ee8b4a42c57aa092403d0abf01b873345ccb390740412b8fb2207dd517f640c6

Analysis

max time kernel
117s
max time network
137s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

beca149f228d52b9bc33e6dbc789ac09_JaffaCakes118.html
Size

460KB
MD5

beca149f228d52b9bc33e6dbc789ac09
SHA1

9df31a8b6f8a638aa17e11ed1f406efd6c7e2837
SHA256

ee8b4a42c57aa092403d0abf01b873345ccb390740412b8fb2207dd517f640c6
SHA512

517ea4861565cf54561b837f96d4c95ab8bf669f9b9824aa0b6e27e3383410d739fd6ace1d50bc7bf56055080f04da0cfac2f9eba6cbfc74b8dc0e440b27e64f
SSDEEP

6144:SGsMYod+X3oI+YtsMYod+X3oI+Y4sMYod+X3oI+YLsMYod+X3oI+YQ:Z5d+X3b5d+X3o5d+X315d+X3+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{15EDCA01-6225-11EF-B557-C20DC8CB8E9E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000b6221ec15673b048b9cd2bec5b2de1dbd04b1561e250dd40a32fb2132684efb8000000000e800000000200002000000058465faec2ddbbca8756f7e6acbb3464b06bdbd2da5a1cd79b0518b2a0beb2c2200000004d3093b8b33b935e0bbbf07bcdbbdb12c2f23916b0e4fefb2844344a6c1199cc400000000e539c9875366f1b579217566ddd62ade8140ade26686614bec7a47f3ed07d23aa9965ac85680ab69404e81ec21cfb6dec2edab8f245a7296f13bba07dc474c7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d09c72ee31f6da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb470000000002000000000010660000000100002000000015b7f0ee10ce057bb8a86278e146b28367c650f5f699e329f11bf13b39330907000000000e800000000200002000000034d0304cf37fcdb13ac4c85cdcf35372591b37f13536f3ac7bc95b4d84ec041b900000004ac7d58220cf6bed5be9814a7810271d0d7271948dc7d450b17b9eea14c425dee8e586ffe68405b672ecf99623014b1f326e8bb67ce179a37b1468094d569e98c6b8bfd8834a21fc585021611b0622b0e8bd6fb8b8a36bee9ccafdf1c7cad2dd19b165532e9bb6d08ba85306835285b050ed55472832ebb66ab4fb9d5bfb3ae513667d11f8cfdc1deb2aef64d34e24894000000040f2d647b7d65d192a7e8c45466c8e80bbe32f87b83ef474a02e49ac96ded39dd9ee71eeec825b2d9520b52bf4e06b7c550550d243a7f75cd2e81e66b503921a	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430671558"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2624	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2624	iexplore.exe
2624	iexplore.exe
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2784	2624	iexplore.exe	30
PID 2624 wrote to memory of 2784	2624	iexplore.exe	30
PID 2624 wrote to memory of 2784	2624	iexplore.exe	30
PID 2624 wrote to memory of 2784	2624	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\beca149f228d52b9bc33e6dbc789ac09_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2624 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b92639421138f3a447ae9b6bf1ff5a0a

SHA1
19532b214dc8d40f402bec2508c208e48ffae203

SHA256
585fb572e0468fb237554fffed7ca3cf6f71231c01d73313f3683435c917b673

SHA512
1164df2e823498ca7fdbdc220ce7a45f323175397c89c16ed993ea73a76eb995609c342d98e7a614be7a1e387bb0cb4e122976f3df4c3ca2393857770e536602

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
000503a7df766df778fb99b1136f0a81

SHA1
3cee5308ea549f7dc8da4a7f8523d7a96ad424ca

SHA256
46db554459b80e88893beee6d03e1eecb2e94d1ad95df03eea6541b0d3eaadcd

SHA512
7aa03ee7205f375ce8c8143d0c005ca5724a2d01f85e7b7be2f6d82f3589ca13dd24d7fa6bb5f03a1ee34290e35d7c8fa6054af6bf80c8b40df855c3b4a7bad9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12a6474a8cf449430c235eef76676d05

SHA1
3d158d987c028755d4b3d09e484c33fae115c84d

SHA256
6a96a0d75c9034f851d4bfaa8212947e60e55939e88fb76bc6a768a67ed13285

SHA512
b4d34624f8ed9ff519a0ded333d909c171df4543fb5286425ca29e1b1db214b555ced9cc2f3606c3230a031623dfc0929f954db81fda66ac7312072e26b12493

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
724871955117d27b992128a705ab90ea

SHA1
d9593f6521c48b80798b1bebd866a71050c546f5

SHA256
bc6869da42f09c9d75fcea927d3c37205ab9d4189bc3e7009ab2c4140a3c6d45

SHA512
a3760fb708843a8b9e952a8ad46376352d338db35be75e7c10291b681e56694dfbe7b8fdcfc6296399df30cc94b77e2033b5d702d69b910b5eca2a5b66082cfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af8ea94e654b7843e9a19f7b6d244946

SHA1
e2d543541826f53a5fb5645fd047d0c91759786b

SHA256
b090f05a9a88ae7512297e18bb064ad21083b42212b5f450a2edf74ef17ba685

SHA512
4c183b1018d385d460d1f52abaa6567805ea6b13b0e23709eece995b2988c00a57a36c84a4e93284fdc63a2a182e5c15d3412aa07858e134a2d7c97d5705c02f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10ae833c94e2e68ba884e27151625c6a

SHA1
5be85a657007f60023e8503bf04eeda06acff403

SHA256
39dcb7f3173bd4e27c1d45b104e2c041b5b1ccbb39cb6b8c041139e10bf31b92

SHA512
d1d79f53254ad8155adda9c7e1633d98bf5abc2c4789f9a7f2e0db7c5cecaa11fa44954e2027bf13d9a368cc21fa650d9149a9c299b6125f033bcdf3fd31c1f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
189a2b87e787d48beb9aca1eaa779e6e

SHA1
c6dcb826c30984d4feb6d96d02bfea0ed6577177

SHA256
a3c1795af1e15c8ae46b6f96adb575a17cc05e0099d8ae129096c05fbd6b596c

SHA512
99b26fbdb1dca71e02b9353ad5f92278d42347aa843995b0b44ab052107e353e6495c09a60f525b793d0ca8a5e2904fb86659b3861c8d804a494c8b3a23bc16c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d622d997402ac926ff05699f09d2a467

SHA1
59f6fced5cf44d925ae6da273883a6901efbbb17

SHA256
6feb1f7887c1fde6a2bbca966fedf677df4d4757a629c313578b712339b03825

SHA512
94aace79ffd832afa290057563e683db884ee112282a0a02c9f1d4618c34f2a0ee1d945b23bd1d4236f4714ac920c96d4f8983633c848bda64f003de6e836f42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9a45992eec65172a104e4280276c654

SHA1
c7f35d047ea01f55f38a7f6025d2598c58f4a9db

SHA256
99133e507cbdb4662d967e3683bda19db7d1089881a3dc4a09645c69f7cc9a5f

SHA512
29bbadb8c0392dc574419961e2371a74c582f7e5f61943e6d9cf9246c6539032bf20a8b0ff2b4d9e160586ababf89c94e6aad379a09fd5742224e93202fa70db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8e0df6097dbd5b9b98b903b6f21cee0

SHA1
8da44e61b1b15c06a7100f21c3f6f8ceaf6cc241

SHA256
c400b7cbf6c20d84d3ddcec4d6bdb49f2878d74aa7603a6c6887ba28432af4ef

SHA512
e0627355c3df51b5568d81cab133edeb3f401397153c4e0b49be61c2989c6267616b87638b05d59d329c5b5140c9733f291f973dbcf76c753204f526315457a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c6b3604d5b4882c84b411cef0c2fdef

SHA1
da8bf9728e3c2e47e070eea06de37adf2bea69bc

SHA256
19e25e8856cfcd00e2f74953473a1c46bc7672337fc99fb2422e9537febdc79e

SHA512
231dd3805b6f3eb3b7f8e02e0b7907d94127c91242b57af1b450d98d6ce012eabe748ce232821f822c7370e9f731b85cc1ee4e3679358b85a141f93c854f82a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65fc3de50df3a1954224df71fc6bda33

SHA1
21002f05b72a4335dc5e501005be546d074922da

SHA256
5ffa41f55573bc8ccf4008dbd0b45058e4e4d5998cbc894a5387138d4d3c3a2d

SHA512
6e5b36722a2b3eae6c3997bdb58379ae773ba9d3550169f8d9454e8dc16ab8cf7792581f6e537a9bcb930f1d9eeaeb2b68b800ad32bd64f4169e9fc28b648e4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6bf4e6510e288ba9fcd455128b6788f

SHA1
26ed66db5d5929049c513ed3c6117bbb1de29ee6

SHA256
5f9499e442dc1bc2d358b51d95c01f4e3f2af9143e31e5a60700ec04b3f032db

SHA512
be1960cd86b510d9110dce95afb704827e2181dad6161997bbd45f69305a3df845fd47820c3845b6b12b0e49738af177b261b74f3def6433f22243bab3e12f91

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab650D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar65BD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit