae90486561337c218a4752a3a01268a9d4a976830ea061923d2ed455f0

SHA512
5ea183521ff529fea39912653a6498285c0d1b0ccdb353eb494e84effc46867a8ea03d478be70b688b46b89673cbfba726806c8b61931b277834ec538f43a962

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e86e447a5ae32d2e0c3fc0d60c26c129

SHA1
cf6672279c26c582bdfe771e3cfd12ebf20e93f1

SHA256
1cea1efbb897f6be4237264942034eac3d5ddd148ff35e1b9571abe3a9a02e45

SHA512
7feaacad72565476842c62d5b02c4ef65202eb371037d398168262dc96c56cdbca50cd9e513c111a4cc45abcc106cf431aa34d1c2cf5f436f1d404b28f37a507

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a1c6e42fb395d329ebe923e57df3cdf

SHA1
6a4d9148f07d90720693999c76977e8c7294bdcf

SHA256
84f8f0a38b1044e1a598d67905728be1e5d6974d3c28591d0e57a30333cef0b1

SHA512
68aeddef882f3ce76bafd8f664ac2d024238610fb78a88a931636c5e4f4df6d17ffb5d019b19defc6cb5093d4fe44e347632fe8327513e7133cdc684df5723de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b209858f20caa99eafb9f6c4dcef7992

SHA1
43047216563c3a8ca83d7f9647b132af14cb34d6

SHA256
49e2250b529f9280c25bb5854ffdc3928c9fc637ae75d3f574406fefc423a0a5

SHA512
d09611fd41cfb80a8b187207504ede81af09bf07774fd1ce1e6f96ae1c5939ff98f1ab4d37fdbc0a70d1fd88fb518e626bc4a730471b9d0eb72b758c4ac810d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd0976d3a5d34e68e64811aec7c29fa4

SHA1
ed82614c0f4346f53935afc3e4a9e16678a0a2ca

SHA256
5b0f4f34202bac3bdb2e6ed74f2b9add07004bca70ee1b03ae8d19276af26bcd

SHA512
8b8da19d3943988996a7cef03dbf6339c392d1ae35e8ee771805e15252ba4752d0bbf3cf2432fb94dbf129b4804b52b862d52a7334d9e21ba9b31d9ed0ff4879

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
57b1bf52024b33eadcaedba6193585c5

SHA1
d79c90ba1529f457f27f3fe5664736c3503728a5

SHA256
dd468804ec3753790b0a378c1ee4d97e697da57317be43846d5664851c5b82ab

SHA512
0ac2a8529ed2aae6e11d04a6ed785c11df827c6558f40b0d2fb4d031994afc2667f7c1a5317580d9f7f39de3133a306879b832d36168ed6b29e7e240b56fc7ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDD16.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDD18.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit