86a3d0589b2596a2f5e7bacd47365211323670b079c8eb997cb2ee4ca7914a7c

Analysis

max time kernel
149s
max time network
155s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf577784b1443fe126495bca631438a7_JaffaCakes118.html
Size

27KB
MD5

bf577784b1443fe126495bca631438a7
SHA1

acf1087ec1939fdc42dd4a02b1b392ff983de92c
SHA256

86a3d0589b2596a2f5e7bacd47365211323670b079c8eb997cb2ee4ca7914a7c
SHA512

939600d25fc45d0af61fb09567057ad40b04929ce61aee3c4d2b3a6b1939b21f8e233193012b50935a279391d1638c80bb84271a81bf4a264e5cb719522c949a
SSDEEP

192:uw/ob5no2nQjxn5Q/nnQieWNn6nQOkEntVtnQTbnZnQ9eoSm6uFG0Ql7MB2qnYnM:ZQ/yV6kGfSYTa

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3B086F21-6257-11EF-A3B5-DAEE53C76889} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430693097"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2748	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2748	iexplore.exe
2748	iexplore.exe
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 2680	2748	iexplore.exe	30
PID 2748 wrote to memory of 2680	2748	iexplore.exe	30
PID 2748 wrote to memory of 2680	2748	iexplore.exe	30
PID 2748 wrote to memory of 2680	2748	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bf577784b1443fe126495bca631438a7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2748 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed0039b6c88071981af8cda6fd07546a

SHA1
b404ccd99cd43629657c01fca91a72733b95d2e0

SHA256
674f24628758b9d156caa066f64f8e93d91f2be424640b91e408c2f932c536c4

SHA512
cadf571baf1442ece228abe307b77e474891c8a704f4f0e7c656eb941f39eb2c3e8c938f4c210b1d7953a4f8d69e843568b26411ae132ed763843345bc3357ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb05c6359362227a56d80515fce5a5de

SHA1
ca9354754824d12dc52672763625e732e5493f67

SHA256
1998a81c2f3a43fc52066fe2929502ebe6412cc9cbabdc8597fee2f6122567f8

SHA512
bc1cb8e6b38b31f9f5879bf7fa4133fda38b6711ab7f480a1e19c16835e62ae53bbe8be75a275d2902b79e2c43e3b8cb08e960182379b8a892d50dabc08edd38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee5773c4949928f59602293b71fecdf2

SHA1
a32bd939cb7106ccc91c010ffbd580efcaf2c1bd

SHA256
80130d8023e3a5a7d16be59de0be1a0ab759f8adfb879d40a1e39bdbcf565adb

SHA512
cbc5c976b48cee17f856870c243755f9db3d88571cb3e79ae6ef63a22434a74626e76a7ac6b13943229033c59e25cd99382bf515694a8231ca60286cc00b197d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b893891073a61d237f2ffd98c023866e

SHA1
e71f37bf332f2544de2e3517b41d1879dd973959

SHA256
318a619aa767537cf3e7131e99bbafd7d2ba364815b4cd168ba25653a06f0671

SHA512
a1332d5d7ece689f757a1ae641436caf579f1a4c8be63decdba7ce1cf085aa1836d025637c91bdf8fb500786c682a3415e140fa5e4ee56ae0e6d21297c1e4e0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9034744c95cd55a0af4542ea60209d7b

SHA1
32a5b684ee189d38f8208986f5588667ad2444b6

SHA256
ab377bed4bee25f0adb1be2a2288e9dacec3df0eb28ce5cfa598352f2ebfceb7

SHA512
15ab400b86ab62c3b6fd40a85f56f7810861211531efe1b412b8e7fd29041da4325e709a213351d9006eaf595a92cc1f1792f77b38a6a4dadb73d4f1b24acacd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e22670d5f1dc6855bb83385b2ffa99e

SHA1
c792ab98ea85647ae50a86fd661e6707325a81ac

SHA256
f4e41b765713be5d3a88dfbf15e7438b25d2371557721d3bbde703584edcad5d

SHA512
7250e2fbd639f6f23fd6ead8acc16171b0cad87a50921415bfbdae2b7b57323a2f5372af91fabecf52c09d1c8be46bb73eaa880e6a11b8da39fd76982b08dd7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3560e592696fa7d88a9ac049861a72a2

SHA1
c73a0bee4ed7fd94d7740baefbdab961494452d1

SHA256
0e743c0409a54e9ac03668984825265d839c8d749ad5d0808f203f2fed2662a0

SHA512
c0f3986ec7eacb80dafc646daac25de5ef3c8d7c4856e0a251d4c7098adc7e25ccbe728c85a2a5cf352efbebd699e17ee26e976fd1767e4d5609e57c85fd67c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27a0c9e13f309f01d34fe8bedb99f719

SHA1
f35ae3442724cf9c6e2075eafdad5fc2a4c1ff4c

SHA256
ac937fd1061191534109b8b496bc60ebf840af81f288438d4c55697c8d1e0a1b

SHA512
b124a85127e372c7a00e4bd2996177e4f7c14f4a293b6560a34b9e6dd3e82a7fe7f786c66353d7cf9f823d0f91cabf77c77112d399bbcbc74001b54bb6c8c7f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f788432444418bb1ba8990be4283d19a

SHA1
2514e1cb482f5116014d771197ae6191aa722951

SHA256
3b0fff9d0aa0560dae9f67516a2be5e28fd5c3136d10440bb4728a07b71750ea

SHA512
4627d1521d1931f7fc4b3843161b066712c8b1b488e8ff30ac4a00efe9d2c0f83b82d94499a9bb4d41f1526e6a40dad3b5c246ec599cfd7ce4e3f21a875a308a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2F0D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2F8E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit