4e3fe9d3d2bdb48b12735dba4ea248954b7e1b23e3e1fcf963c6208b34e7198a

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
24-08-2024 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf3dcec471d7cb589415f2f2829f0b7a_JaffaCakes118.html
Size

29KB
MD5

bf3dcec471d7cb589415f2f2829f0b7a
SHA1

4f0c3f62e5d75c1b00186396c02b8baf4448c0d5
SHA256

4e3fe9d3d2bdb48b12735dba4ea248954b7e1b23e3e1fcf963c6208b34e7198a
SHA512

957ff96100b0461686a934c539c93b6b987f84fa1546e665ea3feecaa3fafee51ce5da9641a9fcf885d2a4293b74f40517ed0929f841eee557cce35461b8620e
SSDEEP

384:mmDUTQlOoNUFy6JG3JiAs5cq+GyHDn/J07V8gO:mmDUmwy6JuO9+z/aV8gO

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{223A25F1-624E-11EF-8B64-E6B33176B75A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430689188"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0c4c2f65af6da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb90000000002000000000010660000000100002000000067ebb47770809f36754000c1a8693a54a54df31d8c27e6af16e14e1f46a42184000000000e80000000020000200000003a95b306f4f8a3de974ffcdfbedc458b03591323d7fa9b0e4a0223645357e4e12000000063b00163ed56078f36fd4eeec1debd9b80299521a596d7955fd793491f5eb75a4000000009f088bd8e2113832a7dd4ca69d37ac95918b41a175fc64a159d48acee720a72b4d0e4140e34bc6a2d07d4db8e11b79449295076628e96d979de150227c0ffd9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000dc93cc0e23fb74f26401a0a26c3a2b24331e1b367c71285978d51a783122099d000000000e8000000002000020000000c5e878fc61cc9cf8725db5fff78d11b9ab4fb6696cf9293d8644a965e948463f90000000cac01009a0ed8696cac81735dc83a0efab8379cc255a6b8f5892e269bfe2cbcf33e9ae1f2389500b0bff29c9e34f0c5ac63d6f2ab8633aa780c22d6c7d11d28a8c0e4941332bafc1245b2d9f6674ae2b462650fc948ef821c94fdc47960f242182287605f64283d7b22d813151d948e00061d8b4a5454d32da906e2f9abe6531c02b5ce311f05ffb7e9f81cb4679a93f40000000a3d77e3c1414c636d6cad5313166a0febaad2461fde03c3fd72c4c466dd18df4357b75c24eaa993598334694077f669073b351bf5033a72357930c021510d142	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2464	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2464	iexplore.exe
2464	iexplore.exe
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE
2172	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 2172	2464	iexplore.exe	30
PID 2464 wrote to memory of 2172	2464	iexplore.exe	30
PID 2464 wrote to memory of 2172	2464	iexplore.exe	30
PID 2464 wrote to memory of 2172	2464	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bf3dcec471d7cb589415f2f2829f0b7a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2464 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4764523efaec6ca77efb92104c5d9c85

SHA1
2f7abd680c2301e7c0f136a1e06392297828d928

SHA256
8a372ead8abbf4bd6afac99ce6ddbd799bbf67875373d102e3dbfe528d962356

SHA512
56c4bd62d8217c587f03fa51f6c693f2a0ffafcc209d4ed805af5dfc37aab1e182c359693831125a2099db07682c79c6ef19efb2526939d68e72645b3b32dba8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c6ffef80cb8c1dc6d40d5491421965e

SHA1
ae22c4e74524983b8d0ac531fdb99ae97d457566

SHA256
24b83421159b52e2012876a4fafbb6b4a94968bcd5726b3d8675afdf0aec9d00

SHA512
fea402023ffe7c3778aeea28ba03864d996eaf459280e8c0a49115208d0b9f787ae99147f1f4a6b2153a214ef3cb8bf451b8002ee49dbce6ce8a2806adbfaa4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5dc1ad8ccf18b2d8c6e3b0058d62d0bd

SHA1
b28db088bab3fb8ad10b1556068ed5d61ecfc5de

SHA256
85621d386c738ceef06c06d01dea82bfee63f833b4482a0cbdac656ac9041653

SHA512
369594129d30f5ccf0853449188056b7ca109e918753d89a639f73db4c40856d0d225ad26948157da8dc49521172090004bb52fbf2d8aff527be8e2ffa56bae0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5fd0d8643ebbb4b64d537784705b50e7

SHA1
fa6357276a915644b1317e3f8b7ac24aacc3dec9

SHA256
2514061d5cea581cc3041d7226473896f01b0fbb3418ddcf6dc318a74d532283

SHA512
efd5a5c71a08f71c349dffc033dcddc68c0ae53cb090cbfb9941f2d3a1209e5f0eed01224ef18d93e3c8f141c43b2f5b300d0669f7a6ec7f826751e10d31a7f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60762aaed963cac1b673f8fe31d36dee

SHA1
43942824f02220adcce373e1fcea8a32e6825d45

SHA256
5a0db60889fa7b71007d8b8afa2466eb44b0b487b9d6df51e6c3e65b3b7f7f91

SHA512
071e5dfe27820ed3c0e5272a1c119b8999bd7186b26e81d708cecad7b14066e72a6424aafe86ec3f75ed3f1af132c662598768a7db2d78ebf74d0b498f65fd55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e0bc8b4264b6fe0b5b8730486bcbec7

SHA1
5d5bc4f5cd57d0d98fdfa1d8e9ebb0e661c4791d

SHA256
85da990811282c8ce97b56cffb3c884c4835fde6c98a9f34fd843705fdef3470

SHA512
48ebb7efb6f350beb07b33fab5933682bc2531a2d3fe9479579accfc0e076c168352b22c943baa1802352ee9a1df28331de23cdedb0876d0b69176fe43e80f59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
900a46bcddb923858507fce1e6a01698

SHA1
2e19343ee92a385c0fe69ed702f2b267f5b3c824

SHA256
02d2ebff68c5f4143cc389029ed7f42319712211fb95a0e60876aec852f5985f

SHA512
d3aac135f1f8b7fab839ff70714176d05ab9c75889bcff66b8b0289016679ada699ed0e33c10aa9d934bb9576165f50e7f2fe495b45d88762f3674dc151c3706

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d131bd79a6d6d8e95c4b1c50142dcbf4

SHA1
03c372194f241d7b6d8d98e06732f62211d489e0

SHA256
3295d64aa55c61f2a120117a4e7bc9240b4da04ba0e33daa65d073f61837613c

SHA512
485156cca0cf31cc159cf6d03e0a97e51d60f4cd7eb8eabe667f7ba27545c4ab8dd9dd55f0f40b7b7d6fba700fd9d007a684c8b7da646cba47a20bdc40354dff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
670abc49ec6435c7b5e00bc0b16ea59c

SHA1
a333f3c91c5856e698dba03fed98267dd581c939

SHA256
c32b39f04358291f91bc1883a2b9ca2c7828ff0ccde7a45b885d359b85d5a16f

SHA512
7a64a5f88d89419b4033e12b8361776604d09a449b1cf0ff79ad04feefdbf6858ba91bd4072646488359536054449f7cad24ed86089fc5bbfddbcd61b4e2d85f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f3b76d6cc7478982feef1f284caa8c1

SHA1
97e4b4311dced7470cb4e1fac9e6eea1bc2f152d

SHA256
7a48cdb8e29de8351b48a3520bd3e141ab2396bcfc6d49744bd3ea5b60af8f2f

SHA512
d5544d6913a3a0315ddfdfe827beb929429600e47c4f4b6037f2ac3dc64266483d36112f6dffa932e802285cf967c10efc6666fdbd3d4d6e4d4d45a164bf58fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
342cca18974b905e8cd7d957692d163d

SHA1
e52589d5546a94b45606e81d7b02f22b28e551fc

SHA256
8171612c73ab666aae0d54715dfc5af7cabd1425958b936fd3ab9b466637c5ed

SHA512
d2fa191e8e2a565fa9e2486ebb572ac37189bc33c0b8ef8d64be26eaab3f6580ce69fb5c0bb6854acab1c52e4128ebd7a91ad1e358413df2da262642f76077cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31f4114e62942e2e170ee05bc3e59b00

SHA1
6ef11189d22d15d6b588deef771d6cd04bad7ac2

SHA256
11fe8c8709c140326689e22f2ac56435d9cc0f10be0fce2991ab7272368ee1be

SHA512
aa7606b82a48bfce8689fb6f170c95afff84387aaf4f755ce8be5f3697fc725086dcdb98d0a61e6fc01cc155fa28a91f20ebbbce4faefa404a549208097bc11c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec0762e0bdc91d1f65c749a944483c09

SHA1
97b678f24f52808a6aca44fd065149a29da7e46d

SHA256
107775b90cc45dc79ebf2a233442ff4529ca2f561f9d98e9ab98b6a485b95ad7

SHA512
dcf2e324cc792b75d503707d3ec9f05316c9faefbffa88ef255e97b109ddb34d185f665e4c0e1ab17cb02e8dee288ea72cb156925289b1830b1c47c07901252f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b56fe50f8ceea5795ed6691180693ce

SHA1
85942a9a01ee1ae26cc2b5c2cb301e3ea7e6128c

SHA256
b416ae004bb8300235ce3a3d8bf3592243563252aa84b7de7d7532ec48bf699a

SHA512
a7a7fee682351a6c257e862bde8d56fc393baa5a93a31287be5bb5ae92f4f6630f6bc48b2c7a701cd4bc2831ea85757549a1beaec1fa51d0e2969f922dfd12b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab90ED.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar915D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit