2ee8601c2399de32e6777c9bd7fc1959332cd5ea05790d643da617d70fe1109e

Analysis

max time kernel
143s
max time network
147s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
23-08-2024 20:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd047b69fca273041e2d6893565121ac_JaffaCakes118.html
Size

56KB
MD5

bd047b69fca273041e2d6893565121ac
SHA1

ef41215a9ea0825ca8f9b4e6890a401c9e202b90
SHA256

2ee8601c2399de32e6777c9bd7fc1959332cd5ea05790d643da617d70fe1109e
SHA512

a677463ef905bba2acf363ea676e6b10c172ad7a1ace16ba176361aad97e09e9fd68c3c9102b99c3376c25da61209aa8b307c2a63d3d8c7db770ff766bb1aac2
SSDEEP

1536:gQZBCCOd/0IxCbn7f5AjQrBXiNKJT3hWbR0Z/4y20LEl7JbXDrD7ai2W/4jaNfvH:gk250IxQf5AjQrBXiNKJT3hWbR0Z/4yq

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20e46be799f5da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c920000000002000000000010660000000100002000000083cc0e7048867cc79069f0f58aad3ae4488fdf3ccdf3e61fdb814fa4a8e96aa3000000000e800000000200002000000078628ea8d10af765b57600e125938e1d2463f5c822a3cc9be5fef98c24fb9eaa90000000e124cd41d4d531c7749aa637f46dabef6c9a4bb824ab94309f0cbabad8c734405e13a7a5b58e5fd7204ad01581cd2470a01ad7119c3cd590f9c0037cba5f751f2584d924eee7881c95477a8e87c458d96817fdc6ab17212c54b4ee8e9862621415e726556e037ad2c43661a9add72cdd8a8684ddbcf765cee6b5ee6db7cc71d92ce11582892db21d530bd517217fbf1f4000000021109a7bce18d76e98fcdf9168b20879e2db7b8f0eeca4cc9905c20be3c24b6c72cc5ec632f1ec3d834d5d7f14bdb69a7d3121f879ee1c3a2b4326a4a2c31291	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000400de055d1ba151ed3cfe31ff76951dd50fdbd6daccad0d13dd90c401e6d1d4d000000000e800000000200002000000018d1d78f63447c243282a7d4c31c84668c2de3fb1d22c671bfb6e7f6f628e0fe20000000f4d4bef5a5c5eb2d70a651148b0019f8b22bd3ceced960917c670e9cfd6577374000000046c54fbbe2b65ea81b8fed0d1de4f986e25054a50a5ea47dfa28bd7a893abd659fd22111221a0817dc33b953eabbcf52cd7002923df05dea7a7a309a398bab69	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430606266"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1178D021-618D-11EF-A1CF-525C7857EE89} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3040	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3040	iexplore.exe
3040	iexplore.exe
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE
2916	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2916	3040	iexplore.exe	29
PID 3040 wrote to memory of 2916	3040	iexplore.exe	29
PID 3040 wrote to memory of 2916	3040	iexplore.exe	29
PID 3040 wrote to memory of 2916	3040	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bd047b69fca273041e2d6893565121ac_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3040 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dadf411678f2c3fa53f29d30bec8e814

SHA1
d6da17d0907d4b6bbd14523a93427883096ff6e1

SHA256
a788fd759b8485527bdbe21e697aded9295ffcc3d3f606e12feb2557f84209a9

SHA512
ef3816a5bb8140d76b438e796e769fb22b619d43c19cdb416e87d2f57444b7df9b55f0915f09d7f78f9ca963c942a8246a021dd45b2081a142af9a212cda3433

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28cbdb4139dc2cce5d10cea817dfb30a

SHA1
445da2efdd4cec4379ecd367a27507e98a5279a7

SHA256
c4d6542646f68330684315fb0cb668bc095a8218accac5cc5d77d6e67066e28b

SHA512
2560811a6be3a5e7a5164e9d076ed84aea5a85fde1f78cc8cfcaac61ed432225c7bc4e821ecc8f9c91aaf97a90a675a3e8c4b1e89fd7ec457be5ae7b09f9fb5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d04348ac3393e16b029b0797652f38b7

SHA1
d95e77f410e0c00cb083aeb5475d69a3ecb03fee

SHA256
3eeba82cd9d4abff3fadf51c511d5eb3b209b6fa897988fa44e94ca0fa71b2f8

SHA512
4435711c29a2fa69c6d33f9d2011aa936a3a751d0115b90a554e039aa741279c906a1259ca59782f3caad6f0134165a34083351e271827555c60e6e3fb323df3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eabfc3c9668c818c8090653980431229

SHA1
5e2b80787e4268fbd6ec1eb78a0e2ceba04e3da1

SHA256
aab16dbaef274cffe9bdd6fbb0e3dac308b688713b0347415cca640168466875

SHA512
54475e698fdd50cc3c25d8d9dfc0bec85a876168d2c2172ff205025a2c0d700768a0055bf3bad09132e0d39a4cc682f5ff560cbd373c5f7726ed45cfc106b251

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0735f3a9119f22719ef7dd091834e23

SHA1
1505a44da91035ce7d83fdc9abdf64de31f6af71

SHA256
b2995343d5fc884ca764dace93d55c62d0cef171dcc1a0477d9a625d99b0fef1

SHA512
4cff9ba18312d0372f20630449e65d3d2d42bcae265e8e73b44c850345f1ef3b7a042988eaf73d1e4c78536acc3136355c01096b94e3203d9ca8a40a67329dd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9ac78cc047fcf57b9dbc923a23151be

SHA1
5adc6f2e134a5461d0d3ec57ffa8dd639a422237

SHA256
95ba5e2c53daaf329088171a8ffb546cdf54e6a0e90a7ec8b1d8391717888131

SHA512
f3e8201e654c9dcbee1f3656a6f643fbd83cb49a3faf8c3480600352600786e28ba41a7ccd9e7cffa89743a86b376163cf2418c0180725914bbb5d187427bc63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21492412b72af248255a96e80d30a083

SHA1
9d841bdff265d5772f30a28034ff346afe67e943

SHA256
5f493dcc000dc922fc0cf53815acaaec1cfcfc456b4b8527c3a5c7453b7fe224

SHA512
15265964ac677800f7bf8c24d00aab1eda354c8a8a28e13aea7d5d4982ad5a223a483129ef8bcf5c4527d9c2a1040f0441311434b567e99bd7df277258c83527

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82fe9c5c4e78ae2e6a323c13eaa99d97

SHA1
c81b7bed9a9c49e4fe188c6fd000d12c2718b923

SHA256
98f2f28dd4b2c249a8836007bd2511188b45b3be7a38b08f596608b8f93ccee2

SHA512
22c75831c94a959d1ce0b3ad9d713eb40664f34d2c0343fbc130aee59efe8c8d32a5080519622c8656e5c811dcf86929a5065c627bf59f82b044796d069438b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
653931d353cda628b6cd0774248d60b0

SHA1
e67ea5a131fe1d929c57e8cda246a4ddd2e8608a

SHA256
3fa4e651ced2f12be6c2aeae72053d9e83d4a2c7ecde34e86c03038a721c1dee

SHA512
eff5a30251c44f86e61eac17d9298dac5264b976885d669d6bdc4a83b6c0baee430d5589ebdb8410045fac9cd4cc86dec519e97b319fe882534024f4ef60d9d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ad3f4e47e11c1a3229b781661ee5322

SHA1
2526387663785b16b57e7a38107e92f5c0ca5438

SHA256
8ded3434cbeccd127527054f4d42cba11ca32d719c5562ff330aa480b624293d

SHA512
2ace013eee7902be3357d7caf29c29318caf435601a8cd9a726c76b331d944ff7c8380ec6b55c76d7c2d8e2414378b656a3b4901a76936eb8de635c33e052510

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
606c50dfe0e33d6c1a9554012d03b7c6

SHA1
2323eb517b8b88e9f4fbf87867f75c523d98d1cf

SHA256
95d354586c3a2cd292d7dcc30438464e8f8c1e2a0a20e13d8df96fd7c12238ca

SHA512
630d03cce85ec6a94d4d67bafbfbcef00add4374a050a64ecf98d74a9766ee348c708605bfb26b04c41ac3d9b81935b32e9caa7ba9e0e6ebe01d94f449d4efa7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57f4643828186501fb446fdd5e5d4d82

SHA1
4a8113bef7eb9100919b195ae0815a88834fca7d

SHA256
7ce2097627ddf3885431c121ead7713737950163abc9fe9b6974e9524393e7f5

SHA512
82f272a10e4ef66072fc0f1d4326b168a46502f62de6cb23e3b99d5718c3596fa37e723c39158189a9a758832018091a2ee87216b5243c489968f0108b9be026

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
966aee3420421c5d76ee047939f29ae8

SHA1
a80d5034ee7f759768139903e2463728b2e3ac51

SHA256
f59256518eedc50403100d9ef8c22dfd3da8e256649a1a1a412f1b10668c3768

SHA512
4b3d8c65ebc6a7bbf2f77c41361c0dd065475bc511528ff11c02aaa9ca36928af29be7a7d4a08d5aa6125eade378ec9a202442cff1525599019d71e288207a9e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e82adaaecdce945e09bcff86c3648d0

SHA1
9a64bb05556f7131be69b538265c41a914a3d533

SHA256
4d1b59bffb63c7d9157423cc90f5cb32b843e5a30907d9891d98d764e0755d00

SHA512
54c66e41e797b7638457318734b3a5f6627c9b00390af54cd69a3fe16ed330a35b6c64ecfe787e5be7e73806f56a71a8c805e8f852e0de1371bd78d8e8f447b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab52A4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5371.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit