f793394d4f1e51c7b4db88e35c736806cc648b07abfa01fd46114715a982785b

Analysis

max time kernel
141s
max time network
142s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
24-08-2024 00:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bda6f98464376b4cba2fe6ea54d8e025_JaffaCakes118.html
Size

29KB
MD5

bda6f98464376b4cba2fe6ea54d8e025
SHA1

1e805b1210d6db40fd1bbda28ad43b795949976e
SHA256

f793394d4f1e51c7b4db88e35c736806cc648b07abfa01fd46114715a982785b
SHA512

237dd8efb856c55f658cbb81f106a23708aaf7d89604ee2dadd39fd4eed0cbe1118a183ce6f3ae9af004d23a3c73d9311ed64c394d208fb4f6b063d1b651580f
SSDEEP

768:xbLWXVNbqMH4a06NjIS0OwYxdzSVMZN1sjLZqOb6FS21k:VLGbqMH4a06NjIS0OwWzSV2NeLZqObYo

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 801315bebcf5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430621226"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E5BC2311-61AF-11EF-BAC8-6205450442D7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000001ea9731b5ca4f113e4f2d149315cbe376dd24b1daadb14cfcb0a163cc4791e36000000000e8000000002000020000000eafd804d2cb38709c648159b391b8d121bbe3a6548d18503424cd2820f33432220000000f972bfeab06296b30b082810366de64c1db9215e53cb18819c77809748566758400000003ec2db4e490ca8bdc0984b8f9c0cef7970ad188384cd8f226b7e76c7853b1c6579d5aba286d25172cde15081fff4e9080784345bb01ac5cd9749781852615bd4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f0000000002000000000010660000000100002000000067f4ed6985d972ded656160f09b4f24a1ffb68fd8cdb8490898430a78245c0dd000000000e8000000002000020000000e1b302805bd00b7930f0b0b8ea749230a56b95a76bd9d81092ebdeedd91b9b16900000003d723334895a3bcc2b9db84f4ce35c0f049ae8782af81e07eece07fc8b9c589832ff77131ae046335c64201d8ccacc139cd962d456503a15cbe5a2d268e2e1ff511dcb19980ac60cc0c24f8e8241ba70df88c244e7148328789e184eaf01dfb9a18caf41982568ef3c942e1009ded28056a2522a986a5012117a068dd629131a907cdcb287b6606d36f7a60727bea5b1400000003acc963ade1b216c3725ce99ca152ef2efedcb8555e13c90b5d96fa5b3c18ebefcebc9bbb9636622adfafdb9d32d3a75938eed07a779ddc3aadf9837eb97e6b0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2504	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2504	iexplore.exe
2504	iexplore.exe
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE
2064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2064	2504	iexplore.exe	31
PID 2504 wrote to memory of 2064	2504	iexplore.exe	31
PID 2504 wrote to memory of 2064	2504	iexplore.exe	31
PID 2504 wrote to memory of 2064	2504	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bda6f98464376b4cba2fe6ea54d8e025_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2504 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
16f9cdd70756d3cb7fbf072a944f8e30

SHA1
b0e66dd0029f7285920d445a80687267ba8982f3

SHA256
35add8dd629c3b611e772fd036d95248e8a71a49d4615c622b32408c0d1e12f3

SHA512
4a12206c1624310249bb68c97026d9ef888000dabf298be16cefd0ae1fa98958078f3675057bc82b85ad68347e9795d47cae13aeba2d2fe8e8f9fd3ff10b1bb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3dad3c92f34490f533c944bfba5a919f

SHA1
b0b07e7ed5f591361869dfed93f6f1568a8a8bd0

SHA256
74526ea743703fbb7e0827571cd0a086278aa351b5a67f88ba942172ffe97767

SHA512
afef4dc43d2beefe505d33c0591a22acab28351d498921f083e3b1b2f888da992016a0eb164fb9e829b328517653e896e8969a42e27dc7fecde0e9abc9e26265

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60b93f88579bcb18f8db901d9bc0997e

SHA1
320f73f6cab52464d5bd683f306a07b9861b85d5

SHA256
b5c365ef1981f1a934633ad5329d3e9f3aeec71a391692c7d66849b7b6f37da3

SHA512
bf715f6d2918159a87b5578edb26a5bc94ec4d49ea2fe08db9b731f85cbe490ffee7844c752c1bf2eb2ae62d102b6eabc399f12f003b61cde5d84dc37d307cf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c83a1ef7e55cc3c8f6b453c2af9cd168

SHA1
4a1a4eb5fedfea56a4ecf2889f8084754e32f18f

SHA256
2bcdc7366064ec7a2ba7b1f1acffb5bf3819d3203611ef105bdab412a53251c5

SHA512
12ce78ea0b24f0d0c9761b5ef0a6e28db9164fefd70bdb7d7440182f97e81a133780ba1078e479752e80f58634294fc5dc9e469a006324d5f900a928fae73217

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b99094948968f98681ddf3782a7cf4f

SHA1
1af90292144fe69602fecf4f1a9fd929e5102c09

SHA256
4405d34fa5674d61b252370f6fd6356bfbcbe8c681f832cf1ac70d36fbbe40bb

SHA512
747473f6976bd3584fd13d7eb2d72e46e3fca0c4b462876d16a8688a3d120b2622fe2c406e5608cb3787b8a2314a04597e4e77ad46af21e9a5271de7872c51bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1cd1670bf18de06cf5a6a56ec0b7dff2

SHA1
19107af9d2b0b54b2653502849d30a98cf9586ec

SHA256
89edd65aa536b446c0f323d2df8b6e9add826937856c84360dd0969f87278973

SHA512
d5831dedc8ab93b273dfa0201b680b153eba59d33f23460724b0e793eb6159a7606437b564f88ae7a126405c8476860a1b61bb92061889b1345434112809c07d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1931b8a2d88bf74d720b65542f1b4ff9

SHA1
2c54f9f982a1e8de716fc6a513cfcc349b9ac480

SHA256
8f5c7d38f008642ca68e615d987a7ff6d457f67ab6bcd77c9029828c079af470

SHA512
b1330d23267d08cbdf4124a518e4dd8efcf382ab9b94f8821fb2717b5a411717a918dbc1facdba9ecbf567f46ba1336124246faa612ccaadcb3e9d9ca8919922

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
160f33743a18b4b9dd0db7a583664900

SHA1
0cacbedd46ac707e4dfe01bb3d652b3431174606

SHA256
c5f83bca8df2dd983f47da1ae9fb1473083971c50788f0966b0ac8b34691807b

SHA512
94f068d4d6fdecc7f3622898ed783b1b55d786489a3715ba2c32fabfbf88433e78b9ad40d85ba6e2f7f733b745cba81e9b9782c4c5674a7b396d3fe55cfe8f1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc0e43249131c9d1a40ad72b56bf1db2

SHA1
fcc611e188846c2674333a32c9f8d632e43b80d5

SHA256
6cb03862a5634724d51d400080af022f2f3ebb23a49df4ecb749c448019620a9

SHA512
eeadcbb3521936121f2463a6624ef5b40bd9184fed1b35e4c1a9c7592e33e657cc1a36df5f9f94a92ba59dae25e7d9d3a2d321870a4ff91081a0736d303a69d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b94e8e55d5f60b0274ab98866a17ad2d

SHA1
9140256ec34c49b4cae193378efc063924b8a2a6

SHA256
3607d315e6ab275e11a9056450ed760dbbaa3c6c4a82a5763b75ee5c80213d9d

SHA512
74b86849c50f2baaf7649728555d98d5ff75abad626ffaeeaa7b46acbc3d5ea1fcc0f40d1d557d08cee34fdea456491e6089c1c9afd33f95d2e9cf6e3a873c44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9fa450dc7f66badbdcb7407d455f63c

SHA1
2cf8429f153deb9a07721b9603f69bf4e60bc903

SHA256
19f6f4a809fd0795ce6173fa8a81f4ec0c63763da916229d7921d23089aeeb46

SHA512
e68e3532a559bcfa406391b7a85b8aa1317f65bf53c5f5d9aeefc83a907e8a621026799802363dbb4ca18a2846d4a8a60c75a9612d6a01b1387e6007dfa9f687

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68cb9d2b088563b708d484ea5f04d094

SHA1
abf29f644f9bb53b779f8579ab4cab175d68efec

SHA256
2e02ef0ac60c0b20c533771ec5e18d7b97d79fff2adfd61b9c2ae889e506f71e

SHA512
5655ad5b482e14a285154e049eb2b2ec235e5819f5112b36f0442571951375f9fda39a798a248ed9b2489b16798c2ba44f126ae9517de3c697718b509480ddd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
451bf22ed871a71fc537d9218ed38533

SHA1
969c6b983ae9f1494dd04e66d3caf449eb2117ba

SHA256
8aa44d4423a05f6d63243b27d2d28d43668e3ee06d3a5cc9237b61bcd94b8941

SHA512
08af70213bd29e1e0c5684804aadc81e525e17775f23509429241de7ab8928f99b4dab8cb51b4607ffc671f2f2ff82692389747a14c70d91862c8e5eeb295053

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7455c6efe5d59ae731c1b02ff16ac648

SHA1
dbea6b996cde3847cd5bd5f63974e087058bc326

SHA256
bdd66d2b5ed2dbb7448aab69a63141b547df6d033e738fcefc72a37b3d35c192

SHA512
3f7918841ff8d33a62dd1faca362435fe6f9710b7dd58f388d47cb8b34c96d042e60cb36f9ca9f3f153b6bf760b92586aa79ef78de54e5c14b1edff51ab45451

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
36b5a8449f0f70c14329894c88865b21

SHA1
36a40c8e3061aa0a94a1539cf396ac44f554e04d

SHA256
51eba5568813a9d26c99b1e64bef99bbccb52b95eb086d2fd5daf9f498173288

SHA512
11770e05fdb7d20f158395054b143e3c2755abf73deeb4733a0a88485a63d229269af0a972dbf85daee8ba5fab7d11472ee48cb2e08a7a992026fe317de04861

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFDB2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFDB4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit