286b49583bf14939c307dfd5e270622c8af07133e40cf0dfbabd679e0be3e9be

Analysis

max time kernel
138s
max time network
132s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 20:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd0ed4d4822e7914c1243754d31d3820_JaffaCakes118.html
Size

34KB
MD5

bd0ed4d4822e7914c1243754d31d3820
SHA1

7b9d5bb59945b9fecec95c853b85749c8896e174
SHA256

286b49583bf14939c307dfd5e270622c8af07133e40cf0dfbabd679e0be3e9be
SHA512

ef2ec7e71afba163422e4b6620189e86f80e5116dffd742323078a037e3fee3e39b05219e3561bc7a63b929ca5e2edc54e55b1107a2e58310c7895be3b86efc0
SSDEEP

384:S+pnliRoihkCMdrytkFn+85wB+7dgL2OCMc6J/gWAg5FlE+fHRLs6:S+1IqiqCmSET5wB+7dVOrfASRLb

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430607122"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 305de1e19bf5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000a18a7748512c8e3198533226580f23e8c57b03a4521a06bf6b8e93a9f223dbc5000000000e8000000002000020000000c26d04805a5645110452aa4bf97dd891b408872b1350659c7aaca9dde2333ea220000000e999320818cf400c2d7f370323fb00688b31bf9d2d4f9675e665c906f056785e40000000d3c859ee33e26e3ace7ad5776627aa65d90e6bf1eb5972e9e43f9c627bbad631672b84aca20e283c386a2ec125806a794c5b9c75d9687067b4ed5ffc73765bb1	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000109a654db8343a06edd60554680333b5b5cd1979c6e7daeb91fb16e4178a1440000000000e8000000002000020000000bd39215646a1d60916f4de341419a4ec31a97249da2bd22de92dcb352e15871290000000c7a906f795b27d368edd3b011cb0240c9058c586737621831d09445a776a9171d243f2c96d1d51b4feb6008782afcd252a105732b32a6de8fd5e041ac3592ebdc07ddaa7c83b398bcd880f45bf8f623f2f726746dc696225f77e68306f5a4cb8486fc2c67deb23e33192d80b0146bcbb5031fa52380d7c5826b241fdeb2161790c60bcaa6ba977634d0aab6c330dcd23400000007d83682bda233560566aff0424fb2d0da529d7ed8a83e106032b3283d69f3d72d6db2f41bedcc3b3ed853dfbc735f47b085a81d8f62d8beb516d613197f30e7b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0CB77531-618F-11EF-A069-5E92D6109A20} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2632	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2632	iexplore.exe
2632	iexplore.exe
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE
2816	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2816	2632	iexplore.exe	30
PID 2632 wrote to memory of 2816	2632	iexplore.exe	30
PID 2632 wrote to memory of 2816	2632	iexplore.exe	30
PID 2632 wrote to memory of 2816	2632	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bd0ed4d4822e7914c1243754d31d3820_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2632 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
0357ee0dc09ba7254c088e43bcf2c791

SHA1
cb1cbcd58224266199f33d0ea0891dfa383d3cd2

SHA256
97c91b53df0821c91150602f982388c3ddbe6ebfab35c79311014608a2a37158

SHA512
2f1b5dbe323919dbd82915a27268c134a54e0c49194e83a15972acf17cec148355db7a21ccb5f89ecae475b01f7033a1758c4da3766578ec9d5c02cf570858f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b30db4136c6aa6319731533234623249

SHA1
42811e99039ce946403bf5e1a16ecd2ea7f79cee

SHA256
e649b7d3248a902ed68ca1d794d9f589dd240f8912ec4acd61b25495fcaf0441

SHA512
825853c552b2dec18453b69dd8a5026602814ee1c18832f115eaadb6181959c72078a427d5845d1c283a5ee90e183402e45eb48dd9ba1b6dbd475978b6ba1130

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c5c7db38c1fbfb8dab74ba3d2b67a4d

SHA1
e643212c98affd24a878a769498d6e585161d759

SHA256
f8efd35e5197a772860a89bfe2e6c971337f2f54bc4cebf528c0fc893a333e78

SHA512
2f89f9a78f1dced6d37c4bc1a0c4468447222915ce11d6f15051747d5cc7a9114214911d1983d987221be23d282aa896d5ecf22595f4d0d6a2584b9c700d3377

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83744318b6345d0e7d1b8983d1b7d311

SHA1
428bf1106f52c9fa38e64aef6a3aeb7478440ab6

SHA256
d9fed97cb56a172ec68b876fea7a85958dc2467746f3ecbedcc2cba09e9157a2

SHA512
7e8e5d79fb6837f1fd44937caed97af9e4ff0d556b63bc3aeb92980747a781c0255fbdeb0cbd8aa77af5c7013a49da92e98bddaec4666e1eccc7ff1d1bc98bf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a22396579d003cf26bec058ee6a1710

SHA1
cccb281603f0a5dcab2a1fa450404155e3645e21

SHA256
3b82086d7c9cb1263127004f8e07e7276ce70f7ed66ae88f1914a27ead4b4d8a

SHA512
fe08dbd9530f6d4bc9b541cf7aafa5d576173575e35013b559f3518ea7bb51d91ab6380d6efa5fc41b7188bd9371b715e21a7e679a113f8477989858552540a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61129f8dc6c7274ec640531416e2fffa

SHA1
54ee9db8904f57d949728e12ea7027006287dc6f

SHA256
5e8e3c5bd7f154ca98e69877a45747ce36aa0fe7f81843cd4beb8f4d33270752

SHA512
358281ec66c0693a724ea89fd932383ffe940bc3502d0c8b32bc08ce17117d2efb18baee5d31ca812c4b8a76423b2cd59e87a3d1ff6261982ab40a80d7713d0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3cc0408daa000514ec40341fa32c4ca

SHA1
c3377c971e885b55d2498efbe73cf8db5dc9f72e

SHA256
65672e6219abc39b0a48604ea74a23ff73b09ff093c6c9fa2fb2ec857cfaa45a

SHA512
b146123ddc3eba77c12277bea0462eaf90f3f5c232719fac3163bed83387d40650179c40d6e9b9c6dcdd14ae36465f44411430b705f0359b81b0bbb2807fc5fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d346c8cf37dd46838f9ef260fcb2123

SHA1
da2c342c311e4eb5007023baf975a61f7d14cb59

SHA256
80d4fc16894181c85aa2b6c8fed10ecf5f32354abf71293561d070f0dea88fbb

SHA512
159552b5d6c44fa464d4c06002259d0f9f27471aa4b49c6ab15db5f7d0d3473e9ff90a1406667fdbf3b1dfad92e1f2ee70d1050969b4f04345bc827c79d74aed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97e775e1837360175389506e085b57fa

SHA1
10b27cfb56d65c3f78895c48240b35b646de7659

SHA256
26e58c20580ceb9595c0df7791325bde3da8483c5d4c08e8fd05c4dde903d593

SHA512
494d57e14f960768da6f7d9487f97d38242235b3390a4de992f7a4f83903c85ee1198b8c1fb54cec1467dde235f14c8031142ea906d9769a189ac54953ce5f2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c1642dda207513c702fb9c275723056

SHA1
99365c061684f50f191309cd279a42d0a73906e6

SHA256
38cb7563164f40e5fdfcad35814f1222b50d2da2996aa9770f7c850fabc67b48

SHA512
fec7e343535a4c18c2ccacd448ba053a1b9f82f3cbbc6b773da44db56de7916b78c367505baddeec986444da28ebed26183bd5c76995f4e9fd94477e1ab08046

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9c8cfa5e1c19c93d34a82be27dbe06e

SHA1
61bb2b0082b551c35fe7e4ceb212a32882654387

SHA256
5cc810a6b4e3167161ff7b973d583a32fe977c4382249b3b511370222c9d1da2

SHA512
2ea25cd3a5847fc1a430a6d2f90a1830171aed24c28ed352da5688175e69b196c657b54c0a61d1811b776c60114215b3595bc55348fa197fab142e44a6b6b7ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f74fff9f462bbbea50ae2b28df4d050

SHA1
d56bb8c1628574e5d8078db3bbb267c83562064d

SHA256
c7ee347dfd24a2b44d9aeb7df2937937e297001c41733c18b4cae2f017baf90a

SHA512
78200162d07e02042c92c3c66ad04263769994a161b7031f1c00ce436605aff2628f1d06e7e9e740da6744f0d5790f261e2b97d4dce3fbe2d116aaa92a01076d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fbc2115e9ec7ed47c45dfd9bae0c8714

SHA1
f2cb8fbf699673e5d59c340f12c0bf4443833375

SHA256
2c8eb825d9f9b5e704c506ab023b977c56b2e0f5881b9557ad18725b4970e303

SHA512
4d13dc1ebbc29ec1832f8fe278b4dd5fd95ade9518a23374d89646e2f7d1a6f83bde8849a2e165f3d8fa874596b15172cfa3118f531858dce36d206ad7afa222

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
0891819ce966ce7d94617887bb386f40

SHA1
e9be6aa7770e01fe05597de6c248ea23000d8022

SHA256
4046015e829c8dedf49acb7d1e765a1ab2ea4114e4a334c2b943f37e0a48a8f2

SHA512
26960c178be894548eac58a4810b84e660173cd7cf8951e7850cb8d95cfdd6bf15cebb00933a8227a8226870ef993493e1782f2c8b7eabd5ccf22eba6be9f102

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3A54.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3B12.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit