1c23855f8aa3dc3ffbbd4d90979f388f23c0b812fa1b870ce6638180027f9d17

Analysis

max time kernel
76s
max time network
142s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 19:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bcdd03a85c12b2f5de8831e89411f37c_JaffaCakes118.html
Size

53KB
MD5

bcdd03a85c12b2f5de8831e89411f37c
SHA1

56b16655243e0fd07367befa3869bab12f3a40ce
SHA256

1c23855f8aa3dc3ffbbd4d90979f388f23c0b812fa1b870ce6638180027f9d17
SHA512

151db517edff5e1d6a2a40ad53fc3af4e1e8c6d444bf55fc105df8f4c8e6a2af510e2e1ab56d4a7cf5b85a35f7b2d2f5b9c4b174584eaadea1fab6d87b0a6cc7
SSDEEP

1536:CkgUiIakTqGivi+PyUdrunlYV63Nj+q5VyvR0w2AzTICbbpoe/t9M/dNwIUTDmDd:CkgUiIakTqGivi+PyUdrunlYV63Nj+q7

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b04149a791f5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000004869159bf663d270204cebfd2e2d7ceb87a1655cdf8ec6b0b6b699a33fa2a039000000000e8000000002000020000000f7943eebee5c81a820752ab7e05df75f35be665a4f0d57ab7a77a274cb7902df20000000e01e7049e768974fcd60d6dd1626fca6c1d8afae42d6ee1efc21b9773cede6264000000057cdbdf309a6bb22952a2b38ec01ab00dd08fa3107f17ae784182109472bad329a485ce1c43d366ef70b217ce2cf3edb7a237d19d0f8d58e3b0d03a10c4f3ed7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430602731"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000008e26c140dbf4876d1e621ab52e0fe1f3a874d8394dd863891ac31820cff5b31b000000000e800000000200002000000051fb5e0d1737e58a3611b1d6904caa118fde832d0d166a3aa52f1bc59b343a6b90000000610aceb1678a3389b872882ded63c0fdf806cdcf5355b7c4a199f1bc8f7a13e107f345c843c04b85f2990c2a883e11adf73de5a554d9c47b9ea68a1bba9335cf16fef613f96a7fa9c9e017bfdc2eba4705fe621f709ee48291dadb66637dcf812ef13980999dbb17320b240c9f9a12ce831994bd1fac2033be6e35bb4e36b7dd7223b27bf5dc2e10794427208d66e268400000008d27da24ef2fc57bb4a112d036ab6254928e42c1b222a0e39d86d5af71e24ffaf58b9a520cc8c0323776dc7c6df46bf190c93d4d39b24422efec502e893bf545	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D14B67E1-6184-11EF-A251-667598992E52} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1900	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1900	iexplore.exe
1900	iexplore.exe
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE
2420	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 2420	1900	iexplore.exe	30
PID 1900 wrote to memory of 2420	1900	iexplore.exe	30
PID 1900 wrote to memory of 2420	1900	iexplore.exe	30
PID 1900 wrote to memory of 2420	1900	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bcdd03a85c12b2f5de8831e89411f37c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1900 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20bafe8f199c6d5493d61ffc698cca2c

SHA1
834b9c90d3310c8aecd149c5aa44acaef00905fe

SHA256
c673f65ad41f4003cf15749f4bc1a2260dc86f8e98dcdc1938576a51497c95b2

SHA512
2a1bf3b5ab3fd08f465ce396d856e37d65eead5c3f2aa9a168a834c11db69dafe3d3bf95344c54c12818c2bb711620d00dc92f7594db6ec79700be556904713e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d93eb306a5c7d82993d21a12b913170a

SHA1
f3efd14c9b2d2cb90eaa65c4daa5a007a24d555c

SHA256
a0efba0a96815ed2efb6ba8cd613c655696ab69debd115d75d865f4ee2f69f2b

SHA512
b68f4efb90dffe1c6caeb29a877b0709d73c37b97469d246aef817712a01bc6f871f1149567d2fe9f72a290e512fcf5c92483be4ab4045950a70fb61930e2945

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f0b94730333b865d7813931c7725119

SHA1
6de1179b204203202b79aef6c63e5958eff53ada

SHA256
b34387f7a4313216df3eac9e9f455d671cb116241f1ebc36f8907fa6345aad5b

SHA512
c49125488962f231ff44b0f1433108ef85727860c93cdacdb7074d332a778a85e372ce5e74763c7d374f8522abdce56fe9ec30e44635db94c2a7413c48aead06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
720ed9ee3cf0e9e0a7407aba31cfd5a1

SHA1
cbac34c4c17f4cecdb2b4662fcecb698cdca341e

SHA256
ef49e02dec22fa2a3b5532c22f36ff18613087f1b8bcfb505d36157bd454b7d5

SHA512
b543057efa86032bab73da9d0123b6edf97444d316249311091c5db8df95e38352cc8c63613f509e0df94600275cc1208059fc43cbc9e1669d8bbd5b472bab8f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
325da6e171d147ddc86f39837eb3f13d

SHA1
8cd7991747244daa883565f5920c0af45f2a6688

SHA256
4a0013a51f55b8bb9a11cf2607bd8e1e7147e02f412086b088550870b01cc040

SHA512
ca15c3894961c2f7a63f62d885cf88ab0a39845413c70360ba7ec172b346ee0af36b39280e5e0411eb1cec04fe2d7c24f71d28860457acfecad3fcdff27ce86d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e92866bde4996472c4413b43d533b05

SHA1
4a0d502b40939fabfd9de66e3faa6c3f6df50659

SHA256
a192b32e32fefe06858530cff5f14a9e014465caf09844181ca68dc4472b9cf4

SHA512
b4effe9fde915572b303c492ba3f8a930e722ff15aac4a26beb6ee2bfcd0974a6182a6c6752659eb7b94d0e6bb6e1b422e86678cf9ee796c973e25a86a835bb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92e04449d22a2353fa7bcbe2be183313

SHA1
bbf04ae28c4f2a616c8bda9c544ea7a16983ecbd

SHA256
26ee0a8c9d13973f5be8f6442f305cf063aee2592a0d6463509fdedcb10cfbaa

SHA512
db0a8bfb1be81d1623e22d2976a1544c4c2cccce04b764a5ba824b28726b2d2b697179075d308f9b0cd7fdab4fc7cb521ae1fcadecac6022624792393badc4db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a21a071bea86287d5b54805450531136

SHA1
24cbefca0e16eafa628153a54d6e44c74b4e953a

SHA256
f778b48b0544f153f465d8e75f2daaeea26c49b786ffff4bda6626da5a79862d

SHA512
e2e76e7580f5e6d7f8602682b05a8e5a192584eace3ed7cd8e4c744276dd35a459a7c01d6e57979188c10129adc540f5f0f30bad49def5ae96e7f53c5a094030

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5705f3962bbd20dc3a2603d4362c6f7

SHA1
c7cca810597ded54b15f61c72d8e24d3a4b42e7c

SHA256
968ac01e2b26548a66c60625541606d5238a71ac81957b021f9d7b7c68df3d63

SHA512
776c43774418e8019a85f1f5acd7588436040bf71a7bda90e737bf4f5ff11755698ba7486654a351658c91251b8c7bca63f89ddfa45f0aa2f95b2a94658145ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b83fa5e902544f2e6384f06528944364

SHA1
4434be92907cd955bf8f6b694956406eda9db8f9

SHA256
e49c94954f88c43c869205a9c47009fd375d7c69fb1071475961ff3541fea916

SHA512
f8b2312dba53d35da47c87b89ad2498649d47d4612c8ba7875a868ab0190724d8b525d218c10fead0e9d3c8b48b5f042321205430f3ab1e493bd521d61c78463

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7cf0fc7de96e746c731418d754882e24

SHA1
69154ef15bc4c38dde7e9cd8652753e2133dbffa

SHA256
a1dd2be2b76d2f4f922769fecf6d36b43c1b050f038f44b3f6f4b82a426592b4

SHA512
7ac90e6fca1ddacf3b6215b229af875954e8d867a227d8232bfca056dcdea2fb8633cbdbf4ad2feeacc1b123ff20a0f701496408a23e1be7c0a25b1b54843901

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f9779044ef5412d8b964baf4e2a8b99

SHA1
6eed37c1f342f6fb7c779396b83da51c11e33fee

SHA256
24885a6d5d18d8d1c46af0e2e977d5be2b1de4d422be34dee34cab8cabd8d9e5

SHA512
34ab74de9fdd7fa34be256c61788d1c491f872e07daea2d82a5286f7c7d677a3be320042fb33e2ac509bab33ea823965cf89b8319448035d2d3985acf5739baa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ccb2ec5b31533ff0d88326d8c2a4699c

SHA1
e5272b98cf9620e2930d2ee770471c7325142b71

SHA256
7971592b9330304ee79c54d9cefc074465c64890dcdab5fd5ae5642225d35007

SHA512
7f08de6e55de733bc1e56bea29048bbf95d5611434831ee46226f4079de00b2e065dbfc6b52850d8d32ea5dee615e735846d9beaab658098c88bc201a401400f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61d793fa36e33aa2760ab9f6acb8194c

SHA1
08b35ddb49c609b2c235ca71d15e12173f48b36b

SHA256
5ce40de32db32cd5f8c0edf9aa50f3f0fb5a9fb32846c9ef7928f4e0bb7ffe79

SHA512
2fa87fdb529fb69b154aa6daf6d3a732eecc18f0dbf1a1a4dd1fcbf37b919ce9a391d629b01ce2270a84b62ee9cf731bcc89c68a1b3da528248e40667bf5d611

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NFAY0EOS\style[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDC4C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDD1E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit