2ecaaef31fc47230c1afdcccf992e3637fa465f73fc4084b7cc77eb10fd83d3c

Analysis

max time kernel
120s
max time network
130s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 15:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bc53125c5902181975a4f38c86a51c10_JaffaCakes118.html
Size

53KB
MD5

bc53125c5902181975a4f38c86a51c10
SHA1

f133118f57672ea02060918bcb32083dc14f8132
SHA256

2ecaaef31fc47230c1afdcccf992e3637fa465f73fc4084b7cc77eb10fd83d3c
SHA512

6de11544e4368962156ace873edd819a3eb43b0c7d2e0be4e824ad20a8ccca7863a84f235b6041f8e54556b2cb1ee5c2a530e97217956a40591e6780604d496e
SSDEEP

1536:CkgUiIakTqGivi+PyUjrunlYr63Nj+q5VyvR0w2AzTICbbzo8/t9M/dNwIUTDmDt:CkgUiIakTqGivi+PyUjrunlYr63Nj+q3

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430589058"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000008ee6d888e949ae50d7e927d4555433bccad4c19d9dfcc2193962cdf772c8e11d000000000e8000000002000020000000d072d1592df1b9c51c751d531b6799a7c67fd61419ca405c6a47a7c2ac056a6f900000009f1f5f403d06faf3f4a59a3ec77ab151118255f82b9f175d5a0c27f2ac8c7ed2b7b7febb9b83f1af28d6cf7880cae2f2da6c85ede7f6d5bc13db4b707aea6ed4b32a34659e2eab60f8f6c6c5adcaac0602a691843f8a9443f292dc42768a25f6831c1b96dd91ab51f6cc67bbb540fd494269366c2a4660c18df88823aed793f9b65ab9e63784a90c4887f34513f3441d40000000eade3b45c0f7c31a14a8dbf457722eb33a6002e03a2ca881ef517f7aba9de66fd1e7b70fb5a11c77a02b82d3110fbb85463952884212062447567befb9859002	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10038add71f5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FF7EB2E1-6164-11EF-9A0C-EE33E2B06AA8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000058d53b5072884212f0333b0e470450adbc626ef4f43b04de1787ebd5af02090d000000000e8000000002000020000000fa3c9a77f0f3083b6a888bee91fb6a5e6a313e713aa0511cf190e49778ee7adc20000000dd3ce3ab7a1284aa122d822cc9b4068e699d8c06b7990976e9d21f180e36136a400000001ca1d416991ae658fdec35a8616cc177d5b4e8c290ca1b95163b84d00bcbbd2f6049eb2d087b566b4c82cb0229f4a7c74c8d172926a78077b4d8be3cb9268e87	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2416	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2416	iexplore.exe
2416	iexplore.exe
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2100	2416	iexplore.exe	30
PID 2416 wrote to memory of 2100	2416	iexplore.exe	30
PID 2416 wrote to memory of 2100	2416	iexplore.exe	30
PID 2416 wrote to memory of 2100	2416	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bc53125c5902181975a4f38c86a51c10_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2416 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1231d5bde398cce4ac7526f23af0959

SHA1
5a0cf1996da0e1deb8fb365d486235d266c12938

SHA256
e6fa8933728c9fec6edce1ab0074f22816bc5944724835e66db9efda05f230ee

SHA512
66f62781342222749de9aec047cdc1baec3ee1a9d42dfab19c3504207ab625ca975d0c3c2a213e4d06a62963bcedde8e6f4a3275a341f3dc25f60dc1dc706bbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42e415cdbd5cbef1240ad3e1091fc221

SHA1
0a341c5c6dde3f49e25004677dd6790ce16bb072

SHA256
876da6bda8bd6e3e03c476159c4fc00c5b5f39b99508356365561ee85d54014d

SHA512
571614d9df016dc6b379786f5851376fa718cec65bd9eaf0086b4ed39bc92d771709b71028efdeb3a57ba1891b811bafefb8a66b94500a15865d31b88356e70d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc500f1950fb9758b76d49cfe184b158

SHA1
8a234921348f3b4dcc4a6b99fe0f861db1e43ae6

SHA256
a34776e5f048a5193f9423b0669a734b26e76d39c128f2f6f580073a38f1a80f

SHA512
b9e9b7c5d9c7fe92536ccae30843c551baa864bade0fff2c6049cf4e6b5d1a9771c4d7ee801d8ff4bc9d3455a7c2135b8d6aa0463e70b484c26daefee059cf53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb3b0f0f9d11ccda7b7aee37f5e6d0a9

SHA1
0a0602d6649a495dce236488efa7e4c72373f667

SHA256
51caf56b20433766f6c3869b699148e15230b39e06e20798fde747993c983681

SHA512
8aa0090daf6565411deaecba3f8023b0cc572ccf46b3ef3790dce2b65242ebb0ed58e69bcf8c87d66a733b8a2dcd7b6a3722ec5ea8931421c81f86714cf352a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21975a155a79a1348425ded2a5ea7b23

SHA1
6d893f7ef9c869924d28af4dbdef486a5f368754

SHA256
5c587547aaf18f7e0730cf6f717eb7fbc591337713e77d2d017704b3d411ff9b

SHA512
9531baacee8cf22a8e22d0d6057e6f94b7ca68cbe346d19949180468365a7112d4bee1c98daf16510c8926148832c74bfc626df580cd6a8839813b3f29dbae5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8702c6527d10347913e02129657aa00

SHA1
8d6d235fc414d1df6f303a8700e4e116092d8eaf

SHA256
e49480d0d1e4dd6470bd48341fce2725fa86a4087282d292ee3b306badec5a3b

SHA512
4f6653825208bb94ec9a5c26805e65127e6e3476409ead0c13afc364b4e3a4b7baececd834aa7fadd875062af09a4844a16775af585d2129cce068efc08ba34b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
baa784fe34673af568edb4ccea114fbc

SHA1
25a14997cb35a6015373f20dda0c871c88dd6820

SHA256
0194886fd3838c418f779fce4f531b20527abd0586687af68726eb16fda5b5d1

SHA512
9a5518733133abf89e0927ed3225ff016cd848452b80fcebe5312bae0e1a16fdfbd8da17229d1640286361a001c72630036d57cfade7bd10a8f74c66040ed871

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
352883f98f549c01cb62a46c654234f5

SHA1
ec938540c603ed3da1d67f9be201bf85c69fd54d

SHA256
a1275decec3484f7b97c175e727712433d99b3845abdce8f55d35effaecf1739

SHA512
0f050e56964c781f00d6318f943e4df6cc4cebd09ff453c5e6dc0ddfb6611f403d10ca9465cc2490033b28a3c77265243c85ba4f87e255a16df3f1866787f7dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0752f137ff63b228bb5508fac4e80037

SHA1
50b59da78a4d6d7929bcc938a764a52952629393

SHA256
b1729af9cc5c4a285ce0572dfb91dea38192c0f7bc9a8b810d0997bde679dfd3

SHA512
e77dac6fef6741b5f017382a605f16cb4a2f74417f979666cdb1ec3092a0433bc2024911d5546adf32fa466abb11cec50795e02308f818637b3ac80fc933e64a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3111b75dd2849589c8511cb0b1aac41f

SHA1
03643f47aa6076ba951648ab88d2b298210d4951

SHA256
d85595930832c535955bf271074151d8f5ade2ae842747be4f934287828221de

SHA512
753f9fecd2a6026a5bfe38d908d9a896849099d095cd9c007c2abbcf1c1f3b2a808745b5675c130475854eaea7c0e9c31021c567b872abe06aa4129f3dc06f8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cdcdcbdee4851eb3f318a9465d10d976

SHA1
294c085f2ca5010c2d564caf7666ecb8c7458d85

SHA256
df0a4829ea22fe41fa13108c0262663afb924aec88cc7af5d70779e08f43769f

SHA512
9666f0c31d4b1d1f66c65e16f308643241837307554a95c5a1d9eb53615057880a791315bfecfc83e5b871d8146ebbb8a9bac1dbdd8c23bb47391c59b0a925be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d49ef6483e820ba1ea0cab32f21e8e5

SHA1
60cb101f63ae73d6bed2517d2b88f56a0a00adda

SHA256
77c8a78b7f1d2b7a28de351f3ea1e04afac4419f8d8d4ae93fd1c019cddc1a02

SHA512
66f2c3054b1c7b44d321e013e7e65f9bc8060565c276c2fb25cd89d607eb10e94f66553895c610a8313925189151db462de862b6c91e4299fdbfdf2dfb36de12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6XUZ2JLF\script[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1CB7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar214C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit