2871e8c8eb8a008ec59421b9d1acce6a0aad162a800cc353f89de7127e5a9d94

Analysis

max time kernel
120s
max time network
131s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24-08-2024 02:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bdce2d0f86a56048f8f031165bd9fc37_JaffaCakes118.html
Size

69KB
MD5

bdce2d0f86a56048f8f031165bd9fc37
SHA1

0259dfe3b6a3f53001102e01a378e0b02b6be86d
SHA256

2871e8c8eb8a008ec59421b9d1acce6a0aad162a800cc353f89de7127e5a9d94
SHA512

66133589326c550496de8837cc3f5f0489d68f836c980a81e806af20b5d06901b91f9b9dc31483a5889391011c2c09dac69393fbabedbd66964ecbfe3535c3c4
SSDEEP

768:JiggcMWR3sI2PDDnd0g6s6cEoTyZ1wCZkoTyMdtbBnfBgN8/lboiGhcRoQFVG8sB:J2nTSNen0tbrga90hcJNnspv

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000f5300ead49936e4365d193159cb00029641946fc1b9867e8b47590e1d4302ad9000000000e800000000200002000000047c0b2b9c9cca28b0c9c5d8217e1b6f1973bcc31e23c07f02eeb64dffcb3aa02200000006b2524b751358f5efaee50afb85237b287d795039d9efe6a9afaaa7142848bf840000000052df377921d6e9a4e49367e572011bdaa43da8ef3d6c291e5121c5327105f22cc178b89d572eac21a57d4c1a98c7a4c42afd48c07712595ecc686742e26092e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c70000000002000000000010660000000100002000000045042ed61804da83b93ae4260f27d78d5a1e4ed8f035267e3c2bffbeadb8a7f0000000000e8000000002000020000000aebc3d6f87689643a12d558776801a3ca8a90c3bba4ff336253139171546759090000000b8d06d995d69209638adf23faa1a47f914decf6db32c8b6ecb04d19c0c89821977beab7a27269bfd18097f4bbdb0420105b1aa80f297815c7ffc53960426e65ce7f92c14fe74053a4b7593f0fac62050eef8b5af997bf538ea3321565ba1895ce7e1df909292358b474a10c67ea1c935cfab97f6b92b244ac0487ec466cee485d7379cee4b37696aaa0130b49007ebbd40000000ea07cc59e2dc55de0d4eab55433b6c2b34c38a67ef38aeac8753976000e552aa7eb19854b49ce976fba95216c7632e64c9441dec294c9d82c3aadbe6589a3f11	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DB036A11-61BD-11EF-AE10-CEBD2182E735} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430627223"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e05328b1caf5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3064	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3064	iexplore.exe
3064	iexplore.exe
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE
2600	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2600	3064	iexplore.exe	28
PID 3064 wrote to memory of 2600	3064	iexplore.exe	28
PID 3064 wrote to memory of 2600	3064	iexplore.exe	28
PID 3064 wrote to memory of 2600	3064	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bdce2d0f86a56048f8f031165bd9fc37_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3064 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39da6554342e6e7c03b5c9232bfefd0a

SHA1
a23ff0d305f60d0a87b37cd95a3403c2ce5fb9c8

SHA256
87bf6b50aebef37f1c0d49964601b08ea5f0140b8fa65d0a87c5c089590f7995

SHA512
7c2955209fb1b86d51bf3e39fbd0902aff104ee4b74ddd74f2324f0bac43eb05f103336b479a3a4aebaa51c908c4cdec569a7d1a7bfce421fc7cbc400b2add26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
061f224566c37097689bcc8f1388e94b

SHA1
6e036830639344d447bc64c87516e7fa2b6db5cc

SHA256
a81eac7c66d0b15988e7fa518e31a608ad3b063e4395ae3feb6ba270dbe1235d

SHA512
bc31a781a9d0ce44e5f5d91bee531133bb9c1ff207e4b1ee9b670cd17dd7bebc5e8a6dda41dd803af3815d674cb9821de37d234cb185f115e2fe67a945068cef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
525a535ba275d3977eeb6434e23e15d0

SHA1
b3f2c481bf696c5bb45c6a1f705e0a601d19eb9b

SHA256
1288c9f312b68e02701fca000291b99e682dffd279de100ba3923b5055ac5e0c

SHA512
d5c8e2d8b4066e4ed68e3e4a301663eb4e35e30467fbf1a09b70b280d361cf4d9e5b6579b9b495a4e75b7e703e7025d41d24d91fc3fdeceb94b4c59783835845

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2da54d8529612c260a7bfd8e6c0a846e

SHA1
fa7028c83e3d62a9e3c4b9209413d79e6dbb7669

SHA256
3bc244668aa91db630073844e8c03d90e7a9af268a5a980e76fdacf6aecfe671

SHA512
bd6b37a08bf8532b994230db5faa6c176264adc39cddf31398bfc75eb55cf544b35587eee8faf69a64240f99e76b06bb95c76474f42a17c519c4d825ea18f52b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2651d6dd235570b60a9137a17bf9e4c5

SHA1
1f2d417bb772e8faedc641f287bb9086aaa9750b

SHA256
08e11269ebd70a352176059955d3d557824f89abcc6fe2352daa0627bb273ff1

SHA512
bc8fd78a69e3a83290d06f3620e72e889c863f1360dd33c4e498f88dd2155ccb64f082ba5ee4af49b083e504d3c433ba5b78e990d4c4a6b1c6559ae83ee5a6cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f9cf9d75a22d7b5613a6a5575455f5c

SHA1
77e065738d46ce7b5eb845f746911311f7b1861c

SHA256
0c6eebf75ea81ea86d6527ebd5b454f0217afeb7256789b233873932e6fbfe6d

SHA512
aeed33fd76469904f3f99e3d58dd335dff3f942b94818d7bad9671a8d10fd86307edb06dadaab335200a475b227b97d9c3988f674b3417f33ac8cf73fd5f9432

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bed6a17f93b722396743522e83a8ca6

SHA1
b93913932039a515dc869a41a56039d033c7eb2c

SHA256
916356da517a6f3c3f01e6f9968a08b8166fad4c3dbb5d5d2d8b26f9bc263099

SHA512
0e880b029bd9df20644679eac3af5aa8dba2b7e7882e3065378b969d45b60b47d2bea0a2d90803095a7569f5e20afec60b8ffffd332e473262442545c4fdbb14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8cfee88e495a24f76da5eeb50e9c7c3f

SHA1
27f57199c8e3c24ea9dfff83988ef7a46334f7c3

SHA256
fd910482fee416fcdfe7f491260960a410f7b94a27f64c4ca028b4eb178587c2

SHA512
2899fac847bfe19bad685495e4a83b96847e0a8e73b3471628b1bc27bfae8da2616ebe2e201c6dba0558d11eb36a736b70af0733e254f81c4cc86dea89c022db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4829653717444c401fe1000f3e3071c2

SHA1
677b8e92ef4040ec04c590504f9bce1fd7977e8f

SHA256
d6cd59f9e3c12301d2d3123e436b06613f5f027c957a7a1ca0bc9ba798997a42

SHA512
bf95b19252ee2d7cd52324b93018a3054ce557035e145719fbe21de48e0c6cc0f49f4ecc15e59181326d5d612ae93b426572504e4e011e8574d7839f676ebdf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b06759852e0b7ac3ae93178eec15215

SHA1
ec25fd72e00e602390da418066275b1793d54723

SHA256
d000e30680a80beae36313aa8b16dab8ee65c4612287ecb8ae117439896c3aac

SHA512
7c00221f255f4b52007ca4894fe4ff05ae84969f838446ba0a9e951bad91ec31658e02c3206a23a3fbb94edc4b905e2a0e101e310632bf7bace01aa5105ae280

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
410ebf7856c0f4f43cb17aeda6ae7118

SHA1
aab0e8e862147e047b2f0bce6a1bd29b67186efc

SHA256
3da92bdf950242f68709aed93742df5bdb1f8ac5a5e1786b6f4abd5e0c691cf4

SHA512
6f43b0b53ff7626570e09934e61311aa69f508a897b8ba023edce6d38f08c55c46276c4d9123689e069a8da97f52aa08999ece2aad4c804e749482b2c8e17e81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ae8a97e80f67908bdf8e7ba4bb4b75c

SHA1
13179fec3d63ee8c98127f07a7e0e4132b9e15bf

SHA256
904ce5290061204516d3694da011c4aab5081710c0918087833cb3a78c1e4939

SHA512
6855508068b0f5a8f30c77d31694f44b2c08b13b0a09cbbd2ec6fc67e850f6b17970b639140d4c36683bde0e80ed604b54ea1fbe88a4545209f255bff355c088

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7eed25404067176a2c8c748d2a299741

SHA1
ef96200dd22b7ed8e2a2cbf8598ab17eeca1f93d

SHA256
6d08002f04ff14b3fcd5d88304ff14a2518733f64567ac5b9c3aa9ea9f7de007

SHA512
d434939ce88fb85574ddb3bb047440f9446b9a2c6e05d1f210a01868956f98a7cefd7d2898cc4da8de3ef9028aa2e9e315033c511716db990180a9d6b60b8f88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f37760e3e03bd5572bd98ee7494a4a1

SHA1
74ea7c2bcebd69d9b81d3917e09d6fd92728693b

SHA256
8bdb3fcbcdd67704a07cb8ef9ebd6b96a1604a03764d6930b51e852258008ecf

SHA512
88b557c9e16196781ea5b4dc167635b97612979227af791b1479a4856ef5ed3f7e3fc92b373d840315cb884b19b91cf58f61420c3d6a3b50f891f224928a3121

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bcddc075ea381d7db7f9e43ad07ab28e

SHA1
4f5a6f07450f877b5cf836cd6f7ca3ea983d69be

SHA256
64636cd12ca0ff7ecce14de0971e261ab9a6ddda261a1812fd7e3b084ab746cc

SHA512
04f76c43736f7455c453e3c41d158c21cb24820768edb86878d701f2464060cd67e9917e2d806448353742895af676957796b95bbd167fc6f74b6dc72763edaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37c8dbeaf82751bb1ec499010a965075

SHA1
95208d60122e33f4b8835a9c913b28e3f1d5ae4f

SHA256
8fcfb3f21e4e3871e815d990234dba6ca21d4f39aca182223ed548c3ab49cd42

SHA512
b0169c7bd1a15465f132a718fb3a132f79b8f5fba8702aa4fafafe18744c1d9a4558b57fd499d89f019f8317dac797f48cf7cc4393c716e85f845ed95ab7846a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE6AA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEC29.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit