317e8a2bda6150bf58582d91138d140706b8c9ad7dfa6f1f923e1d6f2472d604

Analysis

max time kernel
136s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 20:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf6431f3acdffd9af7f6a5c06896b48c_JaffaCakes118.html
Size

153KB
MD5

bf6431f3acdffd9af7f6a5c06896b48c
SHA1

4a1c2d63d15f090b010087beb48cbb5f537c40ff
SHA256

317e8a2bda6150bf58582d91138d140706b8c9ad7dfa6f1f923e1d6f2472d604
SHA512

440998ba54b156fe427ff0355b8448f6a86d7f51dd92aa973c3d96319d620c75a2b0577c36389e44cac31c175f1f4e94b8bb9418e14ddeec5bffad22dcf2a0b8
SSDEEP

3072:SBwrarW1hPYyfkMY+BES09JXAnyrZalI+YQ:SBwrRjPVsMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{43ED64C1-625B-11EF-913A-D61F2295B977} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000ff7ab1eaa86965609b9f824d852e8c67b46ebc6813b621589011856849fea621000000000e80000000020000200000007f1d0d8a1c6508cfb5a3f002859de4a5630ef312324cf755275453c69ef825ed200000006a1e9bde66249a882c8af8a8a847a5916f44a9370c907f073450889a3a32cd85400000002255dcec7517d9d67cf67912fb665bd4869051a6aae79dbc4c62ed6861252b3739e6723428618a5781898fb695c859ae85cf9da58be6435db092bf87731a8499	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000827cb74a310a0c51312147f4834292102703a7bbf2923f276e36c3c025152667000000000e80000000020000200000002fa054639def9835599dfe7deb994f5b301833e8d7b3ff2029613e8267f5122490000000cd0f280c256bc52421cf239448d5b92de250d11dd1c1069d9f3681e715cef3b4721ee3d4ecdf3c4ba546b25dc0b5c824ccd0aaabbf532d375e496e70a98e1e9d5b16bd6f2335c7f20ef10a5162a255ac553dffcefe6273dc608022fe3f98675a800829888a18d9ba9d3c372c912be14cdeb3a91b0e6afdbbe9b00ff0754eebf94c68adc5765ab6cda84cf85d153c8c1040000000ef7d8df3528a795bfc7036680a1716a4d28fde48df5dfa604ad408290623f58677216cdc431e2171123eb5515aa91e054c2f69b474e0008056d5693958dfce93	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b018ae5768f6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430694829"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2824	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2824	iexplore.exe
2824	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2748	2824	iexplore.exe	30
PID 2824 wrote to memory of 2748	2824	iexplore.exe	30
PID 2824 wrote to memory of 2748	2824	iexplore.exe	30
PID 2824 wrote to memory of 2748	2824	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bf6431f3acdffd9af7f6a5c06896b48c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2824 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
994082624902db305ac0b21de8961405

SHA1
763a20e1ae6587e0e4c987b405da5badd9c2b142

SHA256
7783ca53260821a134cf9151373a57c890791f87d5e36529ec571c7b24d5c8e5

SHA512
41c4c09470f51eb774bc66dfed377d0bd4a68acfdce1bb1fc951afb5d97add913ef13c235537b9bc5169f5b6509f291b01401541dd4453cb4bf11984068201ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
331b5b042e045357f7f310321c26ceb5

SHA1
0406beb9a9fe983ae99fb258bc5f79b7b2d4d45c

SHA256
ccc87f3dc745c52bd81d0b48164d7fd61a6f33fce19a5d2abf1149e7ddbddc89

SHA512
3e97fbb84327ceedc89472e63b515f93c5f0850d092d4fcf50c7f683366b9a5ca0010ac21aa341de37e78b1181b59dd763f4d0aca1c884c2353ac7fb2c4ba4c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17d3c33baa0d0ab7a7de493b00d1fedf

SHA1
c8fa4306b4a60b64654e758390af1af6a9e3dcbd

SHA256
c59567ce0d9f38fa455e4b2c695230460fcc18e40ef263e43051bf1ddad69916

SHA512
42f72973bbe9f4b39f2e042f3ecc6c1328f6d7a6443c2e18486183e694737965cfe7030fb5f96bb5beebfd1597813162f970360709f145591f2b3e965531e107

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f72028c1bc0eee0c93b7f46a4bfa338

SHA1
7a6b17584e17b55ff77780cd5b19c1e8606d2955

SHA256
3a69a46fbc6fa2881d4a2e463dc7043a48eb5961d6e92bfe9c62198ac7cb6f24

SHA512
85770627c486b671b6c0541727de7cd686853b1a399a0225bbaf6cf5b3072e62fbe0755fb0b15380a2ae2437b4070a9f56dfd320e77381e0aeac43b7dfa4356c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
004a6f56fe3c66a5e280856ec8a8e677

SHA1
797cbb7d5938401d197bcef5f4571e274a5799e7

SHA256
b13c845e1d0e9d72ed004675c1670968ca07dcabfa8ac8875e0220a4518494dd

SHA512
47da2fdc842ab66c1c85cda00edbdea7c4dc6bac184e22ad90a3845517070746f96a6c7b03c971506457927d999475a44f1aa75f4e0e3415896ff7228c4b83e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08873177538e330b2bca87636f75f64f

SHA1
bfbdde34cf08d1ce14711275671c9be87b69443c

SHA256
0a118c32d599aa10ea089392d907ef37dcdde7bffc624935461608cf73a957df

SHA512
a2a8dc04b5e7468a75089667f3962ea945b3f4222484e41ec0c4c1141cbd99d2346354f4293d5e4fa8c852b89b4325cfff1bbe0f9407b34ae374a2dd01bef60c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec3927c4668e5ae11fb3ba5afe3986b0

SHA1
01fdf086c01611973fbe53ca359726fcc9e71a63

SHA256
40e44d93cf0630c600d6c071127b17c984dce84d5cacc1ba9f41b7c07a81eb62

SHA512
3ae4f9f39d6998cb0eabcfab239983b17707e5b862b12a27f2d3387df7d28e02174c4025f0745a330b0e21df21f05bd9c9ec293a27e4b1f19f16020e08b283e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59dc4b9469f8ebddeacb1930924a7d6a

SHA1
1cbb8171ef832095648f46cf1fe8dffdf75090cb

SHA256
8a5ea75c4d4affada2c05d9b2a83dfbd5745130e470e5b81c0341daea5775e06

SHA512
4d5b4bfbd6a1928b91a4d4df92326b69efcebd018fedf9609468703059c98523c4c3f424a3792558d708e31e5040953ed7229b92cf2f25cbe9b5e8f2fce95996

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
acc4ea1568f76d3a231b6c07988b74ef

SHA1
8296111f59c623d9b0e1eb7432440df8a36d23f9

SHA256
77536cdd5cbb257fc50a707ead8bd327b3f13d853bb99c543f20167e82782c5d

SHA512
65883bff54b9eba2f5544e907bf908df8da006e62423df4c36a965c71d75d14917da4fb633818d3b61b2dad0e40e07987ab2bfa684267dc3dd65431d502864e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
581e8f03abb95cd2d721ac60c53e681c

SHA1
efd6eea032a1cca0c9e9435e12150c2e02b04854

SHA256
a1a321ee3d8cc1116c023453aa10c2b93ff9f3ba95c0c5b15e5b8d4a84ddf65a

SHA512
5e5ebaba830d687eb71083d7bd2a0ecbdd4beffc54f27268eff50574cfc28791cf238f96b1c45923e49ac70447303cd9f5a3d4cb1147d784a82f78cc68fda487

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79dcf36c3880255e9c0ffb6610982fc5

SHA1
1a64b0d02d9edb8f84c1be0d666702e8e6aa83b6

SHA256
6a2a13c511d3cf4ec835a546adbc6cd4b41e464562b50747ec328bf8b34cb16f

SHA512
5e87cdd6b0d8c32e5af372c9aaa5284a610e4cd0452765ed6da0eebbc9df765da99dbbc3caa9ca96e5317c44a5659c4f9cb05d414d539e038b111f4b6204117d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d16c50a4bdcd2d179ef0de643c531d1

SHA1
5784bbfea0039135f06c16667a7f8ef5c284ad3e

SHA256
72554cdb7772eeb78a7b802a7491e3c42001329c06fc82867749ffef0de03c06

SHA512
3eb7f895ad387b4d267a45f69db0d88ed46aa3318c6a7b4b0799cf1b4d677663f5be2f58026610fa5da85aec3d2d904ffcbce4059f2bf9a46637bc83d0114c3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a0ffc69320a68f188c72aa7a516891b

SHA1
d9f5120073a0ab83c891f584670b7ffc006f4498

SHA256
ccc1aee19bdf31d2785e96eaa8757e246aa14199c4e4cd944928db995910ed57

SHA512
bd9b5f113d442513b239cb0d20fc837fbb92d00406c55553ed501a0ebd900fa7323ab70ffbc18b6ebda803e76afde7958997911a687f32a3e87a9b6ede4d8874

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24f2112fd7724a491455658bff60d8b3

SHA1
8d172717fb70e3dd76ae22060d59acf339746e54

SHA256
3aac71d2680ce5c72dae29565b34eed5c5adc6dd05c900bdf7421e4b6d371b56

SHA512
5bf60b5824885a091524baa96db042a5d64deb12aad3f33fdd3a13d4ca7c7cf970525cdb2e9952759e845f6bd642c2c07aab7a822977d0d89558888178248a3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab66A1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar67AE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit