4e6b55772634872f499eb43ce9ee7e816c7510869116c89c2edbe56adb85f93f

Analysis

max time kernel
145s
max time network
146s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 20:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf65ff2f83e0646ed14261d826799a07_JaffaCakes118.html
Size

35KB
MD5

bf65ff2f83e0646ed14261d826799a07
SHA1

20be833ce6dcb716109fb1a7ae9b7f46fc3dbc71
SHA256

4e6b55772634872f499eb43ce9ee7e816c7510869116c89c2edbe56adb85f93f
SHA512

79b7ceb87fdfed877726017413a11968f9bc428d87c9727a361a02afe50eba2bfb0a4a4f06cdea60b428e264991717a6111de21e530bbc11849c61939240471f
SSDEEP

768:NXJIzyNH1pEXfzdHkdi8yO0z5hBnIHF3m8:MzyNH8XfzdcitBn8Jm8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000d6f3051abd680f9b02e825009d9e9e377acf3718074c345d7263647b8ca4baa7000000000e80000000020000200000005525c9dafd543db859cfcc9d97d2a9795915f96f7ab7e5fa9eefdf5fe538b7df900000008acf37c61bbe38dd865a3a24161c1753323ca062a615705adbe6ba0802d2d8a3a53b7bac9d5c0dc45ebc8d0c780a1978a44ee3cc78995a8e6e85f73f894b2b705a2242c6d78c94da83b0db93527286a32aade54d90f817c24f27df59d8cf8ea64472ef65c37d752480f77967a7d5b8237ae4d67b1433f68c8332c54ad26a9132f3ae3d0155b5134027fe9a6816ce5c3b40000000bce2e14b6dfc52bd4616c822d7baf522c1ad939af3474cd73c7bf746d4d84ef4f47a484cad70f07f7fece116309f134fcbb7411d19b5637db13770190a6b6ac2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1067d0a968f6da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BD8AFFE1-625B-11EF-A1A6-7AEB201C29E3} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000004e4d39e6370796a461f4255d9b90a10e7a46a367bccd84a36bdba8e3436682f9000000000e800000000200002000000010fc4c2327fd45b323a17d9ef0375e060ef10cf7a7ae85840b7bdd263605b09c200000002c378c1bb15e461bbed7a9b72ff37407eed71e1b5cd905be4bea19874cfa52e040000000202c8e9d82a4fdcbd9123a5452027b4127fe7577c5d4f1c340b79f78d7ecdd996b42ed208691e2f0620d956bf9ee60968ec4a31c95927e51fc2c35f593b70a42	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430695032"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2768	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2768	iexplore.exe
2768	iexplore.exe
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 2804	2768	iexplore.exe	30
PID 2768 wrote to memory of 2804	2768	iexplore.exe	30
PID 2768 wrote to memory of 2804	2768	iexplore.exe	30
PID 2768 wrote to memory of 2804	2768	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bf65ff2f83e0646ed14261d826799a07_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2768 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
c713575a58db74318b89d4760ddbd2fc

SHA1
12dbeb3347476707443b14b04870abe6b63cfb8b

SHA256
b7de52a3311b567753f90a6855454f5774fc107cfb26ce82c5fc56b97ccbce5e

SHA512
ae587ee4e7209d6f63fec9348d4a48fa5eb126454b230fc06115c861459fc63ee70a539a81d0900cc44f6705f1afa8819a70bf85c9dad5b5eefc0e301e2c41b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee28841a6259a632f29115170835171e

SHA1
1bf8f96a397266bf3756244de9fae4c5b939feba

SHA256
7db4674df5d88651c378b48c947fdfc6dab48c2b253f272bfcd272f1d14d3e40

SHA512
6a70d0e7df2e08cab55a1779398011f80a815a24414df0c6741c99edce3c51929e04c68b42110c3d6ff38e14f4dc45bd43a8048d99e83182d320f46fbc2d48ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b4a6e48c399e87ec1ab8f301d8ef0a5

SHA1
9540fbebc88302baa3382faf2a1456621d042de1

SHA256
e9f2c8a097576eb2ed714ac565147a3efa07eaafd52bd59c45966d445f75f951

SHA512
f05b01e8bc8846728b04188f9a3acffe637bff30f06a6f7dcd728b89605e5992851b9d4a2c35d8bf21ded342b42f58ae8badae46d95abf619535326c231f1c3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45039cb70f1ddbb6049d25396339f7a9

SHA1
47a3b995b071baee8eb803c187cc7a69aff1eb17

SHA256
ae4965a0aad228869ed0ce9acc94ae973f7e3018c8e1ab374cbf64d4eae1b875

SHA512
17b9ec7d5b2352cd78cae38603508e705e3139352f56decab1ba5f0e2724020fa8d19e881e276f7566333436e691b562e95b004e69b86f2b4a09a62bb6abac30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
902ad9c5c551dfb45cde7c9def25e016

SHA1
4682dd4c68ae9ea0ae4d88bc96f9e769ddde7358

SHA256
8e90164fb485d8ffa3a2bcbd8f45f98f4404e60ce5ea5ae580718504b94fa926

SHA512
0ad0144cbf8339e9178ff3fd62e3844ba396e367ec76de6d7b1b363bfb6db90a7fb20d37b6d6bcd7fe073fddb0dcf794fe24c917581ba141d332b90660db3b12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
406f6eada5b3d56c838766169779e94c

SHA1
1aa094c93b6a1ac79402b2d0002c04a4bc30a991

SHA256
b9357666caac1ea07a7964f38784ebd4b0d104cff36ce5214b2ed93ba2abe93f

SHA512
b8f1d30a5bdedfec09f0be28906c535c9da38ad716fe200e656439f82bf4dc630856257156719b5c51de7faa9cd17338be75841f0cdc8cf555f3baf7609e5602

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95f6ed4f8f6b58866159649d2d6918e6

SHA1
b46e6872460e9e614f5ca1f3eef5d2fa1f44a4bd

SHA256
0dbe1e48af6606f7d0f922d3181cb1f7b5b0e996fbd915d043b1a30abbc596c4

SHA512
488cc97f54a7d37ed06913eec78717c02ee66983d13404a854877d587a77077f0dbc2f44ddbd935fe0b28b81de681ff1cd66010252e90cc1e80bdefe5ebd03ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf9ff40f68c09ade38cbd3a2c7b14e7d

SHA1
ec1d86bfc14a16c6916960b55a988861dcec0cdc

SHA256
b8c44c40980657cfab14fd5c652649deb06cfcaeb4ac9f7bd8f00087daae944a

SHA512
23273f4cbc0c9b38e34f4ca3bee40f59c1fb10fb2ea19a7bbdc150b958ad0557a1b1b7f880ae76f886d451196f91e9197a3f3c3f687992c0537a917a5ff351d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d22a23c9109ef4369dbb9f5ca0c8dce

SHA1
0000dd9ed13729aa0d129db5205355f2f72666af

SHA256
4d48769dadb1dc17c9995bd0bcaf2a8b207bc91c2b8c4b2f13d1534658869843

SHA512
4e10a60959afd94227541f2af7243853baef22e6985668f7b6f74a41024ae5cd31577b6df4babdb9e7a1d7b9f7e713e881ee2609d3a422c8308cc46af0410724

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7303160c1764a337564132703148f44c

SHA1
0693dc4bb908f1d3148c5560a3237430231b3555

SHA256
b92d7a436d82edade4470d2181dfc777facb0bc5dbe076ef343726549e25e819

SHA512
00bb9b4c63de758c5ec0ae0cdd6b3ed12992760511ae9dfaf0b5b3360043520b879773aeca9c7c8f94b5580f37ada13bcd6e9ca15da167bfa92974e08c1d3681

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
190ccf3e23a273ed1784950a8800b928

SHA1
f40f391a7fd635b7bf6cb0d30ba14bb096629a08

SHA256
4e80fb1e53423e9f6fd6d26a0d930e41b0e1409930a85d3a36d9f9e25ab65f5a

SHA512
7ec3a18f63775cd9c6fb434daf12e99ed864c1c96cf8c2c9bb9cefa1c0a9cd202a0a16a566f625b96cea81abdda42d11866dd6f0dff066ef344f2a4da94abc5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
1c098d69c1cb1b5dabd919583608cc57

SHA1
5444c2e898840e1b432753eb9e4e9f34c9e61157

SHA256
9607fc4df40d50213598917367c759e1ab46fd77609306da358958474e17684d

SHA512
56e41757135d7746aba56c5f01781a23473fee6cadc3b88a8a0e69ee6c4513023236009acb39d4cc629bc9420ca3ce7532dcbf430ff96054629a7bb4721d3883

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE9E3.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEA15.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit