69b3dd99c0aaadf45df6d1c54e9659ab9c0f0b19c6439284484e1d2c9bac268c

Analysis

max time kernel
142s
max time network
136s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf31d7b1b367bf4b6f60c75f8963b1e4_JaffaCakes118.html
Size

3KB
MD5

bf31d7b1b367bf4b6f60c75f8963b1e4
SHA1

44546003a9c8f236d7b9bd72c794065ac6810ca5
SHA256

69b3dd99c0aaadf45df6d1c54e9659ab9c0f0b19c6439284484e1d2c9bac268c
SHA512

a0eb3c07fc430263de9c8c32759297ee65626afed066a8ac81af9480cfcaf718a8ff83a3576996a4fd3e8fd1cf29b9c3c4538696639119d7bbd003abeff854a3

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6622BA31-6248-11EF-B190-DEC97E11E4FF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70a9c22855f6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430686732"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000c45c7d00312f154349bb3216a6ed9cd72dd665171cec46b79f5f8eea771e6aea000000000e80000000020000200000005b95b2498bfc8a3a72e1ec82b233b2d0a197bab8b52d069bf2ef9ba790d4f00790000000818c036705480cde19f039803c8911e564e444a3bc59e90f417b2b82f8a870789d8db94eb3e165fa6453673aed7cb615a06c4206c3e8f5037533253093e9e344aa608f1f0a83c683d669a83faece7f49c7d049af1a4af69f14d0d0d5256597ae6b7a6c92cd19f39a97a2f15490406cda6c0e63fe4d7f39e7a7497b344dec03cfc7f9f1e266588cf0f89f0315be2782ac400000008044a41c0571a648920dbf04cf330d1d88d947c1b92afd8a3ad75de1ea96957397b6d4f3e320ba186f5a9682eec259d59c438ba63e9771d06b3c67e3b1c94bc6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000095b03db53459c7742ad2bce10a7d981937caca23c6b60ca58ed4548344c5e1c1000000000e8000000002000020000000d3d3bd00a37c5073e9d87f497cbb385f6ee80fff01c94c18bba6bfe230291a962000000035f343e5fe6754144c77e550037e0ebf0b305279906a1c9ec9534c6f0bf671784000000032f5754e55bec76446617cb04b32ef06075c991fb2d3f617528f4a1022a9dcc04358d9fb89569d100841fea01a2cd2225ca7a8ddc80d22be60e8f83875af5488	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2328	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2328	iexplore.exe
2328	iexplore.exe
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2336	2328	iexplore.exe	32
PID 2328 wrote to memory of 2336	2328	iexplore.exe	32
PID 2328 wrote to memory of 2336	2328	iexplore.exe	32
PID 2328 wrote to memory of 2336	2328	iexplore.exe	32

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bf31d7b1b367bf4b6f60c75f8963b1e4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2328 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a9e03b7f06be4d2a19e961a16dbf5fa

SHA1
5d0f0c13c4b33cf3a672fbf6baf155810031869d

SHA256
08dfc5fc3db2da886840d4e69201d7b621af103a1c225e4d1229d52b801cd57e

SHA512
fc234630db04e26b164ec09c4282a57d3ec1cc358e4ba3db9f55ef33fb816d2a30db825b8b11231d8ebd251e688c1e6b7ea1660b52b5b9fa154784cf99340661

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ee953cd1100b84398b2029b5bd37a03

SHA1
0f052aa2e51875c76aee22f67102499d3616d2b4

SHA256
4e8394df01f9060ee0c0c6b859e3e400f96412c4723c8c051d981944ba0c0037

SHA512
8957f5b4435f2650b8bcda8c4e35c1ae67d983ee9ee81d145a98eb0fbc0dea3c02d4c65e8334519fe25f3c3fc1acb41fdd98b6943ebeb4cbb4bc3647400f22bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ac89f3ca331155539d9223837a44565

SHA1
72472c50e2465b42a02ed1fdadc2233965cc3268

SHA256
245a325e6121ff3ae96f3770154905ddad45ffb557217522c5796217c08b8143

SHA512
dc12aeb883f496dd615e4c07100611184eaa9121c52b27239c236f6f1c02ac51be8a245ab4bbafa9562e7fb470a70ee68ed2a14ac882d710fcb7c57b8ba4ee78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60b1ea4d1576284fb6d39de9330cbb32

SHA1
b834550f9c7cc566696688657f19ab3e989383ac

SHA256
678fb44cc0db37b1366f0bec530ea43d49c927e119e83cee45a92a0bc57b6b2b

SHA512
85a2dde88350310655685627e49c2943bb37a655d1a24796934156760b474ee02f26c103e3e5660b3e6f06f76a464523860bfa92ee52d1b8bd53e64da63b1e83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5caf47fe3abcb388d44db839fa45e03

SHA1
f2d3d46bd1c2c221abe791a03eed0764e429af99

SHA256
f15d392edd9940213f4cf709bf020e53be90413a6f69cfcebff7a35a2acda5d8

SHA512
3211ac29c8321496fcdf8ff978da498a79949b609b6ae82a873ace8df7337d20529d4406b8cfda7ee46324111e82a62fe7dc92f03bad494ccec237afb726b402

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6fd55c6d4ab8d65b7fdb1cb17afee9a

SHA1
2839e905aae0ee811c3b4f1f35abc75678284ba6

SHA256
2069a70cb587f1cfed3e35121196af2d84320527a0edd2419d4e8dd70f3b5b98

SHA512
32c8901da745c720554dfb10a7a08993cb3e9a94f8ef6b48da0dadcbf000d873431e36d1662b14f4454a96bf9cb1da08f4ffb9f0d5e722134f0a699e9295c7a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56e4d17b6dda99e48edad9c33c0cb284

SHA1
8340cfce3641211b925fee7b470ab85ef9919dd8

SHA256
43900065d0d889c0e79412e50401506ceccb046a57bb6ff3757253f0d4b8a9c7

SHA512
c8eff47a83f82b05537e70ed566ed8887825065bf94c44b128f603995d23f380a18b9ac72a989b07dd2f694b691cfcee6ca7e1d09de7e97ca2cdee834cfd4bfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12adf0625c9d6c602199938b595c01ef

SHA1
2240fd1ac1fe0458ad42fe697909e9854d88e344

SHA256
d728809675bc78fce257c39a0287dacbb477477a24c5080171bd5006d97211e8

SHA512
57d7473ac982576560e14966e229b0cb5504c6408ed8652848fe1a70a0f15ba2fc0220cf80d822fb773dc5a0a1cd543fff372cd2530689650ae5a1578d04c52e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc43cf2a3ee2be4fb8def8bab625d289

SHA1
8feff62ea9140ecbfbf9c78ffd1c8c7d84d26b48

SHA256
9f5c53e5e4eb3b40e3f3370342f33050c94964f9c79cd6542ba5972703ac0081

SHA512
59a6be4485f67b50940ddbadb564b63a413da554f687c9e603774272017236fb087c5da7c8d2846a287a9d9bf167882ceff85210beaef0a703074a0680309665

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb0666f935c3763c68f8584027874732

SHA1
4acae2260b9139210f2a6fed3bee005f682f0a5e

SHA256
d59c6941035a306f8a6785416b12d200a9c02c3dd3603cb2b41ed5b4ad4f64de

SHA512
a543f12d6b9ed440642beafbc27f055068f197bdf896292059825f1338205a5b4909b37507b388cd2fc38a7a18fbcc71c32d171376b6d7a55e2110621080c08b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7c9163f6fb23da2f333e8e42e715774

SHA1
4407f0d18058f7e8a55e332376f8626c8c04ac40

SHA256
baea8a38244677dbbe7a5fed9b0b1dd2723d396085ac5b93a7a764df6a481fa4

SHA512
2e7c86545651e60622fe1bbc892c0ae16aa0b2326bddadd28ee8e0714165f60ef470028621c068652959711a02a1f2db3c1588011b32338a2f60823256f2ee0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61db58274447095ef14d53d428cdd4f8

SHA1
d62770b651f0d89fd681425143e77072fbf3146f

SHA256
ac1444bb5647b5d056700df087949bf61564edd4636a1962505d146392d3e516

SHA512
76848d843dfdca4a5aa31aa48946893c0e07e568457585d8c82024c7d18364398c0a95d4ea503ffc33ada4ed90cd6d8e250238cb74b913cfdcf2db762d3de6b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c648192f9c175494efb16b97cbc5c496

SHA1
432da0b110445147cb72140e069aaa010db7ec74

SHA256
4448a1630fba1ebb128fdd425bc2952a344865bbbf0d3575f81ebda65d11ea0f

SHA512
23ac4713612ad2907a27feafad157d99af2d67706a5dcd39d0bd92af66a44373f2e890edf5f9d6d0ba7c85a6aff85db5b72c075962092dde7b4f9a1565131069

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f7559cae1f12efea0b32245cd74823d

SHA1
fd14f6a6d0dcab068398986ce1f380f2b91ad1a2

SHA256
e05482f7b4025ddb3c7d0cec1d7a587bfb057840ef450b27053b40c1f106802f

SHA512
15da804ac5c94686c9336c218eba3a13cc71be7aca6d45911a4545732993dc9d69c210c75e72e8b885f57d7d0e72137f9c171aa292ce84777b44bc5fc43eb04d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFBEF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFCCC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit