63763893a6be8f1b20297dbe352a0813ffdec68432392ae0ef3d464274486bfd

Analysis

max time kernel
131s
max time network
140s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 01:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bdc706e87bca7e8bd782658a99103d6b_JaffaCakes118.html
Size

22KB
MD5

bdc706e87bca7e8bd782658a99103d6b
SHA1

a22187c934e37fe4622345e491bc7edf6a06c78b
SHA256

63763893a6be8f1b20297dbe352a0813ffdec68432392ae0ef3d464274486bfd
SHA512

87e76ad95ba2fb6b0e6bf5945fea65ae58b356842d2836c074efc33298799a0881e28a96fb8b9e807f7d873d8cef43f1826e8f13baab33f798fa289bc1651f84
SSDEEP

192:uwvGb5nndnQjxn5Q/WnQieVNnqnQOkEntucnQTbnBnQmSqx0GwY45xHMB1qnYnQ/:HQ/ZVxMAOk+7

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{04777921-61BB-11EF-8340-72D30ED4C808} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430626000"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
332	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
332	iexplore.exe
332	iexplore.exe
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 332 wrote to memory of 2124	332	iexplore.exe	31
PID 332 wrote to memory of 2124	332	iexplore.exe	31
PID 332 wrote to memory of 2124	332	iexplore.exe	31
PID 332 wrote to memory of 2124	332	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bdc706e87bca7e8bd782658a99103d6b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:332
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:332 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09bc193d585b0aa5ec1ed5c5d73966d0

SHA1
86fdc84490a834d3e935e8e21321e07d6d1f37e5

SHA256
af89800111117fb307c23d2664b809561c685606b7ce831569493ba8f2b26162

SHA512
ac7dd66c39a212ab86f4eb035e9da2279990898ad3143b4218c75631dd382f1ba30f1ee8a5c9cef1e5d1295497e3369f223a271989f445d2d9ddbda731f863c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69c30a3031903fa6d299b27f593b64e2

SHA1
b389d8aa9f3012a1f4b0955bd8f397e28a173015

SHA256
e4b84afc9c472e1b193f80d17a95f380e1f405244bd31aa647bdd4d715f5e4ea

SHA512
4f97b74a75ee7563d0aa77855727e08861254155e673698e0f2cb377516bb90b29d9673890e8cc0509f086ac2b83f8fe4a2955e0c23796bfea2330d4f6e41d3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d467a6511d56f35a14bddd6586d6c63c

SHA1
ed75e9ba525f8219261b7d850364c9f3fe449a3e

SHA256
c34eccf23b6fcd001e61fb8badecf01a8f59cdb36fd72876a98cee2200f80d4f

SHA512
5ef6103b89458e93b41121479f0783d50d2688933bce53087281b6f5f083ef99b84937813ccfb3e5c85adeef7a7d16015875bfe7c6eaac263f8339f3d2bd992f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4fc7ea9869e49e37223b5dcec0519467

SHA1
dc529a0a32182a8931e1e0925dec5c40bc1a5f42

SHA256
a40f840e95b35b53ea98e9319c55f9aecaf92a662fb1ad9c508ce178ce817d65

SHA512
c7d87d70e697081abfe983d00ae528ab76c937249e76df024026130d6dbd1b87ad6aa0431e831d990cab1cd74e5af9dfb1f612ffa84666f0f0d10674e5b9b119

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b68e5ede6cbc3c476a4f8c1210063d3b

SHA1
867bc4e980a0934551ee1b5bc42822081000d98b

SHA256
fcb607f1f0b0087aa902d8df160f4feeaa7d80e81438d454c5bd878c43f50d56

SHA512
ef0bdf23db524b0ae5215ce3b36b0d29ff8cc076992a3a858ead5fe299a86680e5e5e834984d4abda85dc859b9c70313bf4caa48092067dce3e079e3cc3e6cd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ccdf97bb29d5e9209fa9f5f145b3102

SHA1
a6ad4fb46813a832246b1f07b655262bbdc5450d

SHA256
299da72ba568f2febf162816db55b140e032e91636c036a4653886179ea498ee

SHA512
07829a20bca49669f437556d32cb4363c9c1649923011013ccd7ec5bf20917b09e4644200db94488924fe0d61d46cdb108b417cde5f38434addcc78cfb6e3f24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c7e034169ae1e76ffaac7d176f72f77

SHA1
722b11f57dd9c583d150b16c3b11219d95ca22b7

SHA256
8f510b0b0fedb7862db24a9cdc5fc938cf9362a04a36514f6cc649c722019d47

SHA512
b16a7ca75665b92ff815f88b6eea891792773f3720746f576afaf26d63a86c6a21d34b180ac541e8142bd82efdb158ff1d5f747f0190cd94b1bcdf18a809c004

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
915c7b9f212a7e0032ae401bc721e8bb

SHA1
29540b62363aba846245416d7b370da7685b6c7a

SHA256
21cf110941b1a6c2a9aaa76160c3042a9bd1fcf4517eb24438908c214421105e

SHA512
f504e518a13b23b94f9c14d4c2030ac703122a8a8a3e6bb166bcf9713138ddcddc2c9bd0f10d9b2214aeaf120f193090302f20ba9308a6d0684b771c8e28c434

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
772d1b17e22a5c026d94294bff0a7665

SHA1
fe932cc937ecdc459333f2d982bc19936f91cb26

SHA256
5a549a28e8884d24b18966423faa1762f4876001011194fcb1c3bf0060e13e65

SHA512
e8b2a57fbbfc02ced1885f8a5fb9f110ccc006e5e67afb8625025f9876c1852258d097c2f27534e8acb80a16c8762a235b9951fdcb744a604d90d3745940b241

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD922.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD983.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit