66b26ac1390ee38e9949e8244316784dc424aa5e9c5832a4328598cfa727c232

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
24-08-2024 13:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bea83b5366f61804f351a35ab141fad4_JaffaCakes118.html
Size

94KB
MD5

bea83b5366f61804f351a35ab141fad4
SHA1

310c09c4871b5bac15bc0840f7513f1d997c2ab0
SHA256

66b26ac1390ee38e9949e8244316784dc424aa5e9c5832a4328598cfa727c232
SHA512

dfb2340e7e0dbe4c3ba816c4f55914c535f77104bdc7beccec7ea7df3f81882ba710bce6193f49b1f99f1819ba23909e728b02831afde5c341d2943b3e26f5b1
SSDEEP

1536:WMLiNcqtBFLcfP1trifw27L1r3JvIX0xy5UZCi4BdkrY8mgHC+qpEyW:WAiSQ4BdkrY8mgHC+qpEyW

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{26E880D1-621A-11EF-99AF-7ED57E6FAC85} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430666863"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000c4d9b75ec9e47b31a1725f2652a9c2986f32fa847fb36c81f81a72932f56727b000000000e80000000020000200000008dd1daf4dc8465368eef0afc135a281ecd4dc3ad9644063c85bb785f51613b2220000000a94aa305315f3c8f9404596e6b2a9c228afb1a9944f0fbe2ae843d3dbb10782540000000307699d44d67a2a5fe738cdfa1a7d18c5498eddb6316ddac98825a28b6d1092f8e5836834ea2b5f3f1080b7f5f5b98d570a879b0244942411abef8cc3e831aa8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0d69f3027f6da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000dc48390d608fd89c9077b3c469e66f97501cca818048f85bc810451e380e7d1b000000000e80000000020000200000005a72cafc429b190c0234e19dbfc9752fe2802bd730e8aa091c76bab8a3c5fb7490000000ee05875d592568b5e95abc7ba68ed665b8e48a424b942da4ddaecf8736f9314304101ebf12b22c31a720bc726b1d0898a7e0b7d2c97510efdd536f11208429935501f2c0f50aaa30c5c74b598cb74ce164e1bb7e3e328aa889ac766976f1652e2fa5249adad4a06718172e1a2f219d4329d21d7b72c1a0085a79b3c355775137d919889a50b4a6ff4db776fd13223f9f4000000052c867b7632e9f5e68098729a8ab4a96724229662874491cbd843609fbbc7dd0baa7cda28402e4ae961bc1b7ee7811cf012b442b613dc9cba349086db337d73e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2168	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2168	iexplore.exe
2168	iexplore.exe
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2208	2168	iexplore.exe	30
PID 2168 wrote to memory of 2208	2168	iexplore.exe	30
PID 2168 wrote to memory of 2208	2168	iexplore.exe	30
PID 2168 wrote to memory of 2208	2168	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bea83b5366f61804f351a35ab141fad4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ee641af61eb0c58d010ccca6c31cc02

SHA1
eb9080e009a02403e48e351b0d5073b3f6162989

SHA256
5b1d495ac3d6a49d1cc3cc487f480ea1620e260d096f02fd4dcb36a7626fdf06

SHA512
b08ef34b284e7eef323704fbdae88a8053d290d77bdf1276fabe0f6162952fa915b8f3a3d3ea9c268ae1f513aaf4a3815443403142892813b0d75c5fdffd488f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39e8d98d69322299fc468536168d398e

SHA1
9ade4c23596224c3837d9815114417c5af5ffb1b

SHA256
5e76e01699d1219a5ba00fb26ee180943d2948561013cb6fc7865de52b495a86

SHA512
11db07c13eee240b912f2ad3f170a5fe933a0fd20a75ed0578df1b4714ea936d7d777e4df0aec25dabfd163982cbd03c140c0b2965af777ed9398616b92e14ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e5e9f0f760510f2647720726e0bd73c

SHA1
308f4ba66a6d41cb3d90c35b573448a71e5fc620

SHA256
73008724878296d403c70a5c17c62cf8085a1855d382468a64531058fd225715

SHA512
a83e271191ff16606ae97dea847430de9b1392f53a31d4fb49ac9d791e8587197b9cbdc4c044773a57cd73b96241eea0a60c6bc48d7d50188555383070f45fff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6864aaab149c6d253ca4d43671ad896

SHA1
a930585ebc78d13f66fb5e396f978d9bc906ed4a

SHA256
e6f4d88650a4c380ad153250542315389ee312e3eacd987e38b69d1bd0a8075a

SHA512
a4c95a49a5e0df36f6a452e5e13e6280ad4035560abc7a7ea75b94ecddd5a58d3add2f86c7367fc0af1d76a127ff7127af402e51d1266ac79df07c0d7695f139

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
638708cb690ac12cece0313a657fa60f

SHA1
42162addd014a761101a5da58fa8b9102050d3f6

SHA256
783e02fde40963e4fc3f9c5b9f49ef0738a7ac69a6d6afde0f743ecb0c87c774

SHA512
c32ecbc6292718f25507b51fc25017fa860359c15fa7de949a8b1579eb83b6c6716d9008fe96e7d29ea676cb1ff3e0d79e2c11f317dfcdfe6266e981fc3591a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a15ec9128bd3f1131e131bb06f58df0

SHA1
97e2ce35a075d244113e82b65384246852e6f9b8

SHA256
9596a55da39df62dcf28c68ccf7b95e468b42cb6ad12b4ec5db9edfd2e03e6e6

SHA512
c37ab3e9d89aa8b87be3f635fd0d6ef3ccd5942d27b62649877d90e7b7c5de68998b4215ffa6941add77cfeab3f1e249ed465d1070f0f9765a047c44dc78e573

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c37e9fbc6b2ec90e1b299fc62085ddf

SHA1
f03d70854a8ffca6d6d255886fa95eb1a49140bb

SHA256
d5e434818554dbd0ff03645730a657f3d0ef9ac8c3bcdf31487d1bd2962e8a94

SHA512
2edc2da8fc236dafc8e1de3b3e1ffd359cbb3db834b6e56c469bff1e206ec1f875c5a913c9df9398c83e46175dec18cc6d6250f5b6cecd464b4bd81be8359734

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc177f00c2e021eb722553ac73cbd2f0

SHA1
8a53c0d3f3c2dfd9202062e96d03180e0ee4b18a

SHA256
65b39037a96aed3a583861e60a2a2b0500dcece34279ad49473d2dbd0ec9e370

SHA512
e93fc0f9b29ffdfbe793abbcdd982b9750f9715c7919530c54105d8d5af132b31e573e12c5d018efc8fe6029dd87d319414a87c3ae57ec9948b07dfb7a70100c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04ab239ce64a5d5e40c474fe6e018f99

SHA1
64135c0b072b55aeebdc4948fffefe8eea305c34

SHA256
74350b8877f06b2802d462127f1acec84aea9c9247ab4b90e66f01c1fecee748

SHA512
8df1a829751f6e0820432aeb9e7e6a20a7257f904f2207064c15d4a9968c04eca1d4dd9d69c8ab4ce931694cbad2b389d16ba94a257bca14e5219d98fa879786

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf4530d615879e606f4e51663a603568

SHA1
d74d4740bbf31267be1e0b3eba8b0562c5649876

SHA256
684f11a2bbb8beb7b71d4e74986e4623f0028e593e1ae0e3f9396743468a24f0

SHA512
25deee83d8bc60dbb3344602f5d7ffaa2916aded5ce41d4cbe39f7a8fcf0577335e5bc4c2d1e9b6848ea991cc436108a2c3bf8155a9fa01695371e4f5455b4ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94f37ec9ea4b6c4358e87c0b8e0be5ba

SHA1
57e24c609021d6db27093806b735691fa11c5fa3

SHA256
92b5bb3283a35f260ba6282cdd573c0052c65ea7bdb5d4198645200d78e4afdd

SHA512
5d570145e6065314446f6e0e82449aebdeb5f73e1b3b0e148afeceb0e2c7d1295cf747d8e3b147e2e8d43e04595ce2bd65943dad97d74daaa9931e89cb9c0830

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cfd289d69e65aad3eec5ff18674e7666

SHA1
c303125be3ac05007ed1285c43da0551b86c3bf0

SHA256
8ce60140848d945e3ee00c579fcd99435e2e453b870f693a60e54a3500e035ad

SHA512
c574eef0fff4392128a6b223ca2d872ce806d181a524bd93ee199a904dde7dc6c2d5097e627d815bb5ebfc8b729d480a8bda99d04b598766c728531fb415a8bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24588deaade732a5b771172630ad710c

SHA1
d31474018a9a0d2c280a374376bc69bc477295b1

SHA256
6fb088f70840f0140164a3becb463804706bcf35afba3a07235cbd969ad7b27d

SHA512
6279097449605ccba778ba1fdc8a216948d8824aef377c7b86a4c82d1c5529d7a00ab75bfa3fd604676a98ca7e950a4eebbdd63ce8c21c523983e6f08df01a59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e649a4df293600f0f4ac5c130c3b57d4

SHA1
aaa9df0ecdddac9bce15baf94222d7192f897d85

SHA256
85a8ddb0eb56aa141ba5fafa6d6ff467e4011589e807d43e790eb8b2c1c6460e

SHA512
eed960fd95539e06042c5e76a8a10efe980f0c703735cbb45175c8d076269ef36b3b8b11e6cd9b0fd20a400d41b998d11dfe6518998669f1170bcb590bea8809

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
263dd8cae97395017eeedc829c27ed44

SHA1
3d244c039a3334aa19195178c76ddfe03fbe1a7c

SHA256
22692640e9cf2c4a88bf845ba2c6a42ebb413b43175e530264705166405be8df

SHA512
248714b7a6e1add9dd03d14fa00e506f53180912e53705d8e69cfafaf298a3fe079f2f01570309a45c73ffd865f6d0415d5b714c666d3164a48849125a089116

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HNGGU6NJ\coming-soon[1].htm

Filesize
162B

MD5
4f8e702cc244ec5d4de32740c0ecbd97

SHA1
3adb1f02d5b6054de0046e367c1d687b6cdf7aff

SHA256
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

SHA512
21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC525.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC5E3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit