f05e6ad702de761f34fccb4a603b29406e1de78e9d017be24fee9a3884438065

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
24-08-2024 19:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf440786f8d2735f7f93534ee4abc110_JaffaCakes118.html
Size

42KB
MD5

bf440786f8d2735f7f93534ee4abc110
SHA1

07909e1c1764b7bd252945de4beabf267aa5892c
SHA256

f05e6ad702de761f34fccb4a603b29406e1de78e9d017be24fee9a3884438065
SHA512

0ddbb5fad8804496eb39ba6815da0b347f776e716e747c7aef75137ea2056bd84aa6c1ef78fd4248b5919cda6d8e7083dc4bb40a8bbbdac19b23547f5cb9f14a
SSDEEP

768:Yw/k7OEcI1h2o2QISg+FW7lYMZK7KuQJKrDgQ5seka2P1egpaB:YkwHZIShGlYMZK7KugKrDgQ5sDa29e/B

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E69E5FA1-624F-11EF-B8C9-666B6675A85F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 709915bb5cf6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430689946"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000054ed990177ea883988ee6923e36df4bc468fd4615e2b615a1ba4b4f848e6d54000000000e800000000200002000000053a704959b823dea4ca666720ce760037437c45239fa9cade4b40b3dbcc6c10b20000000305dda43cf51280872ea638a56705cd19149f205f6d0099f3e897cd19e75888340000000f491bb9000d2ca2b4366a2f3d2e21eaf8440b21e19cf5a743b86dd3dfcf65e211b7923dfa0841d4dab903e0bd8dedcf97c03a1b6db2a09334e9859be13d454f0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c92000000000200000000001066000000010000200000007935490d313ece57a94a1f87b0ca91a9da0082cf4c6ee9ab2a2e32eb38ee20d6000000000e800000000200002000000019cebd925ef655fd0f361d752222510fba173fbeae184e428e7eb5cf0f0d9e1e90000000ce21fa3748d532afa1aa5c1f7b3a3114386b679cc64057b5f97510001b09d076da5b8748ad4c5ecd508ee1e2b0a4d76359d1251f090941176ac2ff1595ced796ee70591cfdc0f2d0e317cd52b9626062b8bfcd6b674f9438ad7cf2655a05029a92531528eac087f1e83f69948bb4f6e79b6c8bbbe02d21625d592fa3de841ceec1047a6857859b566e0a5694c3e018f64000000096989411ccbd2445a2320061172cea4557a4b49965c4b02718794c40e0296f26632f0bd4438676c100b311975bea2b89593e16a93da99f1ea61ca3b4e2cd8eee	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2408	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2408	iexplore.exe
2408	iexplore.exe
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 3060	2408	iexplore.exe	30
PID 2408 wrote to memory of 3060	2408	iexplore.exe	30
PID 2408 wrote to memory of 3060	2408	iexplore.exe	30
PID 2408 wrote to memory of 3060	2408	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bf440786f8d2735f7f93534ee4abc110_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2408 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4564cca37047ba837a0868d020f3d2ab

SHA1
a155cc544858088f10e860b94e3cde2adfec0df4

SHA256
5135a3b1dfd8ad58adfa8cea9043d4b764d2ba387f44c9a7eb29e4caf65b71e8

SHA512
efc4a51f69f1c2f721ea3a38fb43fead18fa2ead1202b265ba8345c96fc78e70660d815ad71237158571d731b26e406226802c4782bf04d048fd63f17fc06040

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
000b16711e94b2350edcd54394e1eb66

SHA1
cdc7aa1e9e482aacd75bd621325818e32f27b45e

SHA256
43124f4b263bea3c0454b5d75aebd5e78c5443da610a71830acb67f883242f7c

SHA512
b03aacfd7a19c3d2d47489b03d78a2d30ab2310fea1b92803f1b471a958bda222b5ea1b4f2e209684ff47d94dcbde8f6489ed02615e03edaa7a69687fa6fae6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9aa7c11851348b5dadca879a06d08cd6

SHA1
611ceb12701872bc4ff0ab45695f1be9742f9465

SHA256
de224e424dbb37ef5e0c6ebbc08bc14ed368a5a46bb7dceab24dc4ab19fac0b6

SHA512
6b1002ad390fab1431d3672b4ea326d73b20379ea45d21bcf7f4531c8d55e75279dbf5c6ec087623ae6b5813468211b3beefc7db279cc5ae50f24ce219ee0cc0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e53bdc876c535097f180a059c807341

SHA1
58227da9f99391c3510e358abbcbc93453f6ce24

SHA256
ccc995630d6acd5bc0c01d39952563d13849355f54546fa8d2141922902733c3

SHA512
7547cacf662d3e762e90a4c53fe0e918bb9fea7c962337f33f80ad2b3ab66337a347016fdf89de87ef3cff8ce6e341f5cbf17d7e9cd119b7bfea44ad31fcea46

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd1d6e2fd0c07cba143816f64ee7578b

SHA1
01597b8c90a57a629f38e9241580f0f262f331c9

SHA256
aa3af795b74ec2e792ccfe8a765d5006f47b73ebff8c43d7c20cdfe72b27ce85

SHA512
dc08d2649bda97a24dcf88c71d1a5e11b9bbcf5edd7cb481f672f7c7ed6c141aef9afc5abff953ac96d4232cdeeee0a739c046916766d17ea0d409b841c1f3c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b71c04ae450ae65701f33259e69c938d

SHA1
fc35343507128efe9ae5745c1da18cf7076acbcf

SHA256
5af32c78bf0218a5eb23e9704d915d4485571a405f3e9393d3fe2d80eb53f0b8

SHA512
fdd28ecb61828bddac75985fb4a9b4aa1c6b54c328ef8d15f477d3460da019c643c7e8e4a239a1ee6ba81e00a0145d85a1b60d953b2837a0179ed8a728da00f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
783ea66a1cf9eae19f54f946ba008593

SHA1
eb0408ef99e5a00ee6266157af17c01d0bc8ba01

SHA256
ec3fe4588ed7b5d3cfed36c64c3a0dbf48e61e1550e514e13695b342a3282a1d

SHA512
a5a95554b72f3c464f689b56169df75495959c40500a4733a4ee294f36b99517f11d57051ca728dcbbe44dbba26b30f08e9aeb571cb925d063124a770455d89f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1df01c224f14f72abf971483dd58232

SHA1
0008c55f1841d327011902454ff8e25611dc37c0

SHA256
18fd4400694da3dfc41d6f844fc8dc8e11c56465c644d2d4205d8f09aaeb9832

SHA512
b290ab6d70819f555e9464bc2bed5828ad487fb730bc1c5f1eb95556256b2a2370620b0e27cd026c5276c6fbb935971b69595b803d8402c2d228f5ad3b6e476a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb58f1cc9db23646fc3c22f3fc5dba12

SHA1
dd13c73e5d61297e823f307f0264985bee6f1671

SHA256
4366ba924e1e2df751add2c1f6e48b0dd4950c837c2d756cc495003051ff2092

SHA512
4cb140bd564f1da792336e3b379a9bc2779410926fbc8d47344f4e9dc6832e40d1c2df66e74c0241e9863f403f3bced3fdf4006fec4dc46ad43ccb88317b8223

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5df7d9cd0a40d951cf7e6b8565000a9a

SHA1
6df1ae27634a9e94a154d11173b93fc257c6f09b

SHA256
24320477454a16972ed157a0b629067bb5d850430632202987f627f547caba78

SHA512
8744b9943ed6534d6e77ee43e81568134e202024395116c238f25037ccd3af533c756049649015b19c9d25ae36a69b4e52c16d6acab661b398a9176915a5ecf1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fef623a8dde11c2cd5fca9c20ec6e0d1

SHA1
758c88c1fbd6351ce3b5f873bbf7cc3fa7b96451

SHA256
16c4a3512142cb535da6254b56f10f8bac435b238e53582710f32d942b095bf1

SHA512
5d1c36105875300b9efaf5a23bfb132d054454be75f846a19618b4aea4f11f090b67834fea7b47a6c0bd329422afbce9905c9dd4a28b42498fc91ff80ad5fd49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc9148ec47eb679482491477911fa633

SHA1
808b03e74352189315246c3771e7a789cc2ff459

SHA256
02a452ad52335e72c754f7ec454eadcd45ead9549f91ac73934356e1f3d15e8b

SHA512
79b1e114a538374b79e30fa1bfc4b7b5aa94cc7eba31b610d9184e15fb7ec74bc194f8562d334558cc83a3f4b744d038b5725d1ed89d243289305fb80d770089

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFC2C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4A8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit