afdbe95137eec20c4d0a73b07ac141aa66afadb8bfbc56cd488bb277986c6c4b

Analysis

max time kernel
120s
max time network
131s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 17:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf228f62b9fda705517f3cb34b302368_JaffaCakes118.html
Size

25KB
MD5

bf228f62b9fda705517f3cb34b302368
SHA1

678aebc08707c0158927a835abcf0a5717c89be0
SHA256

afdbe95137eec20c4d0a73b07ac141aa66afadb8bfbc56cd488bb277986c6c4b
SHA512

fdd18482ce162250fc2ea9da5c1c3348c42a436b5229364f42fdbbde3edd6b40323e85954fdbbe31d2958b39f80c778a7e386919ce27401c4876f285969b2fd5
SSDEEP

384:JqoxS910qDbodhHASzIbfupSTTG/OICjFoFsL6fwSmmbQtCDmeGCqL:wImihgKIbAIGGICZz2v4CDmdj

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000fb417f7191dff2ad8a8d48f9a75478752bd448719f24d81b28a502f8b5a091b5000000000e8000000002000020000000b7e1c85f65381558eb4008232b053080ed51799f335dafb2c0eb53969416357990000000ac7671076f0237e31be5ae62b5d5a32639429b75690ec4d7aa120e59b952d80386846bd1e645f943923cf4980dfa40a90bfb5206d24f1739bae2d7e8410cc5702f78ee2202c89ad78d69f146ffd91c2059cc02f5662ad7d1c4ff6ed10513761915e07c743d8e7e81c9c5324d708083b4f0dd60f681ed4c6e8f8b2df17e75375ddd864d7ed5dae1cb1e7d0fff7abf636a40000000b4e9d7403f89b20eaf1f18341c31e22ca80dc48123d658048e3ae20e67a1399201bb19eba6df0a249321196ef45e12c5a9327b3d562599ff5b2852e4e455ae06	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430683420"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a00eed894df6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000ddbe1213284d26e1fd2e063cf360b644fdff354048ba88ac40fe3a06b7473e07000000000e80000000020000200000002a4a4b98efc0e13151a4eb6bae1d8ad4a58dee8a590b321fcb5aa2e6e3c5496920000000a3d90267b2ea770211231034a708b610b3ed02081609ed725f528233300c0a474000000089ce8735ebeb778e8cfb48a813ca35d4819ebf69a094c89bd27c41edbb2ab841fe180246d4c8822e9a51ee7f81730c4f98a2f3f768ed17d235d540315da0c690	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B56EA111-6240-11EF-9E5F-7A7F57CBBBB1} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2640	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2640	iexplore.exe
2640	iexplore.exe
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2764	2640	iexplore.exe	30
PID 2640 wrote to memory of 2764	2640	iexplore.exe	30
PID 2640 wrote to memory of 2764	2640	iexplore.exe	30
PID 2640 wrote to memory of 2764	2640	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bf228f62b9fda705517f3cb34b302368_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2640 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c12bda3ba65e13e604275cb551ccad1

SHA1
e98e2d0d404915fcf01909994c47acedd5aa5ce8

SHA256
a7bc2239921f2477d9631d11727c33382863cc7b14101f6d8e07da507d49d828

SHA512
68fbff2486aa65ab91e6d9d67b3954b3e385cd4bbd106b4fc8943f532847f8e1c490289c40b442ed951eb6d90ff185fc596bff8e787f566fea061b4fac89fd36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
190ce4dfe00d1c8aeb32b9c1b90b9960

SHA1
13947f530313c2a86978b363d1ded3d6e92f1220

SHA256
461d550967100fe56dd6c9ee57342e99a855ab9e0d1c0e89e307af2467af232b

SHA512
741b77f7065d3b59d4903c77de3c09f2b5e2099ead39a56cc9486c2b2ea9d8728a12f661a1422a6de2e88fb13e5734d29a43d481002de11d60c805f975c9a58e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1aa03e27996283064e6b4004055bc175

SHA1
651364a28441f6e0c1f8a3127664a8e0224cf954

SHA256
52502d07f4cfb4804348f2a6867a66e58c57bfa9d1413b7e24929d1b7470a0b7

SHA512
830957357503c50f64e82a281e6804c49fc0b3ca85caa23d21a3a2e605ce4e2e3def0f500abf211f8e94de5873828633daff3b753ef73c9c0809f51af2ca3359

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe1f71205fd0ce0bcb151fdef9b91924

SHA1
d97391c5d27366059a75d8f6884dc133bf24c52b

SHA256
06a4f438c5a002cf495ebbc4a08c58df22b8411b505d8ff193109005e060625d

SHA512
bf5fe5b1b73fc6c8f61c174d312259fad56d32daed7bfe82d08caf2b09b65ff24567917d94a1b1631e719285c9e98641ad0375d6757ab4d7dd32f131e5da30e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52f2ce150a8d93b36366c8704bf7226b

SHA1
7022abdd92506104dc9a80c75c05141f199b2072

SHA256
a1e858eeec795666473f45354e47c0e8af81d1e6b76ca05eeb23c7edb8f3047b

SHA512
13245c610070aa373108b0c16b686995ab7f4b3199e13d36e9e9fc1a31aa1797f897089bf9a318c387273e6facf686ac9e087199513285e5250b1c8ceba6f0b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c2ac5ed71033d967bf4cd87377611de

SHA1
2872d6a34377b72db81fd6ea33cff537693bb916

SHA256
0398f7bee7834b60a69aa39d7d0f03a596a5d677aad3e3b03b4ebe7db3db37b7

SHA512
965808932b3025dffe7bb86d50398655a26d6b47412c216f7e4fbcd297f158900f4a35fb93492af2f141d93f03e822bc2c807a0a761c25760a68a11ef907b86a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
350403784629e00b27a0c6362b54934d

SHA1
c9fe2e7732da9c98f3984f9f92f5509ed86a8a4d

SHA256
b38628c8a50f867062d391ad2694703fe48ef10ac7ba47d364f0a77b080aac1a

SHA512
dc071e83e7a2056a460aa99c3e54b892b759f8b4b1073b1c32b59b565854cd18a5aeabdc6840af01919704d5936413bd8c9cf1e3dbbea1ee91c8f0c6c1222f79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ab719bf211f46e344b2e70a4a932ec3

SHA1
e411610ddfd451c8291a7cf0866a8fdfa9955970

SHA256
ec55417ed430d15bae06d41f216ba83d2c3ea73b8f36d1cab0e53631353180cb

SHA512
d651dfb3be0c28471cb3ab95227de8b3bde68b4f4dabec53c734618327a28ff66b4a023cbb53074e5d2f9b8eb3b71053927afcb956916e3141b4d68b28fefdac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6bf34975d0b9063382727cb64e7e4969

SHA1
be295d0f660bcae693d04d86e269a55ab9715869

SHA256
51e69dd1ef3965ba7cf5377bbfc918c7eef5634f3c3bbf4dd26acfd4b146ee0f

SHA512
40bcefef96793f3993aa414dddcf36f440237a5712634072a90f34981bc876be6e372084bccb418e917fe66a9a1d53094832479d718df693aee02e7f0faf6a27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8e7138015be0d6832c093cca86ec7c0

SHA1
c656f933268c16303b75160bf5390ac55113c331

SHA256
5c65ff62d9dc78112959d0941c6e3ad5d94c3a1b22f6afeddcfc7166131a209b

SHA512
57d1aebcda26d9d429593438e491907dfbfe3323772b3b694306c2e53c0caffe47ec8d99133922346e85484a3d99ccd331eb54d4999530c63b7c05a1103d4376

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9c64ab0d1abcea2899f724c07283714

SHA1
deab088e667b9b60abf262ba411af33eec4df730

SHA256
584d4fcdc3c032bb63333a15f3662a311c312e458d9ff457ca25fb58d0a8d6a2

SHA512
a3efee32238d94924425e648649cb2fb8467017e9482bdb5b72567702a9161b0db093998468cd47c8e7d8d45f1bd0cd4238dbc3801ac7d7670bfac1362869aec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
168f96703c765a61e8ecb4716e119406

SHA1
40d964d1a7b82ccf7c9744aa2dc0884d95c76dfb

SHA256
ffa635118e3605dab4d92056f13586990b1abee807b9a887b40021b906e7a49f

SHA512
c58b7220051db2a6d78e63456cd05cb8d04018dfdb4bddc314d07350845b69662d9b96c0cf8a4315b520c4fcdf6ea3cb1009623d576c0af616c72750ab2309a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dac34b7d610d8ee8d0369a7ff1bf7ce0

SHA1
085543184a41d1f9e913e4efb49302e7429ca340

SHA256
dccb7783b18ddb146e254a263c86d7eb8fe73ec82f9c80d5502a4379f3d947a9

SHA512
c6907fe65f7cd981dfe721709a9fd2afeab757abd44b818f1e5351a23ea218b7e6024b723461a270cc1a468f63059fc0678d34fad9bc47f5ba887f08fb4cb673

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e58467753053fa428295f0f8632e11cd

SHA1
200ab1923230b7110fde7661c5d6d3355cb94304

SHA256
754fe793a0aa4820b00e94f296118981e3267cd8f9faefd975a6f3d9880c6963

SHA512
4f9072aa357d95dcdc77aa63a0c50a50b3f12c9b402317221064023ce24964d480419b57914eb6724fbe81f4e7d0fccebb327431cfdea52f2b51bf12807a502b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2fdb964d51ad78a2d151630bc81793a3

SHA1
2edc07cd328ced49cf85c80408953c216a8dae6a

SHA256
bc30bbe82e40744425ea61caa0e512513cfa0e696bc5040308cba7abda9d1e09

SHA512
847536e2f5f4cf91f29eb2a48850bebe1f8ee2f02214e7e1eafa844ef787b2024a9333baf1320cdb16fa735a152cf321d25bd6f218532714ba876929a482e552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eed2c78443ec8aeaa318d251229f4556

SHA1
cf4cd0ea57e0a9ef7a2ba23e378cfb26b303873d

SHA256
1f90c9b4640650ab673c1fbc314b3ab7cf9c76469b2f53c40987c0fc69974909

SHA512
1f2bc5e5205ad95c9fca264f90d1d82679375dc6b7686e0c00944790e9685be1368bbca3c495261a243f04e88f4df014bad7b79d7ec2e5683755baaf3998a8e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab565C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar56DD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit