dc8453d79cc16aea3075146cdfa4d505b9811b926b208274826b2df846353211

Analysis

max time kernel
82s
max time network
148s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 06:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be10dc97f3e88e991e7945dc544de294_JaffaCakes118.html
Size

178KB
MD5

be10dc97f3e88e991e7945dc544de294
SHA1

28632000ed451f491a6c5a2a9bdf8aca6123744b
SHA256

dc8453d79cc16aea3075146cdfa4d505b9811b926b208274826b2df846353211
SHA512

0590a837e8df38fcc5b480c7046bf8af4f940dfd1caf65bccf3afa89e60fd72dbb47626f81d096be7f611f8406795d9f816d862cbafd0eac73370cefe45398d4
SSDEEP

3072:SJyfkMY+BES09JXAnyrZalI+Y5N86QwUdedbFilfO5YFiM:SssMYod+X3oI+Yn86/U9jFiM

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50efaa07f0f5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{323F04E1-61E3-11EF-83A8-4E15D54E5731} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b700000000002000000000010660000000100002000000025f45139ee6e3806d95eb50bc2ae194320eab308142e33cb2fbf0f8e0ea44373000000000e8000000002000020000000cf3a1abcbbc689feb092e6f121de95c1d9bc448caf2c605ad1503ceee5d5568320000000ceccc511f62e3f322428de5997b278f57c82efd5a7254600fd1dbb6fc2e5f61a4000000082d5904fc78fb199396431bb687005d0182482a43064b4ef3c0db749bf74458ae0b6a1cb2c2c4c618402179ce85b6a6426550e67de635eeda80374696316a312	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000833a086c7ade89e4e5d6850057c876bdd946d7e0b28d3c46b9bd6976d7dd11b0000000000e80000000020000200000003b99427ef215f121fa5d471a9f2428ee4d7dc29c53ceeda2e3f6beda2b388d099000000051d5600b9cc197c38582242759749427b0ffeca72f67acb1baf161a2572e125e4d5f2cb03f1dba519c82cf8270e2d6f507fa39c7a28e15aabc4292433add65f068eb7dd96a03bfaefa295320e386fcf4125f60b93bf74a7dba8dd0ba9f814bcf34f9f6a6fc4bc2f0dee7ee1b499e14b21d888f1bc3049d4f3e1558de384782476d67f7b64ba893697346db37fa1ba66040000000dac03300220c7f909fad45218af081e4ae8cbcfe3f723bce254bc34b27d436c0460c76c16c3b209e8b9d169e2b1b0899763824542852f1ccc0a29f90d3b44aec	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430643273"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2704	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2704	iexplore.exe
2704	iexplore.exe
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2848	2704	iexplore.exe	30
PID 2704 wrote to memory of 2848	2704	iexplore.exe	30
PID 2704 wrote to memory of 2848	2704	iexplore.exe	30
PID 2704 wrote to memory of 2848	2704	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\be10dc97f3e88e991e7945dc544de294_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2704 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4dc7df766ccd0b5fbbf03fb7fd1aad74

SHA1
8e47a39cc0a0441acf5d5e0e9164f7b4f2b6908d

SHA256
a406dfdb6774b76577c19445886f6be30dd7aeffa4f531e165680dcdb65b0614

SHA512
be53dd7a4b747731f99674ae8fb0bd01629a4b7af621dc389eed891af804a86087ec7a90ce967941946a4a92bcfe8c7bef104a36eb4f6c632be9574c891f7077

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9d91d00061cb60c79a205e029c9de9e

SHA1
deb10edf704507f4938e385a6604020c3730b437

SHA256
34aac8b42e78169df87660c56a5a2be9637e9eaa8a1ea331886750ac66248c2e

SHA512
bbd8fb1c712b7d4efa52cc7d7d8fe42ef6af6f8d147f1ffa091d5fc397179f8354479e77e9ba5f2c1c13e89b9281cfa44dbb4fa569839e226c5b0ee26e04a8d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0b5e4bb346daa1df3e6cfe7bb4106ad

SHA1
2a019c097e9997fe20a8b51888669cb01db081d4

SHA256
81ac9cd03bf5c98c8e72bea2a21a70a3a84a916157a07cee2e87025ef7aa3028

SHA512
0e4c095b1fa540c41e6f35c6dd0038d0772652f833477902596df24ba3d93c29bfa1b2ca01490eb19a823b686c83b1caa142328b75e30aa2031939ba2eb1f9b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34bf03ead6c179379cb36fd76d5d4737

SHA1
40e96dbdef748ceb4726d63df7c12f42b4cc1cb1

SHA256
957a381fdfaeffe1553bf0ec0c1949073b6b66157241ed0058bf39e3d24e30df

SHA512
7a36b17f792e9c2d2dcc80856bffd0a6b2e82175de2b152de05dea691af8772e20ffbd2c4ce1d682c35eb40254f3a387a5576c7a8b6e1936bf8843b00eb25f35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d786aae70744bdfca10e898abd529ed2

SHA1
69b9293b11f523f9094993b3ef7280acf4166e45

SHA256
a20a4e62f43f35a411f5b7451b4b93398a1abc236edcb80a945c3ce4f0f2626a

SHA512
8342259dd389dd70a793c7a73d3eddc41e9b9090ef383ab71c5a6e8a816a01845cf082ca20c2a49c6822bf217320091ac225e8ec8c3c3ffb332e34219255e67d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10cc3c1d92186328853641aff365050f

SHA1
d0cab01d42d6e7f70c52cf294fe6695d20e3ba96

SHA256
ac1c9100fd2d77351e76775e399350a62fb60879360968f7cda03c786c8fba5a

SHA512
95c89f446939e3de731ea210b3c457f9d1f348aeda6325d11338916ea94627db268e8a4b6ac1fd8ac2547b5997514311b2489f25995cc5565fd4f4f941699196

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb8917b651bd8d6fbbf0c38958779c1e

SHA1
2fd087325c5ee935b1f3dce6894325e9ebb9cf81

SHA256
6500895135c74b82b09c9ec520935b334f19fc675b78de164b7d54c71c31e4ff

SHA512
3c21f4e154015a995067e95bc817972091e40f6da378d045c78b1d0efc3be699ee5921f52a6d61128c80992de409142cab3e21128552f92d25d78421df9d0054

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da912b4575a6cb5dc28bfd5258be440e

SHA1
9271caa0c4dfd811a524b7c9d556c43fdb2fbd48

SHA256
4af06fbab87b5c6f4c0059e69a9d108a556a18815d294392db28f6e37e7ccb84

SHA512
5df4d88646eeac40fc58defe133c2f0a0940bd06301dfd4b81b878300336da1aa2fcaf26d2aaec55a62a51d9de026f50353585842f2bebc1bb6cb3ff858b112f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41832bfb982969dcc5b6f9e8718519fa

SHA1
b4fcc5b96f430b08d36553bd60089be375e088df

SHA256
39fe0659a61574025f4610bf75b21d46641b5c9aaf19e16ee1ca262c81946158

SHA512
85b9f01df0c204d48859d448743b5fa42cccac240c7cf71122487c6f98b185b4817c5fef0a165e8fc1dc9d1786ce4ee6d024ccb5ecf463a736e7dfc76a2f1345

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
667dfa8e64c322603deb368bdc68499a

SHA1
0f23600ac45b55f194f223fdc7356c642dd507d0

SHA256
1872e0246c03c98156c69ab07ba7c792f821afda1e308026f1f127051b13e5df

SHA512
eb4036e840a5f358909ecf899b1a5def4649924bacb825569d85eb57805852cc107fccac18f628ae454731d0b80d918c3e74ced51c9718f2e83917199998a7cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f7c4da6c8718e35b4bf3127309a4c24

SHA1
aa812a582ac64da8261e5e0e334e8e6b65d2033d

SHA256
380a86a8af61d49374c580be906db9b35addae3e74f0a4013449b36307a8c93f

SHA512
40a6841eaf18e5a36128d898721f3b436842c1af6d58d3bd7919910d4dddfc2527451c04ff3bb5c877b566d26955ac19653f47e8a2912262cbccead10032ffeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAA75.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAB53.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit