8e5e4776d75eecc5dc4c5c92da05174350343c50fde462eccdb2402c506be302

Analysis

max time kernel
137s
max time network
131s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 15:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bedc24ac0952047cc9befb20aa941a51_JaffaCakes118.html
Size

51KB
MD5

bedc24ac0952047cc9befb20aa941a51
SHA1

65f60e9180a0e81249594200e514cd0ca5ec0298
SHA256

8e5e4776d75eecc5dc4c5c92da05174350343c50fde462eccdb2402c506be302
SHA512

534622fd572d4e250a3f9249f67788038ba4233129f71910c745d16d842b08dec22e4a2446289c0a24edc47aa8553993a7012d97bb54e30745a08405cc01de87
SSDEEP

768:NZFYkyWyUr3UvpgrEkNNhrFV0hP2AZypG:9YTGrEkNNh70hP2AZyk

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000007bd63c8a2a6aa12c88f6a7a41a28732e522c3cab736563013ec25005d3749b25000000000e80000000020000200000008ca29af36a5b56cb61fa03028543e239966f2a59b9cc411bb8f281edfe4e4ded200000000e7920a120cae9776963363240fe309710c5d205cb815246282b624ba1ee42ec400000006f6a034098086ea293e3775a88cf3ad900280f7bc99f380b1ffeb3a0b376c5641d32a0d65b207ceffa7307e9e3c85671e26bb2b2099aeec66eaf2779fc02047e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430674140"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90b144ec37f6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{17B51D61-622B-11EF-B4E2-F64010A3169C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000005f235a1542cdb9d905cac85eec61c07b269b5015c015b7a1bb335cf5eb451762000000000e80000000020000200000007a1f9b169cbf9d6c2495d5c2ebfa26089708c7e8c5cc57f9faae6bda9358a9f190000000ca57b91589fa59a929e7423371f3714ceeb618bb0b76ca0782b84228a7dae15d3fffee9199ba2cbac7e72dfad1b558f98b711b2c687061d8e6d897a742bda7a9f80b97e4871a08389b3b03cd1123d25862e387cb7ff87f6b6703e25af4551f7113fa13456c436e84e2c0c3c2a0d6df520d19f2a98f4b255de9a5fac2a1ea488564c57da6a5ca5ba59ad4cca7e63c5615400000002fa4979d0de5afe7bb6c12d2beeaf2fe65f99b0766fe5b183db3aa8ac74e768d5e9f239b1be8fc92aa16b91e2b1f1136152844a7b799971b08952b43ea7257c5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2860	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2860	iexplore.exe
2860	iexplore.exe
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2700	2860	iexplore.exe	31
PID 2860 wrote to memory of 2700	2860	iexplore.exe	31
PID 2860 wrote to memory of 2700	2860	iexplore.exe	31
PID 2860 wrote to memory of 2700	2860	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bedc24ac0952047cc9befb20aa941a51_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3468541578176a5ab9cedf3542d669db

SHA1
6d6a32e9e5cda2251d99cd6d158c2b4180cc4a38

SHA256
dddd5c32939f6f326100bff1e026faa4e02eb69881b0b7e5f23a55a70c45a237

SHA512
9108183014c877c7fe19eb46f913e19ef289d3acf6d509c75bb09ddb44d5b808ee179ebe31f821e46d5fb835b440dfe7507c7b91a432ed63df5908e4c87dc866

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
461648b8789f2f958d9dd7073fb59a6f

SHA1
8f440b0ccb1acd7f4b9b105af2b728e6400b17e9

SHA256
c920b21b973fbe82023d229151e591e1cbfeeb41727bd8bffb0d8417e1829c07

SHA512
c6ab8fcca52975836a3ce0af59c10f2c87dbfaafec0e298aa8899882030482f61a3551e960dadcbf39acafbcfdcfe16a8a4df73d3b09e7699a5e664db42e82b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
899ba0c37c0b249e355c0de676763523

SHA1
ff203173fdc45c1f9b95f8771e7bfca417153135

SHA256
7732ba749225c435387ba1eeee5e8db19a5f8c4eb8ac85223ebea35b1fc92080

SHA512
26f83f7ba0c2b6445a223c564272625ada0fb1d127489cd8d77f47deaf77b9e948081a6ff0f9b0862d1135319282ce979c1aadf6b31d67c230d1c84ae73d5ec9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5431372c11b460b285fe7a8f41a77fe

SHA1
0d0faad3db96b984099e9b5967bf5ae0a4eb769f

SHA256
a40efa76072c9f6eaa1ba713ff24c532b63633188232ee6443719594837f3d7c

SHA512
5344bfb9b01ab5db19d91c6a1953d3e16741f3ff56fe44f44bf3fbac976f9c05b461b86ae46ea55c5a75bd37267ebfd76a385ed457624b2af7aa512e4e92d11a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a920b0397f9cac9c23f8f06ca1b440b

SHA1
864c51b6d664f14ccb764aadc17fbccfbe5df0cb

SHA256
c2317860514ff741b214f0fd00210385ec77b5633acd338c14a1e511b84809ee

SHA512
eecfc99af5ed2b359b79bd0ff8a0258bc79de89cb301f215e3523cd9b690d6789ca11359061b3168ab0e10c833b278b0f83fa658de3ab82892906ca27df4f935

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae5baa79f2ef50c0c5ba027202720143

SHA1
a2693c4a28cd4111e2987ba1a340e0dd271d74a3

SHA256
626fc24e0215141569be8fd03e4358626ca5e19729028b560f2c413e7345eba0

SHA512
87c2b45ffb0f1a44c6235a78bb6c3acbe9fcbd3d9f1a679ac7e4d9548edabd99eb8c155ca87940ad016ae89cff493e4774e346188e9612d23b8cdf6166bccdc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
204e229abe5e99e0272752559ba0dafc

SHA1
0949f3439f8b6507b26393b44a58e46da321ed25

SHA256
70d048fd9ce1350def8b65160643396ee447558a0d217afac4016015de3b4bdd

SHA512
2b9cc461b61f716bd2386ba4550c3170f9296ba501b2269ec34dc62b1b4a49ee712d69eac2402029279e918c1e1512f268884a30b28b3f13299b81e8f3f07b63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
393602418ec0378a06dfa1c15a71318d

SHA1
201952682f819f0c11c44ff156d7e2b10b761a07

SHA256
04e7bbd666248685208635ad980bad1a8fef06ff749cad284488ee6fa720565b

SHA512
a1feda00fd7bc2c878f8c4fe699ab04069aba3a98e0dfffa563535a6453ba47c84d28c4da08ddd89169d8d57bc4ef4b93ed2765580bccdf0dcabcf932fd7b0ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
26028eabcbc3a352d1107e7199cc39c8

SHA1
2255fc8424377246719add70e5fe6db3834a1a04

SHA256
fc457ea78e6d18c612c70f6b42ddea4d28febfc4e4747bba4fb679da34539a4a

SHA512
7634ff48f375ea01094608cf6dea9cd550bae8e95f9b727bf725bcbb093397e6ed76a489ada846af9599d31391b4e963f298092971003e1b3d0ddad9f2e8a059

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f5fb3ecc6abf068fbdbc8578e0fd1ac

SHA1
780c5cc0444d514c656b48ce997b2d11e0a556f0

SHA256
9e733646a1995dc99014e4961a8ed6dfebcdead2bdb124204ef1239615b0b9fb

SHA512
ce14454a0ab1dc74237bca7a565b11beed8ce72b2c69208f9cbe678840fe17a5fb36e4d3b95446ac86f985252a1a25b163b1fed892da98f54f55475259aa69ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d49a962ffb8a19ec185bce67a0a4895

SHA1
a66af5b8fccf67ca73dd2bc25599fde5a7c00e4e

SHA256
a7020420bc349c1f7e5174f9b49dd9eb7c070c7ab687c3d195b3d096fc08ea5e

SHA512
36c6ce062cca0c6abc36ba1bc45292fb7a5bc3d1e0147596f753d33809d039fc730400f9cc90fed40bbf167ffcd6f01fd74f10b6b54a52e0d341d443d5702903

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e5f67006aeff9626897e2a3f7622712

SHA1
617e243b76e38f52495b11ee4935b122e00a79f4

SHA256
e118dea47284e2c261d892d181eeade578647b846a8586301e22d7c8743457db

SHA512
187889117c88d1764e6a6717d702935e5f113ec7dfca803e9cdc5282dfeb3959a18e8271d44c52075e2823da2ef06a106efa2c554b70160bd5ac2d401818b456

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eeedd831f11e9c5904b824339b373768

SHA1
c85cca498883c1df02bd5276795991fdfe4db6b4

SHA256
d561831ba364c4c4bda014d3bfdbe1ab3a1f20dc99dbe8ff01cfccd140669f16

SHA512
2d8e55b459b0b75c6ac4b7852ca5dedb97b508c777202bb5dabaa6e005cb0e43da6bd7640f4d46a5aff51638e0b27616b6488acd60c56a44cd475b61a7cf531d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce3e3510dfa651df5e2a2d97d30b95ae

SHA1
96e039a51641610e06a813dfaa0e5283f0498c30

SHA256
8fb929bef32d8778edc249b04b9e6c894fbcbe447ea3bdd7792f30ee1b03a5e2

SHA512
eb96d24db35b031c21723c46e29d02c96bcf316f846989b96370bdf67b8a5cbf48e7793370ae67d2ccae81d9d90f9ce0333de0303a2ff248448738e178ee4933

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF76A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF81B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit