9762ceb9fbe0dec6333fb7feec2ef98aaf0d760437b5e070c3588880af4af6fc

Analysis

max time kernel
139s
max time network
133s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 19:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf3af136debf3e040ed2efa0a927c519_JaffaCakes118.html
Size

774B
MD5

bf3af136debf3e040ed2efa0a927c519
SHA1

158e15554b46dbac2e019e31d722bef52ce21ea4
SHA256

9762ceb9fbe0dec6333fb7feec2ef98aaf0d760437b5e070c3588880af4af6fc
SHA512

f91b054caaf6d4319368ce49cf5402ecf366841a6b3fef638b0df10acfba7ef901ef8365f505a06ab7bf79e628fd83f74c5c66df83a1ed3638c37d594ef7983b

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430688618"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000d7228d42d7813e679900283123ccfe744b14f1ae7ffd64989b8af762407b4d56000000000e80000000020000200000005aeaf938e9c22b749a49296a4e7f811d037c0180d1e36f92ebdef23cf085b72d20000000f540edeac478d375e64965187c98d0c77ca884610dbfc467622c25386cf8cc8a40000000351d4e372c663c71c4d01b4fb6239533d31018de78dbad6c56c0fe73189a3168b2661bbe5cb63955466462ba41f31172ea72b40de590c452b4fee1ef41c565c8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CC18BAC1-624C-11EF-8B6F-725FF0DF1EEB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d04376a359f6da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000c305d4a3c96707212367885a03b85301ffa8002453d8ff9fff435934eba74fe2000000000e8000000002000020000000242776b298db28202d09968b61c20a3555f97939f261ca9d7865a8d96c51979c9000000063c454a093ccde2ead56b80c22dd425fc5020225a89e7e9e48a67c787c82f37d32839d7c3b4724d59f5b7302475c0263ef608bdb444ceaa000a7f553d8949e057f62aa165c198d39555f18516f52e6dc733baee49ef32acba5a2c7fced990549d849a6afb97c90532714e6f1f7b30c2cff3aab74a8a38c66ea09b0d69c1ffdcf0b4894a28c760abde0d3bcc6bb2e087640000000662ea206e8771a8cc1784c07c0181f063e133a4481a4ffcd9d90e48c277b07a07749ea46d76d763e914ba50f7fc8e0224753a94eebfe05b13d8fe0e4ac480f66	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2708	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2708	iexplore.exe
2708	iexplore.exe
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE
3024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 3024	2708	iexplore.exe	31
PID 2708 wrote to memory of 3024	2708	iexplore.exe	31
PID 2708 wrote to memory of 3024	2708	iexplore.exe	31
PID 2708 wrote to memory of 3024	2708	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bf3af136debf3e040ed2efa0a927c519_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2708 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e16b643330baf2e3b88cf41a5cfed3b

SHA1
4a438233559b3437d304d3860c3469d43caf95f6

SHA256
48d6752c372e0d4d054025235a02f28d43285c8e260a3b11da6c10435eb11011

SHA512
21946a13a700a450168f46388416233970e0fe92e4e2c001ab5c51983c6a0751c8aa74660ee2135c3ab8f3ab5d8dce3cff3d8e1232bb69b19397e9bad945347f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cab292cb870df7b74e26e09c2e36cb02

SHA1
b34cadd291cc2b419c1acd749b21e570aef0a809

SHA256
61432b05d9189dc71a829f2e45ef1cb6f914e9daa5b5aae1689300ec0185567d

SHA512
f705d9c2c1c43e77ad8e320a2160f490e109c1a78d1e428a38d415a1291e68e50b306e7ff5e12eca196b9639e13e0e8ec130899366469f33ae05974497274771

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ab8703b5e93e7c56b9de4cfaa44b4cb

SHA1
44752c993fc42892ba026bb8577bc9e98473e073

SHA256
fb94c69134b31ecbcc5020e90c3e41ef09d1fbfe71cea2cfbe6044f9bdda6a41

SHA512
a1414b439f6470cfd90a629f817d9bff79a6196f538497cc413f641cbb1b216ef3445eae98446fd2bc541aec928f20e5d88874a28d70adae5fbccb997641a684

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b0d8b465402f379e73061fa468583d7

SHA1
2a56aea4607317bab1d07c19189c873aee3ac879

SHA256
e58acd9551a2a9dae36a0d118beae17748196d4a9c019b6990ae01b54087b94a

SHA512
91f0409e04c01f76069f56b443eb1f93a36fa5b10deb85b7f6021c27045e31003e8436f42a82d770700110aebe35539bf5a5e8afe5b7998da66e1b422a189084

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93022967d858ee2ba92d2142d7394b56

SHA1
d6d6d44cc546602515ed47014721ccd0068a1079

SHA256
168c081eea812d483eccb61035cafa82a4b54deef8c16f5fd4607b84dc75a5ef

SHA512
7729a7e35ea6d133b512024404ae757f900b07cf9aa87b0cc70ba2ac8b423656e64e456dc9eee801ed226786b76244140c671c9cc93edfd0cc9493b8d3f47cb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1cc78733b1b12424ed34dcd41aef22f2

SHA1
2ebda38f9809d7971fbfcaaf3a2de36489cf5329

SHA256
f4b14b8a85b5d841e02e3d0f05b3e5ce5f8635b2066d35e341f33eb136c43e3f

SHA512
1c4817fe152d84bb0466680d07a2d1e8645c2ffe265bd49b52069d912dd9be3a3b8016c10fb724baf367f5a84edeeb955d41314745d6adaa3abb6020a78e940d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2c2dd4a70ea5d4ba8d02c84d7da7a81

SHA1
87e289a6817fc805a9a5c4cf9e85da7e20348492

SHA256
a8c8329ecc727b838b966c6288795f570aa95ed26ca6fb24699006dd42e7dfba

SHA512
52174f8cfa5b06cf8d9130112544fd46eb5cd687e1644be1cc51b036a92926036004a12bb8a6ce87ce093e8dabf7c65c751dbaa58610d3c180d9cee477d62138

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d857d2772caa1c5b9d8e37535642268f

SHA1
f8bf63a69e57fe110cee02174c6347f34ad960ba

SHA256
5c24cde24a055a79d883bf07e71586066c47c861dea0db20ea770a751628570a

SHA512
aba24360a2921a965584a959a1d4e26e8e4c10190b4aa6e0055c2e6690c883d4bd74b791467f5971cf6d8a6ddddbb7a807fecd7a004e52f3386d74ec88c67a02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29384ac138849eb983b31bb267588199

SHA1
a258667ab9ddbe9613dc6c624746d4761ecd8544

SHA256
24be66426232025e290e9d4955a2768e421f6804e2d0ebb63402a20b3b5697a3

SHA512
8ea301ad036fde832500c7340459275890d89b583e96672d3c304adaba9f15fdc7fe602d42982a947d1df9468752320dd88951716f3cd1328f9e2e855c457558

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67e42751efa5eb5b93c32f34fda8c069

SHA1
2f9e7bbd9638be95ee07cd32bd4ffc98e6e96c45

SHA256
267df0aa4cd4367613805f4192f52e090929772389ed88d9d2767a96fd8d5ea7

SHA512
9c8c7a8f77e9da346737854b3b98d01d1e539cc3d26021846b4f7a2f01db4a2aa6d7c6bcd8feb8d4a423558d35ce6f0ec5ae5a9f56344dec606880661fc1c7f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbe0ede6f37418b9816aea88e37321ed

SHA1
45ed0e3b16de171a39011f4cf7a2f5991f195884

SHA256
d0525b8d778ca66c2cbfd7a09438abfe7809ba308f08701282383af4027796d1

SHA512
edf9c0ec71aee27a10cee8c25b4add44fab9dd3c386aa7fd75ff98b39e70c0d4c8a515e1f2ddcbacb9fbd528480a22a2f6841c56df78e4c1d4a3dd7cfc9cf123

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
239800e4d522ee79f436d551b4e7e868

SHA1
f7dadda77d967063c0c63eb170d22e5c7d3d4c40

SHA256
37e3a10a380aeeb06a27f2c6ccdee58de50b198d1f28a4598957b7334a99749a

SHA512
6559a0a15cfdca8adfd0952d50e8d68e8823dca1c859ceb88d1ad995f81c47b7fa93c0c84a477de03c9aecbf7b58309f3a83588b2cb07b7b9fb0cf31cddb175c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
451b854909eef7ae58af59c622e59852

SHA1
edde5dcc2bb0e92ba2c569484676363cf3a35314

SHA256
563ef3de748a46b0eba9d17ad134aa06debcdda2b6e016d0a5cee137b01afd93

SHA512
62a18c8e1b4d8448b88727f8b9a37850f996ffd7959a9bcd89f38f63dffb91946feada3bfa0ceec830d853c713d4cdd2ab34b7f97cfa2dd9099725eb76fe1ceb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da30e46ec243caf318dcf0aaaf6ec5ad

SHA1
ce6ec53bbc3ad09db779b3d02ced47fe2aa2ca6f

SHA256
0ef563460c9976d1a46bf168399318254ef22f8568ab0e58de112d7d3e7009c3

SHA512
66dd4d34e5cfa416b3999dd99e9ac36ddfe551c3161bf601312dafa0c7687af69d81383464e7f2875e2d05bd7ea6bf85be574c3b7ef31a278c3b0c186768dc90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bcfa28aebd15f8580d6ab4631429b8ca

SHA1
f58b208a8cea5bfaec9947fa7c4f53a8454cb550

SHA256
3aaa08cef2bbc1a0735015b1d4b5cba2559ebda8433faf977ec4ba52995bbec1

SHA512
7a867372d3a7a63b224a061386e1ff3d0530bf9eb7beff7fd82dc36cda6818f636bf7112ad399b2a4476ea1fa43525e3b4af5ceae1d154096530028a3161fa6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5080d908acdc6c2fe8e8613f06fbc80

SHA1
0433d5fe6e5fcf3cf555474922d876ba91946155

SHA256
e8758b486e054aeb8a0340b9f566ab5cc262216592eff8b6c67c09fae60938d2

SHA512
83afafaf316d096d8f66a395d0b1048cdab3bf9fb6d284d4ef1b1f55c004f981f869d41cdaf3fd4cdea68b47e9a62e3699f2b1f1fed135ebe9260e6871d1e646

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d922700a7e28ece2fd9bb0b2daa4e37

SHA1
77de7555fffad0cd384058daf0f48f8d5866dcfa

SHA256
dac424af812ed356a26eb8eec318da4405e5ac9b8c81c8a9e1e2a49cb8b61141

SHA512
a6bc48d1870a117e0dc0361e3c2b6cd0da8e4c13bb3a77170d5f044a688b9739957e25d54e76fb01a93ae58e49b0f4616fe65f1aaab6a085d6bbf2cbcfce6727

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab198C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1A1C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit