805f354682f626b982b947be18f5f29b8cd197997c62f3ad63c8b81a9d136172

Analysis

max time kernel
136s
max time network
130s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
24-08-2024 21:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf7528eb8a292416591642b4d69afacb_JaffaCakes118.html
Size

26KB
MD5

bf7528eb8a292416591642b4d69afacb
SHA1

2a53989e56c21efa6dbba006fad56ad1972d836f
SHA256

805f354682f626b982b947be18f5f29b8cd197997c62f3ad63c8b81a9d136172
SHA512

69a595253b94f7a130155f423920213ba1958d7f92182db7e6e395f46e7298a68ecf154ee4b3f370f5216c8dd99542287b760032b3afdb9d817320712c9be1da
SSDEEP

768:gRs1cpKVAqnd+qi9q7B2CwBBJMG9SB32M4/Z:gRs1yKVhnd+LABrwBBJMG9SB2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430697098"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2099df626df6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c92000000000200000000001066000000010000200000004681d56fa860024a85878c847d2216d461ef1df4e9d986ba12abb8ede5859c56000000000e800000000200002000000004a600cdd3fe86ff8711f1e03120183c263a9a4acecb7c198905fc87661ee3dc90000000706ca1f5e7e32d2e73c4fba5493aed8c2ae36b945d08ae0e2e5b97b8a5d0426aa30f56f437d346b6c65aa248542d3837f856435875d7030b8c872783ed36175e8dff2556e8fd2be843c2d6c821f304f8da9d56d5e5231f193f3cd1c50c47e07b6fbddc7983f37ca388d6fd8e8492b8bf4070e1d6ef45b5ddbff01e5693cc07920f529e4be0d640726013a95b35549b5340000000ea94862613b17f3e4cf1ddf5bb3f00a05371171bfeba4a3f74eca029015792f7bd174ffda789690de448e3ec1fd0a47098e4ad59788a63e0f81d591523a34a64	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8C5A3FD1-6260-11EF-A32C-7EC7239491A4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000be7a9064b16d21dad83cd79d725a0a59b9c6aa35c1903dc707c928e8b5178ff5000000000e8000000002000020000000dbd6e52f560ca2acb4ea3fc79b6443d208de53cddb72117a49de4c847ed6444f2000000006a8c67ee120f6bf8769d20fcf6008e47c0260ab46b34766d8c6881ef30fb80f4000000041cbe9c97e2fa78a821110f59554fc9830390e6766808ec356227f723c200d6c47c05aa874cbf59d6bbf8c53a02a7829c6e15f8a2d8b522d99e4f460536018d2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
300	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
300	iexplore.exe
300	iexplore.exe
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE
2456	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 300 wrote to memory of 2456	300	iexplore.exe	30
PID 300 wrote to memory of 2456	300	iexplore.exe	30
PID 300 wrote to memory of 2456	300	iexplore.exe	30
PID 300 wrote to memory of 2456	300	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bf7528eb8a292416591642b4d69afacb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:300
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:300 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f4c07ed1f579113c7717d0660107cb2

SHA1
0e869bcc6313690b99dc3e48f7ee3501bd9ac795

SHA256
0563ef53c93a41aa33f70ae1694808dacde83f9bac03b5e37c8daee766f42963

SHA512
0a125da70f584b417a83df9e91e5f3dcbe092bae984a8d6adfa87b446da5536268ed4261e5dcef3cf8135677f261223810b60973eabf9999d6c2bebcee289607

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ea9b10818c4370bda65189b0ed7a66a

SHA1
7d18896c990519e3ea8042d980015feb2404569d

SHA256
2427b03c1a8f0623caafddedea68b297ccf8cfd840d1d102b93b7ed7a932083e

SHA512
45085c46bf47690f53b0e42b3bfadd5c3e7e22f20db220b8da2d739892c2518ea35261d4ce94b8396c3fe9ad30527872c6ade7c3fd9c00aa66728119c1e57ef2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3e8e771f41bc0e40c081d0aaf7f6f29

SHA1
ff991b08a6d55697ba1b2be273ec9dfd3f3d3002

SHA256
c7a9efb5261391553778cdfcdbc56c465296301aab583d375827551ee203e2e6

SHA512
769c40325e2b5f3bd6077b5ce0d666f9cc36b026eafcb5b7b37443ab24bbc85eac6f04d3dc649a2c2bbdd43df02520e9313d56dc80f45c66a843d9e3819f120b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21f4d72cd8d7fbe17537654fc45d1dca

SHA1
745028f1721a5603092007775475fe7cd989c8e9

SHA256
b78cf66621b0e9f3990db350ebef523541d57b833946462625d2df48f5f4bb41

SHA512
3cb209404c4f33395c931ff5be2668a9346b2ced5897e78d08dec58a69c84e0fea27b61179fc4de675727f4b982a80efc6adc63299a308c738d905178dba0976

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ebd655a6aa27872ccf9fa8c197bbc9b

SHA1
f03f44f09eaf7a45ed92059647805cab4edc8c4d

SHA256
d00a31eb9738f708f266eff1188485591718f4c1e6b9cf0b01cced25ad8ebde3

SHA512
ff9a22a1d836c7757914dbdf11b44bf6a062242134c63dc86e3c341483890d2d2cf7c3f1eb604c60fd3ce70eeea6154f682a5a7286557ba0132d94eb2b4b7fc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9128f684811f1ebece953c3fee3ce92

SHA1
81e6098e92bf1aab01b778826fdba64a4c919e36

SHA256
3fadb5d986c0df7b4619d205f9b938ad283c980d9fe465567e616a42f5abd516

SHA512
9c8f21765c4d947a23555e71343906dcb08e963715faba44053da8ab5323729b76cc79aae9b5427102c4ffa8cb7dee45a59d62a542723755f76e9584e67a4b87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf1f697692f50aad16cfb6b8842a55b2

SHA1
650e92c48aef598ed9acdec06da37d5364060164

SHA256
e2a74d4560ffc2b3d35c97c08ca7e9658702b25172bafcc697c887093af3a2f2

SHA512
04d3b27b03dcb20bbb5dc2293fd31ecfa090cd9293656810ac79e661f76dc33e4f1fe8e891254429dfc9c27461c646babd3d800fb9880e98413164df61cf41db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5de6e528032f81ec8b62f7a4aa72d23

SHA1
452d16db9a300f4235514ec3b2953c4b33bd0850

SHA256
ea4fed50be376516240e40a10d3c378dc106626332c94276a9d04cd9bdd6aa5d

SHA512
4a901e83f7665401131da3e08f5b0683de8e8f19f51be04f4eb84cf5a17e2a3e94122905b604df24a929c9e248843eff1847c406392f08661bb54b3000391e7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80d7f93bda0d9554e35cf15928c86c36

SHA1
fa1d5e6db0122a9d5902e1f67b221ae374a4f3e7

SHA256
cb0d69a00c8d8931d41216db97f6d7cf57d516f81806fea26a7d281e834c741e

SHA512
180c37d23a19874e6d0ac4eecc5fdfe03d31bbaa4e5e17f2b193aafabe38a07b6e124e05c713a56b56aee966d77a669c0e4d852c823b6e947e799fca4201c875

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a678155bde7feb8e14994d00ddefa8df

SHA1
ece54f7e83f01c8c9428049e2bd9437d09b08e86

SHA256
9d5661539455fa1550d8068f7ba1219d3964e70d9960e5db00d07cf3e2851ecc

SHA512
f227055ff1a80d3a237e3ade445a2383cb7b9e1c9067b5aefb1e7c56f62e1d51c9ab226e3890c705b00a1d3a9eb796b06b30beb3e71a94efa71146b92c347a1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68f360f90cdb31c32e7a7da350195d11

SHA1
d264cb9bc5b84bf3cb67eb928512733f6c89311b

SHA256
72451cc09882055a34cee1eaffff645552c479168dbba1865ac8862bdc83573b

SHA512
48e43c0bcdc4aa8cb451733a28c8b6311ac89c850c3457ee39a736bf9affa2e57de7b8419bfa0b81871e99cd5aee1a57ed694dd43201111b711911486082bfb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ede59601122eb1a4dca7dcbd185072f

SHA1
397bc043b417384c42218672382db88b55971b09

SHA256
73ad0a685538784da1941783e08ca41dbf9c6449a05a4e02fa932737ffbc2286

SHA512
a766a51db4fccc919611218e6922568f4fac421aad4f87a2701176bfccdc32b66553e72a60c3feb553474c5d258ec3e49d0b286718e2b3be23bd1bb99213e7d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c97183796d2713b1384b071f2b206045

SHA1
4f28dc7dfe8119282285d8d802e21bef3c59087c

SHA256
55d514178cc358b06c8c8d873214f33319484cdf96222629fe444cc0538caf79

SHA512
286d5328ac0316202d03b63d1ffd4be868be3396475e229c3e1d6771f56fe4c26db07ab8fdbd2f254e4346649a1cda5565e4f788268be9fba2fdee351c786da4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3554.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3557.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit