84808c798c8d091c3bb31d5c9797c15799acc36871a070c4cd8ffcf483611a3e

Analysis

max time kernel
67s
max time network
127s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 21:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf7c4265b9617b51b7441858ed9c7321_JaffaCakes118.html
Size

4KB
MD5

bf7c4265b9617b51b7441858ed9c7321
SHA1

92d165619f395e656cd6088b373639df09b2148e
SHA256

84808c798c8d091c3bb31d5c9797c15799acc36871a070c4cd8ffcf483611a3e
SHA512

535d23e31a8c7e32182fef17e8a1957477b217fddc89d95b720f391248a835174317bc0dddc12d5ecea37d559c54260d54b0daad6aabd5824c93ab2dc08d9f12
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8orKftKMc:Pk7yY1aEFHVKtF37sNjtXATIQFM93pD6

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000001c3b67704e02899b312dffbd412e4b5e9da637af21946d856342db81b00e4105000000000e8000000002000020000000b0919dc496539e81e44a853f53198f860ef9ff84cc7dc0381a859f1850fab1742000000001aa5b7b4d18d77b953f7e00911996b801594d3b5061464c6e2385151fd700aa400000002dffde99993e6ef67d1b6ea63b5c91778da75bde606c9769001fd065481658c9deb035a05429cdc9f588bfc761d8a5501ba81487540e0098ad89864ce17d5811	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70852d8b6ff6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430698026"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B6ABFB01-6262-11EF-B856-666B6675A85F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb90000000002000000000010660000000100002000000004b5838450675a994c38dea54cf0fb59de7d80b3a02adc28695ce4794d8c46f1000000000e8000000002000020000000a0251628eb1b5262a3dea7311a239bffde2283233336711074fb6b6acccb0d939000000040d77060303652bfca5292967d965b4e360bd7f1a6709a84ddce3ac1d9a68daa26c2eafebdae40f053999981cf62b84cf03994db6472ed287495b12fcfe6532ac4c2bf55ea4a629e534b75ebadb676d8171b8e3add136f40e5b3193dc6b9024eb7bc26fe79a8a24b7c7bd4ac434df9cd826c8d583dc6ee80a00352eb950ade6ef1a8e75842c8d8cdd30d745b22f1b44940000000b41a965408e07e1233c0b293f7c2035e510234d0223ae15454d0b78a30cd24e43544735b453d821b568c25151a4dba02087bfd4f37f282a92b8aeb77898edf1d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1744	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1744	iexplore.exe
1744	iexplore.exe
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE
3012	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 3012	1744	iexplore.exe	29
PID 1744 wrote to memory of 3012	1744	iexplore.exe	29
PID 1744 wrote to memory of 3012	1744	iexplore.exe	29
PID 1744 wrote to memory of 3012	1744	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bf7c4265b9617b51b7441858ed9c7321_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1744 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94646d492edd981bfb39efc47ad45ae7

SHA1
aa0dabbc5fc5eff9018f9c370182110db8f95dfd

SHA256
c3d6b4fe2204a55e0b2d8511132c375499b1769a24ac0d2ecc61441876fd140b

SHA512
71d332c0be05ee34ce1747ed9a222cb66f1bafc06d941659e6ac7d26a5a1b22c80f3390e783c343b9eac2290f4380cd8b32e5f6cba07f4cefb66b5fcc36a1150

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
366b0a23c0fb51d8871fdacff167c7cf

SHA1
e687192de96d143f0f6e6d796183aa7db6600c79

SHA256
94c8a4b3aab6dfea3cea6503f997a77be7e57f402803730a740be2806f4e3b29

SHA512
41234f3ec12dd9d0b19f11a94fb77402b937feb709ef8224b7ef6cb4af39c207de894c8897c8d933b9eb4f7d777eb12902cce5c46bf2368541bf91d21ad109f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b2c02bc7e7ca6165e5ee9f676b50bf6

SHA1
ceb72bf59be8723b1161328e01f24c61587d828a

SHA256
1d190fb973857a91a687c893cdaa30ad572c5397170ebeef8739dc587930fb65

SHA512
4be8631948540143a9cd1d698f12110dfd140632ffbc69f59ce3e0e0f2990f93ef225ffc5f963eac0f76dcdb0b135088e13e5d94378e992d1a7a510477485210

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49580b9607190f6724dab9ba40f074c0

SHA1
7ec88308d19ff6f62040d6ee8a2a2bdbf9f773aa

SHA256
c391e6ad57320ce43c35e849f696885a1fdbde6cd3391fe7cc04b2f6232c06d4

SHA512
3307a9886c5e4c3817f933a99ac682af34f9216393c620f8bdce4ba4ccecb2a2ed74f3f9704a9c1136f990036aa5baef050a36377777a6b528c93a8f54dcbb53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07dd039769da3b26acc5d7923b08ba1b

SHA1
6f35566322c892c1d7be56d5c448c3eb5948d444

SHA256
181a46063f1d04ac4995bc9e5b325eba3bd262df0c05319c4c579b1eeaa1b7db

SHA512
d0ab275c280de8e83112066807a7f3906447047e4d8db0ecb86c9091900dc6c02e8887a2bc3b05bb85cd0508bfac819ad021ce464edf468814be59bf6e9459d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a18d2475b308a554df90fadd0790cc47

SHA1
785adf13a44a178f6e7c52565145b12337887ca7

SHA256
5b0271cecba57a70da4c68a6baf62c2c90a2d4156ce863af4ddc5c9b50a2bc2e

SHA512
ed93e8744b83de69fbcfaf8ebf510b741818f11e2fa2e54e68fdac3962b6fd2e0c739ca5de96612a669aba2291671113950ff867b7f2d8433ef60baad5d79f74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88e410dcdde115c4273914f0812df121

SHA1
2f10757e028dbdb63ca4ae713c78574660698bdc

SHA256
d8842da223689c1b9f0238ca6b48f28f4d0f3efd43ed135f9332fdcae8d5a3c2

SHA512
a6d1c4f39d3cc5b1f62c8dbcdb7dd0dfd56612cf7479630e77030818141aaf01fd1732f71bd245e168906d2fc0a25cf15e61cfb4d322c174cb7f64e033329ef0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca1d3296bf9aa5e0c7beac3e1787b9c8

SHA1
085a9960119ec297a11d929b83c09484a07000ce

SHA256
1520dacb5d29fe6d8ab0128b03052f1733b050c68623be74ebd629e38d2d25dd

SHA512
f13a4fce6c19203243e8ea919fdaab3f48c7a0eb783f5998fa672f59e346f1b12946d7c808bbdbe36a24d6ad97d6c755d1c065032130abb9875ac0f97931cf90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a65def1a8d39c20c86bb82fd4843f06

SHA1
83b88eea406c5c70e0874e1e2335816be1768044

SHA256
c05c8956c6be6e73e4a03705691ca2b27a5a30719c77af2e2f1b9e79bbf6db41

SHA512
22233b08b7efdeff834b6f1cd396c15a7ca9a42642d3f13c5b85ce25c8f6efdd6da0064d7dc53e78500d793a3f77b2d8ad4637adbcac088bfaf9475ab2dc3037

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c81a2ef67fd159875e6b8fdcaf4fd65f

SHA1
6c38066c11723e941a6d52c8b7860fa3a51ddb5c

SHA256
c4a65309c050a435d1cf994e6d6a84f198f8f8354f514ef2901792381ce57f87

SHA512
cfb97b887de2e9b8fe787fe736df9cbc36ff9204500974c98ca39bc1c2cf9ae4fab1a6903d93983cffc48ab16a8c5fb728e86ed287c112ea29d02de1eac08e75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4a0cc6f7e11a57dfc234ac73f0c301b

SHA1
461e5a8ea674de21ac583a2eeaa09d445e928db3

SHA256
b980f5b14e7e274727645830a363aa23494b4956dbcc6eaa810da292efc1114f

SHA512
ce6ddbf08b1d036a7bbda0987c31e3d6dc07e81eb97584dc17a035ec92a6f05aed162b0028c67e4fea892a4e407747933ce145c300cef52bacf4462716b2e993

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab42.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit