7243454af720e641dc9421ddc13661537b0dee5c6cf2e828a875518a0934ecc8

Analysis

max time kernel
68s
max time network
129s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 00:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bfbc8e60cbde7a76db0aba7f9ab6839a_JaffaCakes118.html
Size

359KB
MD5

bfbc8e60cbde7a76db0aba7f9ab6839a
SHA1

f620591f7e3cd1eca0e05dc3cbccd51129ad5b25
SHA256

7243454af720e641dc9421ddc13661537b0dee5c6cf2e828a875518a0934ecc8
SHA512

64cf4cd9029fd7fe23c7a977492d376208081fda9caee0a8376a2baa3076fcbda60875ad2b8bb867d5a2d807a77638e76490a988bcd7b18c55db879313ce6a33
SSDEEP

1536:JbEM9V6fY7OLEuZmIANFY0b/9KCkcSdccttUVNiLtBErW3Etddd7NLdt9cltdBFp:9EM9V6fY7OLEuZmIANSoQg4ypwt

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DC005BC1-6277-11EF-A5E9-FE7389BE724D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40ba5cb584f6da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430707109"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb90000000002000000000010660000000100002000000096a4edfd63395374aa644ed925effd8bfd4b027aeabb31bcb0b10b16aa88e013000000000e8000000002000020000000d054694a75162a2c0a29f38b9c61c015930b17eb9287da43abbb0f3adf69f09f900000001de1387e39a4a09fbb84fee8f5d113c3bfce45192e087a4f6ae06c3452cd0d45a722442d3e280e5fe5b4f6527cf04af9c89450fd872f69ea9a858640db3c113b94e9ea4db5ac1d199b44f646761647a6258e0cf0dd4c27aedc279157737e9b31c430005df66ca39c559f53d432c9f013e8c35cae29fe61fd792348fdb5842f9c2eb7d85c26d315d42c3d5d3718530abf4000000045d6ca5d4278c6f9ac7f29be51ec22f238209d0a194a5522b7b05ee956a7829de643ea81ad1d05f7d5eeb1e0d96b18e701b44b0e103e9bd730fdd00c997f4a83	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000a953a5765171379d217884693b9618f1fc9d8708126c06ca32615db72e2a62ff000000000e800000000200002000000010a7ae71d19369601325fc899a59c9fd9c31741531629f8f7d2ff59af50b65d320000000400bea7234bc576d652261b6de67fdf0ff28cc0a322df2e19214f7f26aa1cc9540000000e2c47e482652eb1ba9ccbfc9bf8302306c82741a8ab24293c16f6cfdc6441bfebdb47e577c9cf55edc76d82ef420268590db9a624c4c949a98caad7dc2f5235a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2308	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2308	iexplore.exe
2308	iexplore.exe
1092	IEXPLORE.EXE
1092	IEXPLORE.EXE
1092	IEXPLORE.EXE
1092	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 1092	2308	iexplore.exe	30
PID 2308 wrote to memory of 1092	2308	iexplore.exe	30
PID 2308 wrote to memory of 1092	2308	iexplore.exe	30
PID 2308 wrote to memory of 1092	2308	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bfbc8e60cbde7a76db0aba7f9ab6839a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2308 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29c8b21d30ff6e8a9bed16af54a541a3

SHA1
7bc4ab098cbc850325aefac7f3593b980752b55b

SHA256
cc1f6e244db64c1610cc1373e5e79adbb22031ac5e80307742f893b79482a9fd

SHA512
8a81d71218334223ca2a6e46e40c43e74887f7f3e98d45fbf742c1e50a36cfb1db906b3c50c624b9141256908eb5a7477dbaab911d2805da4b8a2ad75409838c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c47991734558fb8578fb96362201e653

SHA1
874393d6636f2170a9559ff42eac289c97121062

SHA256
450c4c42b2bb0453a6b0ec6733a384774c02c446d6c4234456af5d543d047ade

SHA512
bff54f254d7511322b291590422777411ff354414ccab7c2e3e4fa48012cb2d179e2e075f71debe9d4a7ebb0cb34fc5870cbbfb26aa711fbaaddc58f1c736dba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8eab7f35878b39bcfacb64b0364fc224

SHA1
c7270667a1523b57d643f2d5155d0b24bfca6ce5

SHA256
4c97660ecc871dc7a21e39ae6bf984b8f57c50fe0312cffce54a62a95e9dc8a2

SHA512
c849ded010e1c65b696ebd4f134de6b13237b5d27d3c1cd18c822022cb944eb9a937d28f8e84cf9ee887ff3e0acad16637f8158ff4b5e4d71e016c9702157cbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
508771c3db32f71c6351f5f7d48bdbbb

SHA1
9bddb9edea3a585d16479b27ffc36d6a2eb29cc7

SHA256
6a1195417b3aebda3d603584d1aebe1d3f05b06ee774179089920dbdfdcea76e

SHA512
fb704f3dee9417a0e77c991a07c8e79447762fffae069977de409971134b3430ed752c9cbb02f89f21a4cc912bcace753097e622de6b802f23b31ef5e1731713

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
918bb13abdd86314216630be86013b34

SHA1
935b6b3c3e0673ff33c97d2d7934c3f6e0a12fa0

SHA256
09a17097c0f2b21e5a2ec177e6035c71d2d1df75dc9440a4e180f71e557c5250

SHA512
943e1bd5c1ae87707539a6fc86bfb05770ff4429914933bd1bb370a33490ac7bd55f0b203f3edf8a0f44cdb1eb9524c855f9f5658454ae69d52430217fb8948d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00a5f230966ee5b9bad0a17e0ea9f1dd

SHA1
d5d4d1e12a9db1f279a8549538ef92d84d21022c

SHA256
626cae41abf6eb24a206d7619af3bf1fdec83df6bf272099adab33e338606d69

SHA512
41618ef7b9e1ab0606ecbd3efd252c5d94510ec2f8991c205cb089b4792374a7dbba55765c3d489076a447afc8c8c041a4054ad2cf77db0221dc0104f259ee5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ae38984b3684ce440655b466418d804

SHA1
843511ca20feaaa5cdb2a5eef4f3b1f6436e25ea

SHA256
f9be8be2f484f2ba90e015cc3ec6632911db089c630a3bd4ecca512765305238

SHA512
a1af656bdf23b81ca31b4024cc4256f343016a0aa59d213d65c6b8d9b347ff5d758c331617b1b8336918f31f9d79a87157ffa0ddbf432ff8de20ee6de2f88de1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7df04e906f415bf496d9bf7799c56c1b

SHA1
0aa324abd101a06550c7c9b7c0e5aceb3b6d75b4

SHA256
152de80b64c2104bb77531a4fb45347a17bda9f5ae654a3d76d634c750079d92

SHA512
02862a01efda561981665a873586986b04013d72cf60bb281d8ba7a8946b3dc548d1f8e3fe3cd51c7d49d7e92e141c25c5e8aa92314975420a87fff2ea0a385e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2329aedde376d8fbd98f35c1bc1ff8b1

SHA1
da89bd7dbb8bc1dc91ee5cc64b89a136ebc600b8

SHA256
d996e76b8625d2d4fb0f9b5021072f350740fb30e0c5c642510f774536ec6038

SHA512
193bd348514bd026fe468d14bb8199ea064993d87f08888c65acebab0e32d1855a60f0a18fc939d3f71083e1b1f67ff38a5868c0a2ef033ca1214b31dcc4623a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64868f556ec98d305a2e16c07b3b69d0

SHA1
30b6f8ffc9359fed39bd473ed4972a5f431eb84c

SHA256
2355a3e070108b73ae9a621ff3b6d8b660962991df843b910bb587f089fcb936

SHA512
d173f1b6cdd8ed4d603d3f0ff277cca4c417cf191d9b14d676ff7b786317feb4df2aa71ffc3a514ecf81c68a82bdd04c0900dd91d9b0d994bb84b59f2782e173

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43ae072f950fef3445fff0b54bc8c304

SHA1
c9271793f5acb80e44110ba5a44e7f1e7d47a5dc

SHA256
e5991dfabc33db169c5e7e16f0aa013ea30cdf41b4f607fe455e49caa89827fb

SHA512
17f9e3970ffca8ab4cff5f9c4d15024efe17e077cb0fb8de760aabe43424c4c85b89f30d1c0e25916934e276e5bf578b435e9013a5af64d442ef5da5f73eab76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e944dc0b1164d6766f5a698b10278fb

SHA1
f4f36861fc573efdeaa171cd693c52ad48ba65c5

SHA256
3b5765b2146be853d191b3c407f464e8bbde760c2e19b30c986f58cea467e254

SHA512
91706c15a0335217fa3258b1084159862ac36b52243f984f29332f242fa79be39d3809c8c309525000c83f727544ac832ab1eb00b00b45c16ace03b7a4b8f805

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfa27e02878539bbca24da27fe2ef21d

SHA1
4e3d45d3c9bc48423fcc2d713ba003ec3f567c40

SHA256
f1ad56dcaac5f00db052e0483b1d622a527c9a97166ffbf6e5fce2dcc8f8f286

SHA512
df80e536347e3c223464e22aa0cc9e690d0fbd57dceb65e8f9fdb0e0437b8d6bf7738426af6f6f8907c8699b417901d294c592277cad2d71c867c790fc84e31f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBBA3.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBBC6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit