597e0b0a7daadedd8dee829f2d1b22e34d51886718a738bd6b22016ffff38338

Analysis

max time kernel
143s
max time network
148s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 16:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc8e7f9600316e7f60e5cfb4c5d5334c_JaffaCakes118.html
Size

69KB
MD5

bc8e7f9600316e7f60e5cfb4c5d5334c
SHA1

55fe0d56167b685c8401b7f1b1f2f5b6570b87fe
SHA256

597e0b0a7daadedd8dee829f2d1b22e34d51886718a738bd6b22016ffff38338
SHA512

f4e93fbdb66ec42a5f838bb3683fa2d01bcfe5a858867b3af479127a874a88c2e21244915638d5cf4091f399fae3d5a2508d54f071c4a09b31402095c2f463fa
SSDEEP

1536:gQZBCCOd00IxCP3BcNZuO1f3BJKaDJHGcNLt8HQ2cqojEoeJzhBiM9iEkBR0FSzz:gk2i0IximZuO1f3BJKaDJHGcNLt8HQ2E

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000090afc28bf22c12312a73c75fe1088ad272ba297b03ccaf0d3d13c74176a2daa8000000000e8000000002000020000000b2c2330f3d60480a687191a32732dd1ed37a102e6ca14315e0b48d36d54d808920000000e734b12e28855b3e3d1bd9fe49774cbce57628d7a943871e11903d702f52421540000000d050b9d724b9e73d9b8e458a287e8597308846482663d7c96403515a98681d8ad23c6846144566f4d5f0b7820b8ca3619ae8f348f1cb70454f69320f36388c6e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5FC38031-6170-11EF-B6DB-72E825B5BD5B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430593961"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000cf747d4c276fe434b3c47d01814745ce419f1b967080b67b7f183c4cc2f8bd70000000000e80000000020000200000001d77662972f4a34033919c399d54170a09af60211c23d3b85f2e249ad13735ba9000000075794458894729ab2379c4220d6c10c6d57f319ed8b8ffbee385fd39b45f033aeb9ed3d2a965543b7d1aa381be5ee14572b69a07b6c1fa0c90bee54c6976d7cfbe9d052e5cb19b14213f28e96a4ce352a133b987588589459f1ccb0b753c30ce45dca92afd4b4d6e1ed247b2862018b223dcb154073a89fe64b6e01fde85aa5137bd5e847467b33296edb597902f8d7e40000000c8cbec347129ee78091b8957405edf2bd3de80da3fd346e80f36a17c0e93d1d6cf804f95688ac035cc8ea7a8d52ea6586ba7a06e451137f13ee3092df29a93ea	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 008641577df5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1056	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1056	iexplore.exe
1056	iexplore.exe
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 2140	1056	iexplore.exe	28
PID 1056 wrote to memory of 2140	1056	iexplore.exe	28
PID 1056 wrote to memory of 2140	1056	iexplore.exe	28
PID 1056 wrote to memory of 2140	1056	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bc8e7f9600316e7f60e5cfb4c5d5334c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1056 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d39ed05658a7583d9d4e2bfc404e1aac

SHA1
e63501cd4c6d1c467dae536b16540557c99ff005

SHA256
850407791b2897da1eb04232c998715bdffa0e348b68b23e5b1950bc3e37f304

SHA512
e58c4a5b8ba55c5f7859b01aa1f3ca82cce6af1f2c8c451baf198473aee7c2814a6c0b60c6a3d766bb218ff828f738a8787e7aeab53c336f0459faee206aa121

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1842c70e453c5091d1e368ac69f3b90

SHA1
86e10591c7903e6a2e77e4f46f3116ea2d9cce74

SHA256
a2503747b5d5ec673900a47448d7c2ccdcde88124306389eecee1e1067b02e86

SHA512
360b1e60f5ae902fc40c5b0b47c35f0d58122e398ecfb1ee3c19d5c93eb32f4c301b9b119341d3af1fb7468238a1a801dcadff61c24ec7578e4d1f4d0a3a1302

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47858d8b8e6876009a599597045985c4

SHA1
73ade26cb77117726ad819774eb9839c0eb009f7

SHA256
3eee97f9e78cd2220dd1c607e29a73c34e36a4d3f29b9e915c4a1d681d87cb4f

SHA512
adaf6033134d09b634c0a8b36d58466af447bf5fdca2ca073d964009d519bed751480f19a9dfd40a932b7750662c94b9cca9021637051ff883c1212e03421cff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfb0e78e49551c94a6cbfe908f7cd9b8

SHA1
cabd34ca847329ba3d23937562fad8fe275ca01d

SHA256
f4508c01e5fcedb1a64564e0bb34ebe40272e21a483119910e4e4fe76830f309

SHA512
8bcc4baa9af2928d72e257c7ef3218b48c69a6b4471a1804676ceb0c9c0f53407420815eb8192a8d63229c5a31c8a22b62194e3dd50677096f93d0a2161a0fd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d29fc5215273abd32c7eafcf1536ad6

SHA1
c8e48bfa5dbe970e53a27ec7e6661d3818bcad67

SHA256
7f9ac6e5c25d5a9eeb5702cac5b78dd94e3814ad7199cbf3b0a67ece05011950

SHA512
ab93111c060462bfb2eba1fcbf86af56d4be05ceceefa6f884245ff8f900f608c23883259b233b70e4ca7442adb2000e0514bdb5b340d83d137f0f147bf513c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9282451b2ea1fc943980c08470107528

SHA1
3fa6e1cc9b3be8eb6e5c6f71c2f2b46665b166ae

SHA256
377ef5ec9f7579fe8b0101f1d2b378e84ec6a7fd36930b8dbb76b6d215e2c724

SHA512
b2e7e044ba0bbcb49013ddb408d094ba6463879e7afb3404e6b788c619bc5579a453ac72f1db435730fa4d85b161e0ba483fee6b765346ef878fd76864875be0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1306bc1cbf394ad56f85475bb87ccdab

SHA1
ecfcf4502c3c01d1262a83b704801c69ef616368

SHA256
e148c2006190790fc52fbe01ea34c7e98bd2353c2c7a371a8eb99444db214c5f

SHA512
0e48a070145d74e1b423fe007d87a42a2616bfceb4992cc35607b2ceabfa1e40c035804487cfc386503e1f18bf919feaba52c42c932a67925a4cd157a6835a6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1800270c31c6f1059950fa99039cfb86

SHA1
cca9e9a6822f67ca41be4c95d36807211a60b8af

SHA256
6655b8aa8c8ebafa456fd78a0694933e18db3de85b4c3af59e78ee87617db1f2

SHA512
67c7060912fbf4ce1df83ec479a68d4e056cd978ed6650abac5c903e49bff19f53b9ed1f6ecfe083b56c529c52a461a317af20f5e51d44a32b99c467af88e404

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6120d38eea9f5279fd20619236cad8a

SHA1
79d5627736dabac9e1f5c4f8d70720f987a6fc39

SHA256
a4f94de303e4b94f99d9e2ac5040d4fa7b26a2fada0aedc2e39850d3106ac917

SHA512
b477ce516d14066be197c42565bc8b5677cd75f4e76d79752f770cf9489dda528991357cb93d2f5a18f4c3c31da2aed14fa141f90cb7f490ad51dec9092f7620

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f22d101e3d86084774b1683557579ae

SHA1
e586482c6f63de151c7a306b967fc3c770414c41

SHA256
dee9154fcf12795b978e041757b4bf07a300fa136b9bf176ce15906f575c125c

SHA512
44e718928f11313fc5f3bcc7fb8cf698dded44ce0cc4a9fe7d2d4b68f4a822fed9188ba332c73531fbe45e342e81cc881154aa79c63d656c717287a2de390985

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA0A4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA0C6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit