8c6df001c8e1c1e598d0f0819a4b62fdd17c1c47ab00ed676aaddb05dff5e5a8

Analysis

max time kernel
142s
max time network
153s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 21:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf7f9c809fb58fd59d35baa4b13cea21_JaffaCakes118.html
Size

14KB
MD5

bf7f9c809fb58fd59d35baa4b13cea21
SHA1

d5612ba80acdc7e56d5e9c277382ed58b9d182cf
SHA256

8c6df001c8e1c1e598d0f0819a4b62fdd17c1c47ab00ed676aaddb05dff5e5a8
SHA512

066e81ceb0c386ac55aa1e0bdb2b7342a56b61566fcbe630de0f740c3ef12799e66326b08448c9a605e71524ef2def767f33f1afc55c6aae77cd67e317d7e269
SSDEEP

384:CyiuPMPX/tWy8mFAi7zy1wXM/2cGnhqelMahOV:CyiSMPPCOAi7zIKMjGhqelrQV

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430698502"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000001221a0636689ed49a4e8058906509bcc873ca3906a90b6017525c8c3544fc766000000000e8000000002000020000000a7a3133441bb6df46734f7ab92a7346dc80354df04c2a170389ad3fba0bd7b6920000000fa44fb73ee0f03afda74ee008a7a811c7f0589855c55f2dc2d9800043c703b09400000004d2b2cb979a61a394962039a70b5ed59dd49507545ec754b95689a035633ab9fb8b8a55b8f1fa1ae2bb7b3bce1735380e3b98c8b2c1f2564e4cbbc98ea049271	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 807755a670f6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b700000000002000000000010660000000100002000000085754c1abe418a15994ffb541b92b243705c0e73dcf059593307d28c8012fb24000000000e8000000002000020000000641310bf9251b9908c291f26f03308c247a92e4fa915fed9aa0f8747703b514c90000000af4dcf712b81a40d72da21e91142d9f7dc453d515e5026c52e1eabb03618a6705e269bf2c4faf1944845f17d3a43ee715388ad9b61fad3f2ec4f7864338b7c6d3707a6392748e960015d98d912e5094a0540bdfda01c750a23411f623b7d3a1a55b216a57685ccc7c5ed56a4c4707c1326777476ef9f4f568c10527383cc22e8a9190850bfdfb5a9f51d217e3f9c50f540000000ff579b85be089631bc587cf2355165987ba7083afeafc45c2b16bd590f9fb4f22850a5455b62e083fc04b27bb5c72d3732d55d91b865b11a4935a23af498fd15	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D12F7F51-6263-11EF-8FA3-EA829B7A1C2A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2432	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2432	iexplore.exe
2432	iexplore.exe
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2180	2432	iexplore.exe	30
PID 2432 wrote to memory of 2180	2432	iexplore.exe	30
PID 2432 wrote to memory of 2180	2432	iexplore.exe	30
PID 2432 wrote to memory of 2180	2432	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bf7f9c809fb58fd59d35baa4b13cea21_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2432 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e63e05e516687c12f0e81856053c8e8b

SHA1
73897229fb3ce942204cdaa11ee4f4e9ef041d01

SHA256
d126150c28a1d8690fb28ccf92971899324eec8de45ba4677b47ad687095bde1

SHA512
55f8c1c863e0c5fe4d6463dd8aab601278104628b100f37f70a1b1b6a80099d5a42357d879b66a4ca445e5b405646fd5d3a4ba0f5617659ed86497f015e4fbb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4fd735206d974bd4ea9eeefd5f4e6b5

SHA1
0c20411fee2938e76c5c085e4df2be314886574c

SHA256
e866d5a0a958126459f6e58acd769a026890fa94d30e202af56a8ba4ea39316f

SHA512
b125f4a17e428b6866f007a173215a5db1c5fcf5a78fd8f24c3915868bf1c0e947a93349fb75726a3f10d84b9bbb454dbe00d6c6b6d779c5d56f57e746d1fb9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a901deb62f3bff64d7f7e53231f1af3

SHA1
f19d1d947eeef851ff9cf58bf2fcd829048ce176

SHA256
29a3aedb92d0e4f7c5d552882e14833433f8a0151e72816871782bd1275be379

SHA512
27337d20b8bf9555b3fc48c7dbe08ebec490176e3fb12df33b6ffe72142f716e366863fe0296595d31d22514a61c4c831ebb09e7bfbab544e8367834e7305477

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1bad83d8157959dc530e251a731596cf

SHA1
0cd993af52b4db11d1ba2d2275b072e9b8c6b32d

SHA256
4b851d24a4ffa560fda174c066ed113273a49eafa0da526f3ac9e175e532d068

SHA512
170750ce4065466df7357bc81ff431a3106f08e07dd898fc773153c993f6c2bd193fe8679bf07cc3c577d35ba0317c8b9ed5df17915527d6428adfb0370a4555

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2749b1574971572e3d6ddb08ebc0ecc

SHA1
c4af7015337043c406f7f520ce9f4e3baecfad4e

SHA256
65287f159de7d379dd57e989e55eceab7a5efc685371120a402841d01497b083

SHA512
b49e2dc5f1a4564c53bc58d3ffe1ca48f9b59b724b27ec2f4f3682d96073346d433c839a8927a2c62361c93f2453c2c8c2a18d3e2690015ecb9b46d03dd7b011

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
deed504fd14b142d84acdabe8e09e374

SHA1
e5d3bb4610d05d894a50ee550f82ce261b96c32d

SHA256
a8f7693fe2b53010dc9bc68736948e95f3b58c05a3ca4aa4ada6a28fde3c9c22

SHA512
39bea88fbea89d98abea622e92541af558ba518b8a492f2ff4fe862c268074a7842ade56082b88e747b334a333d451f79adb28d6bd88b4e7a5686fb2769b4351

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c93ed65babb4265bf67a84a79830345

SHA1
dc11aff74e4e156c899da67bbe09be3a5f3e1143

SHA256
56039996419707e936193d3c95f1c38dd000ab5859a12082f4d89f8285a08c21

SHA512
13acee8163c0f1586d01ce1e8b7916837ade27fdc76bb4c12337061739f56e2b1e814650309211ccfd63743fb96e056393e2dab37adfaabb07cae320404c9088

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4cca14b051217a95e0400a0b47dbb91

SHA1
81b13b01b32b5782356f64e41e6c445e1b9be0ec

SHA256
ac8227fcad354e285991193581bade00906ea3411d79fce16c68e88ec2ac84ed

SHA512
88dafbfd235f21e13cc1370bb7034eb0d34dea75f2827ac458953fe913ea88c3eceb4146be0bc63a189f74a3d91037bff4e1e6b614aa2a655fd2ed6e7cefab95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
466137655025872f367301e61799c937

SHA1
af0d01ebfc79e2df30337b0f7d761aceffba25db

SHA256
4a4b7bf1356fbab75c492b8b5198ddf87d7cf03f1260edc97f9a7130d2830baf

SHA512
e7454e69a89197caf1622f64e705a0c544bf1537b7165dbf0b8f177735ab27f1ff34ff6ece8118e39ea6b64c614b2f0d0937a0f2df1b707b45e2d3d3654ad767

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3641d800be92b3a66e9b553a9e60cdb

SHA1
3195767b8416b5f76bce6a6864dc66004c9d9f48

SHA256
3566f0c926a46e57ac2adf76d8cdc1781179728636ced9f98ce2e5800357a17a

SHA512
1b41ad567ba71242389004e88ff72d5c251ad18cb485d7dfe10adef66ef52d055072d8477e5462841e091d7e363486b633a96188236a68916fec26b8981abc86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce3e847b969755d4ed0e6a36a5265eb9

SHA1
4cfe740f5e21e5214a18813abb152b16ae63646d

SHA256
830b89adabebe4dbe45fe2e983d12817fc8b3232c1082e2fcc48fc9305f4a99a

SHA512
d5dbc3da868cce4d3814e774949b2dc34f84093a9e9a50df4aef15d7c203af953af4567023848dd673012aa857225e9a80be15cddb4a76d9ffec554d6abf6faa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf9ad19797eda16e0a6b74a6145be32c

SHA1
b268c47b208f6360d2f825d6c9311d95984e57d8

SHA256
91df3a7d0b481db554cba24f93ef37aae15ba9cb80c2da4bf9eb62de45e39c19

SHA512
bb86b91413fe810121aff7a8d1fe38062a8306c6206efba62e13dae11264efdff3359906070a207f98f18c46f488b571e214728de3cdd8b7139dce633594506a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e446c8f3e6c1ba8157d4719b79b13cb2

SHA1
6f44f74295770c33b183db3846a80a91c44f69b1

SHA256
90f8647a21d290205f8068206a7e036d95e1cd6d5e3f4e44f6d31eb4a86c499a

SHA512
e3a5b5f806262d9b8502343325d432f7bd8668297c623959af21582fd25a5d8ebc1c2fc4ab9e1104d3dffce8f0c7de39368f995f084331f50c4cd94c626e8753

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFC0E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFCEB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit