41431703efd0457a231159725eedeb41807becbda7ae1895896c1fdba0f9c6ac

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
23-08-2024 16:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc73e356e56932b47df85e31591fbee1_JaffaCakes118.html
Size

9KB
MD5

bc73e356e56932b47df85e31591fbee1
SHA1

b700e115d4ca66854328b25fc8a04f0c20f2f73b
SHA256

41431703efd0457a231159725eedeb41807becbda7ae1895896c1fdba0f9c6ac
SHA512

ef3e4cb261b40953171b12185572a8ff22b9e9a61656eb62037b1b985e7d85cc78491230cff130d43cd7a465d226159fde11ad80131cccde20d9353dc1b39809
SSDEEP

192:qaZ+sSN9aY29CTpUEd2KWTUueZo2gtGtaW9091aLmokAzAktwhmYNINu1VaYRQ:qaZTOzTpUEd2FQueZEtGt79091aLmoks

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430591843"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60fe205478f5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000a9d0293d310c6b3af75ac08637d450e5b5f55ca1e792e1caf5061a8f2ac432e9000000000e800000000200002000000063ad00a250f50e424d2d44fe00b6ad27a8e756af0873d7037a68ca0cb6a9795690000000572cb2974abe62589b28809817c3f95b945aac729afebcc8d0ba336f018835ba930eac0e83fa147b2f5d902b23bac16c226b6ee953e1058e081e12d1e451bd1f8bb324e0ba14e33aa1e8cf67e57c1082ad521d0f82e3c368c27b053036ec97295a2cd7db09eb3e0b1359e3cdb47f97225cb583d88e5dcda98f3dc29066a3df8841bcea8f70ff529e4ba8f187f8d7092c40000000f3b8e5a4bff033bf96911b74fffc6d5a1717f723ee4e14337975b4a44d2b885f7f9575efa1d608d4b39e85e3cbf7e9862cdda4c42c47554898a0db6b710cec3a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000649e3be63526158e6912f5e7e2ebfc5e086be5e4fa2abd8937df8ad79979185a000000000e80000000020000200000001d31f2d4a41bb77c1c2412aa502d0719d7f51219e5f107377fcf09702b1480a620000000b59caa9ffc87b99daca5b1827e56e58f3ff2f7a0721b02aa0d210409cb8e16b84000000012b88f600a8dffbb4095517503f13dcf6a64b526bddb9974a29ac4754b284d8508e937ede2c198ed75c501510c103e610b25266369fb7fd48fdd85dd1d9df10a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7D43D0B1-616B-11EF-B88D-EAA2AC88CDB5} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2240	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2240	iexplore.exe
2240	iexplore.exe
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE
2212	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2212	2240	iexplore.exe	30
PID 2240 wrote to memory of 2212	2240	iexplore.exe	30
PID 2240 wrote to memory of 2212	2240	iexplore.exe	30
PID 2240 wrote to memory of 2212	2240	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bc73e356e56932b47df85e31591fbee1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9228fbe835327b0395eebf618f0604b

SHA1
9a9823de24b5936a7666893ee5a21446128e7ed8

SHA256
0073e77816193ec00fbddc2f0bdbfdb56ac5d4df0c52e79a04da0716e49b37ff

SHA512
357fa9e106699dc369eedcef4402f6acf0b1bc642995d3ee5afa25f5d80114f30419e12d3284ffddba0341a3eee6ef2408beb6018d9fc24d2dae62ed3da9e684

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3677ca61fd63f5d91e3cdb79b7180c4

SHA1
8e4923b3154341d36cb888a8b180667dfd37ad3d

SHA256
40484d3d7fff1fcf36f6b0c84ee2c0abce5dc72dfd93e4a962be8ed4d01b4759

SHA512
d825d49f3d0230c764a7008b116ede8871b63dab5319899962c3959aeb90524f9679ffd3878f68dfa41d1284e28c254d6a1435498fa55d9f909ce1e2d9b6b703

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f90b0b068d49cf638f00564c44b2cc48

SHA1
364964d0e476f9a50a8126ca768a9bbe113653c0

SHA256
5b8a75b2f42771eb0c5ff049c9dd02bb656b588149c30bd80f19b614aa8e8854

SHA512
0f720dcd558a7e93148081fcac383072795ffdf0a704b15db1858fb440c6fda01c0305e0fffa21b68d9f2608714e865bac78d9d1d0e7b99ce2acac10bb579add

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32358e708100f24ddc20a50e241edf19

SHA1
8ef225bda15433dffdead1573cdc2d6eb140484b

SHA256
5b373586c37c892ac21126baf16372fe9186de7b1c17471bf8ebdeec5670ca6c

SHA512
66aa922bad8500837188a60dc3fd211ad5ba5e87902d67511cc6c62c245d2b1cbc8e4dde468fc84aa4365d4b15ca5018dcab528e79c2ffbaed2ef4468a1a0abe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f37e6ac47695a6fbd0c9a0640b98fe07

SHA1
27193d7919b12bda498dbdc181668c124c755275

SHA256
6c51c24a0ec1378b3c16c3ff5ba9a928df6fb50a5556e6d4dd9bf7b5aa03fe49

SHA512
eea5b96903c4d0a6e8ef3bbcc311b754eb3a48929f330097385e5ed7222e7608dd9dbde64068c40f3d106f3742a1da172fffcc22add3ed2f5b5375ebc4c70cdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2aa5b5e09ae27452e5b8c565a677f128

SHA1
57f53abe5ea7384f85c3d6fcc2e06f300447e0bf

SHA256
8401d679e718f60ab8827755462bc24af95f6099419209bd4297bb4b461e073d

SHA512
cb0d8ecbe0bb4cb6dffa58212e150ab005fbb717861f22ebc3e50bcd4cc64865c3efb002460874ee4afff1b3acab01321f13e254f921baed8e006a1f0906721e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
585184d30c4c60e0690323772769d9b4

SHA1
bffd9425369944519208f2b8559a9721e069e08e

SHA256
2f7ef885b363a7f1347ad549bf5344459b16722ff77faa5a361ba63251f47984

SHA512
3750a175e963e9f6824c392523e58ec93339a7c5f6f1ceeff9c023baeca77f1f80f9c3233fd9ffab15df731c6aa5f0d201d1ae0723935f0749d1652f616f9b72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
967b4172d9002a2af2f00417204393de

SHA1
aa7c0240df53126bdf039a3c4d3168eeab39aea8

SHA256
da0defacb4f474c3685e6acafeb8d121fd2fffb7599b852ceb0388cef97dddfa

SHA512
66b0dfb80afbbec8688139aa1978f69c5e41493ba0cf5d06ceaf2dead5a328738345d66fcc954a4d4fb8a47dea796bff5a517922fc42d4e6a97fcefdf5ed9c29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a142e2c59cc94db7186ff3f31aaf0094

SHA1
e4664e821aebff61e5d148b322c5b04fe8747ffb

SHA256
a3fe235d178523df569a82d9651f2d0de203725d0eac65ca4f71ea8c02273d00

SHA512
7128c53237ab846ceedf0898f32ff12f2e4c804926393b48127d9e4021b06b5661dd54f38fd33a5910e48d6359e76fd39135716a243657c08a09031268b689f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ebc652d20c5a87bf288d23bacad1038

SHA1
fa8852a681bdddac2f4e0eb997c4d6e48e155667

SHA256
05cde64a1e70192ef261ae367a24d622b45fefe0849c64a2b955b830dcd97006

SHA512
560683fae0fd3d7dd31519ff8bc48a89d3b004b09589b2dd51b0238751eaff37eb839a86ca0405a8a89749d4ab524db360fa46d48bdfb2e0ee2cf884c782b324

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81ae5118a42cc5de1b581ca4bb15159b

SHA1
b985b486433579b323701d15e726286a56a3379d

SHA256
eb37149875b538f6fb7009494464e8400f0b183c521727e2c86c61922521d05f

SHA512
8a8cd79773b89fe6c5b1bc4215f125fbdc38a8d49ad229df424563a481f82b57fe5e11eef9999afc44b5506562cf72163b7ea3d8b62d70b276dd6ed47d3a577f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6GL24G53\ga[1].js

Filesize
45KB

MD5
e9372f0ebbcf71f851e3d321ef2a8e5a

SHA1
2c7d19d1af7d97085c977d1b69dcb8b84483d87c

SHA256
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

SHA512
c3a1c74ac968fc2fa366d9c25442162773db9af1289adfb165fc71e7750a7e62bd22f424f241730f3c2427afff8a540c214b3b97219a360a231d4875e6ddee6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB695.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF149.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit