95a082f83d3eaad0f4f690fa4dd89088db30e6062d9a17614bf670bc87434cf7

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 18:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bcab4fe1686828dd7df9e5cf87ac4e29_JaffaCakes118.html
Size

430B
MD5

bcab4fe1686828dd7df9e5cf87ac4e29
SHA1

fd89db6308a27a49835796983ad1eff11a23a087
SHA256

95a082f83d3eaad0f4f690fa4dd89088db30e6062d9a17614bf670bc87434cf7
SHA512

b52e2d74230b2597022883778d327d4ddfea9c04901607d643f529bfc1370566a2ed961e366d3a910cfa9ab59c26333887e42923fe99c158dfdb8fe93dfa9d91

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430598892"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c0000000002000000000010660000000100002000000008b25db763f0fce1d92f3e40566afa4df50fe4a53f9bab7e7b95f742c8173014000000000e8000000002000020000000b980ebf05d85d7eb170218f9a0b60478fd8425bd63b87d961929871e1138b108200000008156a0d6cc475c8818840ec80d51c4911b0688f685fd9b67950c5e41804561d0400000003d877f86623ffd135bbfae70c37f4115a9a07f59330346383867402dd6f91b07d04beb5770a78f06a804fca297117a73ca0e435350c4829bb5317f890d43957d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c000000000200000000001066000000010000200000006258c48aa138ed9e3ac11f2a88e9ed2b2815f4f4911bcb45870e428a4b0c67d4000000000e8000000002000020000000bd12a2cd906d757ab531217a6fbb431feaa42c32aedaddeba78183f91cf780d9900000003b878938485431906709856ced77c0a9d746cfec6dde78f0376c8c6b21bd032036c812d3d26691f6b62a892126c3de1bbe9a171d689189aa16b4b8e8439b95de0b4b533f42fdfbd724dca0703cbb88e1dcb154eb35eb19be012aef8136b8894e1a276856bea9a2bc6731206c5626a77af8c7b90f242c6a8c3074547ac60b25481a09bdb841d95af4960e89f564e18a724000000037a86a5225a86e5ef338fcd84928a1ab51ac4683ec183cddecdfa8b47006f947e06e0bd65ceb32f8712dfafdfaa45e99a1650ddad4e391051599279bab376d93	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CC9AF611-617B-11EF-B74A-EA829B7A1C2A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 605c15a188f5da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2120	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2120	iexplore.exe
2120	iexplore.exe
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2808	2120	iexplore.exe	31
PID 2120 wrote to memory of 2808	2120	iexplore.exe	31
PID 2120 wrote to memory of 2808	2120	iexplore.exe	31
PID 2120 wrote to memory of 2808	2120	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bcab4fe1686828dd7df9e5cf87ac4e29_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2120 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0a9f82ffd35506ec93fc5deacb5c10e1

SHA1
b4f9f3cabc1b7f48a1824789ee4e9c52dd303b54

SHA256
a7d2869df795c57d97bb3e44ad05f88634d4582a085a3025de74623fc3417214

SHA512
7bdbfcd8e65d1a27416c3ff87a3a75f4b5d6f545d564764ae51937bf347ead2c37d7673b3c90cf83627a85de69aaa52cc328d08d53ed57b8bf00776ddcc90634

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4cbfac195e8e0839d327dd0412a4bca0

SHA1
31e1567130de4a15d415511df2e187ecd9ba489d

SHA256
72ee8b0ef60e70c8eb0d996e97bfbda90e7b75221486c9919719b48d3211a307

SHA512
b7fa86f0a9f18ce86ff92fd6078cea6f6894719d183a04122ff24872ae67453d871d57c4911a0d2ebb3b29a74cb5b9d096195211cbbe64a975073eb40f0dafbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7c703a5a530f1d8a4cd29cc6f12998bf

SHA1
e91d83a5ea23c29c56ac54c57d8c409752e802c9

SHA256
4f44c15858bb0dc07924f5bd662cad041ff40c748096c7b45a163d2869e1b035

SHA512
1eeb141a069b160b4416336a8a549347ee06efc3e9d9ae75e3ea51c94c990c03479a32ab0a7f8b790018089ab5c9e0d6805b5a5bf2783af1639d06dbd44f1b35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6fe5b038c3e6413530100f5d840cb42c

SHA1
d12a4442672299438671710da38e1a8d16fb004c

SHA256
6cdb6c8f281ca00683c435a44756d181042687fc030714172597d0df302843ef

SHA512
1936300f21df701162f541999b6e2f93d0fe108711caf7ab7d469d10d380f2b3b8247c08f78902a4a6d7a1ed19ed6eded6f6ea9c1bd59cbb5d9bbe74838edc3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4b457e3f9c76c257b7abbcdc151982b1

SHA1
e9c1d97f38216e668fa2779a239a0e8c827e59fa

SHA256
a012e76ad5fca20fb9fba0af2770ee59f40f685b0725dcd211f6ff0e70b692a2

SHA512
1bbb0c6789955ac0f56ce49ffdec8e9e0fa842f5972d7916c8b7ae6880d5d56897976f9e5ef124255d593c82895ccae2032bdbd6f76e8c280f6222607aec0528

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1e2c978449ff6bef4a2e7b29c040de58

SHA1
881c1e5068d7dc19fc53e570852b86bf05af79ab

SHA256
04cb4f16ebbfebb12ed7176cfb4b61f7efc0ed47fda8abc9ea5c45222c72b8d8

SHA512
7d6e6661bf24a65a1b945a021bc9f223f8018c5d65c90c6b051e154623c52e13e0e6b62f046215bd89208fde999dc7495f276564e78bf2dac6666922a1360b68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e1fefe853215e8de495cfcd50a2a6f30

SHA1
aeffe895760eca58ca515f63aba67b1c62b1d45f

SHA256
6b10aabfb02a78f179b272435ea36cf07acddce19230c2a0ea98f36b0bce70ed

SHA512
264d2db360946faea18f2895c92daf11487fd1a7e43bacd62cae66dbd6f166daee8ef830e8a4ed6809c887171eb4cecfbd65a154bf7d33c768f9f74fc4990417

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b239014173167535d30f816aa3b964e7

SHA1
9bad14ca0d8bb31478293a803b8a7466942f758b

SHA256
6c97c174d872bc7a04701a76d904de18fcc5fddf3b98ef2748dc94a186d2c1c7

SHA512
a676b73927dae5b14007150014f4ff526bd8fa732b4136986fd38db6c5a0bc3264d295ba667a7911d5eee4157ca94bcaae23f8ca7a954183a8be3756663bb4c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFDF1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFEB0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit