9718744f453ce9590a37eabff8e6b5316c2055c029a13dc1a80b818a5a31807a

Analysis

max time kernel
138s
max time network
132s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 12:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bbb999461051456b0204aa2444ac4140_JaffaCakes118.html
Size

6KB
MD5

bbb999461051456b0204aa2444ac4140
SHA1

5cd514e5d29212658fdb6343138635cd8f574fa4
SHA256

9718744f453ce9590a37eabff8e6b5316c2055c029a13dc1a80b818a5a31807a
SHA512

21a0e37343b5857471afabc4ddc62ebe7f44e32e6745d62ef9f322d1b3b09503d4025a8581752c2f3f51c758ca860194f108b8173436a575868f18a598f5648c
SSDEEP

96:uzVs+ux7wSfLLY1k9o84d12ef7CSTU/ZcEZ7ru7f:csz7wSfAYS/ab76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b001240a58f5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430577983"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3516D911-614B-11EF-AAD0-E29800E22076} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000002857fa04a09405835dad492ff1747a67075046d6112300611c96356a17375a5e000000000e80000000020000200000001bc8bc85e3a368e82dfb8c023147a9b337d835afb258767dfc1f1c47dfcb5cc62000000001cf78c5437244bd81cb5859adf6436f63ae2dd3e14e4ab26dc22f0292b05f654000000076a1fcf8783adc676b424cd05329c08ca10a7ca0319242f7735dce0bbf18dc184dd32894a231d06824b620615e0ad7dae12b39a54baa63ff33280dee19b3b92a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000045238b849cd4cc4e12fbce26f09c5acd89ffc342316447575a894023d817f69000000000e8000000002000020000000e3a40b3ee4fc847dd2f0c3fbb168a716e8027b8b2e210db5aa8678b7a3c8624590000000d58548c0871c127c356ea6744cc40974ece6bba07fffd1b37b6622831ce8f2b673b309c89a0a03bb4c269cc136137fb40362704f29ec324c5d759a7d7f510671130e26c0d4ffe8a6197c8abd39214d8b68de3db0f0b4e40c4abcc1f27fcf05b8af04e88206f08e20de4b209d2066a073f6f3a2d03d6fddbc3583db0e461cb65f5567b3f4b1dc8849799715442490fca04000000053cd58006a33c3c7de9020a38a2bb189ddc22e4b46b0629cc406b01e0a7969705acc572d2fd3e65e04a80a64d8db0b0d260cc1408e84c377d496cda67e25a743	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2644	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2644	iexplore.exe
2644	iexplore.exe
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2664	2644	iexplore.exe	30
PID 2644 wrote to memory of 2664	2644	iexplore.exe	30
PID 2644 wrote to memory of 2664	2644	iexplore.exe	30
PID 2644 wrote to memory of 2664	2644	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bbb999461051456b0204aa2444ac4140_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2644 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df1fcf0a2d899dcd51c8a1f8e5433d46

SHA1
627588edeae807061afcfca3f2c186f17962760e

SHA256
ea5f6a50a06e8719e439375759cf7616cd96c70de8ed5dc9b5107657d323d998

SHA512
be69fd618f70b6e2f5f0858b955ef46601def4cf559c94cef027705bfc0064b75ea68d7d9e667a498338ec17bab58a09d89f8e75832d17450782e79e2258ac4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4b38c47ea86b05b5577460c076830d3

SHA1
f8efcc8c84550215ac614ed94196709f2f1d3f17

SHA256
0cc1bffab9ff4216044261c47768172951fca49e25c3768e13697cf53c94889a

SHA512
df28f3f706f57eef9276e665b2824c91b82ebffc78c555cee240abd34b11890239182f117eff5ad9910a77ac2484e481f73da3642353e35fe3a6494f909aabc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a91fa799b6e6127d7a0f80466189725a

SHA1
81519c45ec8d8b289f9963c24afe22f9429ae77d

SHA256
30f1e50b62efb1a39b95e0943ff42fce71beb4552d024e6e8674cff32ec61e9c

SHA512
f47a83a453564d0f59961e208fc41c81fc02f9b095e41368a7bb1503162db9f70435ae85e2b2980c71a1d8c127613aa725e5e2eaaf4eeaa9b114572a540e7d30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb0e938e92c8db8489dc530b729ed763

SHA1
f916c9e7afeb18c533ca4761c5c09f5d862b798e

SHA256
21ab0d2f50362cacafedd08070c80843fe3d664e9364afe23126987f49c1f354

SHA512
b9c22531bf53a8d6704c6383bb7e5632207908f93cb1c0b8fc92b746fe46c14c8571c030eb5c75af2f0d8917df775dc63e96b4c9a0cf38cbc3ec4f40bc719c7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80b635d8fd4418d5054ef7778399bd7b

SHA1
3f7eaf9871b7b131230440150870472538e237bc

SHA256
c6be6ed2779cc25ae77ea81313849b5b75cb6dea745fd938918c4616802f1ffc

SHA512
1a1197ddcb6425c8ff81772471b6378375e0ce0ecaf309dcaa14570c338b6a8dc55ab175067b0d9861d86feda203046188ed23102df190eeef9f7277e42035b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
404ac1004a468c15a2d0f82927860f5a

SHA1
8e1b38891e7f23a4e8fc36af806f2489aea6b930

SHA256
f667294ff83c4ab6a221caec96756f41c380401e33297b9d2fbe4e26afd00bd4

SHA512
b402ae5955c99f4fa731fba0753d8b866429567f913f77082180f70b2fdb3d2c708bf781ac7ccd8763bf90deb4ff8c46136419a54374fda83cb33a876c5ab096

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0e3d7707176ae179ae6a870e1171ab8

SHA1
4309ff4daaee3ad1e580ba5079fc04bc8d70763b

SHA256
808dd37ee1e7308a3232c0f8bb2af4b1991cf9424179abacd3b2db10728bfcff

SHA512
f9ae9ecd4be5c147487bf623c65d35ccfc5b6f22b111e831ec76c118fe3f268af2ede9ca3439673f78e1bf512baf3185190f3bacbd17adc707cdfd71ac44a4dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8982f2205c2ac38053f0f70ea84094b1

SHA1
b73474b829e4e8b9f417b303dfd570ed6ed67eb2

SHA256
dee320438d0cd9aa88ed343b4172056a945df25292d3888e2717d8b2e99e64e1

SHA512
480d04d6f13f00bbed9b751dd892a241d30f3cf762d3323dd97b338b61c42d018663626a9fdc2227ef02f15bba4070dd74fc31e1063b8dce87e55ab4dbf5ba97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c73ec8a4407acb92bdb4be73fca368d9

SHA1
aa2c788f75256688e99470c3b753cef14251d8be

SHA256
0af643dce5573a221a65bbc80b9562eb50e8ed105f870338ad91389496b7cef2

SHA512
5a9ae7c1613fd7c3cfd755bdadaa2c47ecb9cbea5a1b8b2d213402abaded6ce168137b1656cd0492b6244bf2f7ba7cc495a315c6a29cf09d7526b97a5ee7c9d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16a1c6111aed00da552a677da887bd70

SHA1
24a12bab47636b5fea257dd06fdd691a8a2a352a

SHA256
8c72ee95b196d9cb09eaabbd6b7bd1291015bd8623108393b757e635c9b35f16

SHA512
af80830e995ed5aedf4f155d4b690035342c0e8d9cc585e55d7ebbc503f80696766ddac8c8b00e1718803b17143535a0b3b0a67a3ec0c0fdf7c31e789fffa4b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
932682528ff166d3ea3d45d9375ad3a3

SHA1
e81188f356f5c78cd1f2319742a250840e6a3641

SHA256
958db7047680a16559145beed1009632e10d13c0c853c08479dda73696caed78

SHA512
bc6e8815fd3e85332607c64323b94f0927eafd8003fa8e7599d2b5d96ecd30ccf9a08bd2b899d6b0924bb43df76f69ddaf656a9fdf8812862a1c517199e4fb3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
296b683439824abdddf3a86d63ee96f6

SHA1
98904687a8541af1a62a91f4d0639b52525bb1d1

SHA256
f312f8f033253230c1f3ba9bc179192bc8651857be4f7e3d12220734f0232603

SHA512
4c93d4d7070c8661af55563f05e46bc7627d8ed110c043a2ea35995ebe90fcd84073303b1018d60a2ac530c7c67f48c39a29673405837d5a347b9b229422f95e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d6f4d5c40cceb70e6021eda95890563

SHA1
a4299296b08c8d4790c1df59c701cd3cb2a2f894

SHA256
3b8f57bbe828c84485a9c3c6f1d8604fb611642a5f4916cfa837a03ddfc918a7

SHA512
ddb3488de8d06ca24e0c010ced9ee1a4b12852c73e865a307bfb48eb138d810dfc68c00c3e6d614c52da478bda96cc0445c7d4775d41b29e9a3438f0c81b1ada

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f02a9d4e30c235e4d289c8cbf5150054

SHA1
6532ce8d8a97ed6d29a16e6959a51bb489bb8ea6

SHA256
04d674d8aae4e5a801bdcc2d5b637cac0bc84a724b030c3c29e75b3c8e418115

SHA512
101f0f5a70d692d12eee26fb37ab6ec33f0b146a0b7107154d0f4191bbcc3f60681d10f7ff3b9f5b6f4751cdbb6231bdc54ee7aad3e5023aeeb670819d0778b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21935ff5189bc6f09ddeee14b7853213

SHA1
6f175d555cada7ca66959ac379be6db5fbb5e6cf

SHA256
0f37756b8bd4469a3b3906412c3a70aabfa06e685e28c1703a2e16475db95121

SHA512
226a469cd932d31ae94ed1b7f89e028add0836e431f7cbc48f7ec34e2d3b2975dd1fe5c720d2c67c168f2af436fea0a1fbc96bf3e0ad6177564b626d351267e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC81.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD30.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit