bcb7fad08758c6cd73e429d0356bc7770b3e22787ee9fce1923d643119dfcd12

Analysis

max time kernel
141s
max time network
143s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 16:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30cf86ad0958a84ea5c96eb4a60e2345_JaffaCakes118.html
Size

109KB
MD5

30cf86ad0958a84ea5c96eb4a60e2345
SHA1

fe0b3fa12e247a49a38d9427d45e1f6e8f5f9d09
SHA256

bcb7fad08758c6cd73e429d0356bc7770b3e22787ee9fce1923d643119dfcd12
SHA512

9c47b712120cab5d81d18621bf13b733fa12a0855e665445edf060c09a584deb1f733c042fcfeee41ff16cc5a56038d92d2b27b73480e1a9cdc679c506d9d15d
SSDEEP

1536:Sl3jIJlO8tFkYAOIg1pNHFmT0ikciMFOwqOdn6wR6k32HiiHZSSp/m1kK+J3DzEM:SO0bdeib/21

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434739148"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b060eb9f169ccf429ed15d94cd0cc604000000000200000000001066000000010000200000007fa9fe4f08c0bbacabb6524fc255662afb9ea1d0556415bc966013ef5439b0a7000000000e80000000020000200000006ffa8b6052b5b95bcbcd4d136017f4c0539286007362960bae041f7adeeffc4020000000f98d703b555f3a8382b70131a86775d69a6d7d17c73ba0fdc20ea85a825376f340000000f12f3f9e017424aa806cbd8dbfc3251b39dc97cbcce68c2f6f7c2d3a13e787207d758b24d82f4560a31e585c4bc2488f6d32e920af8372ae3cbb97b2455aca26	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 008d4b86301bdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b060eb9f169ccf429ed15d94cd0cc6040000000002000000000010660000000100002000000094c6c515802525ccb30b77a70b7ddca39a61ba38432306e7f5a3e3f802c1b4f4000000000e8000000002000020000000e89b270f47ee83389d7755dd75ff83ace697a5cf0ba34db5ec9bea1ea3ecc52f900000009dd11ec9c19bb5330b19d2f5c05034bc941c64ad2000fc955699e8764ed296cb2084d9c2e8c1db8eea5bf211e1d907a7e2d3a8c4940cd472ad1c836c7eb694c8e9cfeef217df4c2ada5452904e698731a3f48112ae4bdd8542da2f6b8849ca30fc11559bb65f0e307dbf13e8a8c3d2721b608515272b54f80a00d95bcec3a899f90d7008f66585556e6c223f5527376840000000599877dfe13724705c0302cc37ed5db77d64ead018dffca60d7de82f75d43cec57b95c62a485f6dc04d53c23d2e8b5c51c05bada80737151234cfcb7066da06b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AF1F6491-8723-11EF-988C-4E66A3E0FBF8} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2916	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2916	iexplore.exe
2916	iexplore.exe
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2700	2916	iexplore.exe	30
PID 2916 wrote to memory of 2700	2916	iexplore.exe	30
PID 2916 wrote to memory of 2700	2916	iexplore.exe	30
PID 2916 wrote to memory of 2700	2916	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\30cf86ad0958a84ea5c96eb4a60e2345_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2916 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b795a22c21e14d643cae417b9525257

SHA1
7876da61662d9050f506e0df919ba4683fbc3ebf

SHA256
365844da501ec01605f4817a6bb8d6f6b0e6eb6a6142479d2323eaea2b39376e

SHA512
c15ccb5720eef34fca1d7f5aff779930faf0cb9e9efd3aee06c4a92707cf2262e12a2f7ad846852e23d38bc7cb53a3dfd50207b643c6079dce65b716d359b7bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
586381b1ddcb1cb707c9c9d9991728a9

SHA1
82eaa6bfc813714718ec4f4d695e5b6eb5b813c7

SHA256
5d751cf7ca593e89c58ba5469f861164734f746f0310bbb0ce5caa980fbaa80d

SHA512
37b80792bdf92e6fc577cf3f3f7b0731491c5e8d58bfb9db9505655c8b1f5a07ce8eaf854d01d5523c745af891493d650f809e8bd4585c7883ddf05351a6b234

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7afefe77e7b89cacc8fc75dcdfb990fd

SHA1
59dbbca4db737f2a8aa4c6cac6392016aa8c98a7

SHA256
eb2ce2d29c384b3486f2c8511a12a731ee61095309790eaaa10eb751a7d73e98

SHA512
7ff35d3c88c5e46409abd57ec377b6267c3bd1e9de4d9a0626dc94a4527a8f1e983632418b6042bddaf0f956f7c6dfb9754d66b30eec41b472e80a54fdeb6237

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11925f198086fb13b532acca650065fa

SHA1
84af9f7ed98551af7304611bd2a298bb785f835d

SHA256
36459fc47f4b9c1cd52fd7752bcc391ac228aeb0c81fcda4a94345b2b536c5bb

SHA512
0a5a75b0c096b6e1a0366b8a111fe4a4831e62125beabf4c57c6df94d2509cbd21b4a3272c624832b9c7a1508884a986b63a0f7ecf7eb1d25b7a2624fca4d46e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f10a2763bc8284a2f9d76ec421a6af9

SHA1
822c4dd43072571cd8b5b0e22a9ed8ed3254055f

SHA256
1e85fbf6049110f80a85b0bb9bbdb40f1ea97f816a3d8ea1e0fd7dc2fb8b2cde

SHA512
e6f136319a03bdb2667c21ce3d1a9a9b15f5c3b2a68db61cf3e01509192eb7ee603f8d4edc0c19692d082348bd38b3995dca2e3033fe46eb6d9840969d79b397

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d206b1d6b70a983c7ccfd662d26cafd2

SHA1
198343a9d82b4e458c5a4a642f96f03b63019719

SHA256
0819392b5fcee3739e219cb2817aa9a62ac380cab8991d5f194ffe32539b9365

SHA512
9f47de405864db99779ccfc13e69546055b2d867bfe5ccf2b54ce78f22d68988f6b4369a100aba209635bb9740eff9d60bc3ce4b97127c2e84dad0417374630f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ddfb009aaf2ae9f3f8d58be88c97957

SHA1
78adcb513360ee74cf043c21ce8b6a287ef2b070

SHA256
19ce8a23b661dd397c5e7361a99c993fa4224dd2b5445decb2556594bef39682

SHA512
ac151ba6dd6b45bc0206f4fb2400e0c380666597f13028ea61fa957fd3086ee5361bb920c050b7666404d1a1eca6342669904fa7a4288b65f47ad31ec83ffc4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b9b1cc27f9d5077c4f3e353a4004019

SHA1
b5e8039d0fe2caa340868d426467ae61efc540e4

SHA256
f9ca6b41adf6cf0a351e912672d19ed20709abbca9006dd252799799b9ec2ee2

SHA512
615a7c968102f24e15874fcc5459328c9c4390059677baf425d48ce374227faac71061d0718a4165e8429b4497a6845fe8f5f5e8f05f62dab1cb7087ff9c5880

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ad0ad70645ebd432ee802f1b352a7c0

SHA1
92f308940f15b5f986a4a7c8450b7475c8fc619b

SHA256
c561f6d07c0a73e39b4afcee53e838a2251480acca01bb826ed6acc3266f510a

SHA512
e21a9465cc6ee74ca7ab5fe5e727410dc58c0234c87452159aad8cd0a19c80c34825ddadec95ac7f422a0952d5a63fc817db0ee932085b9378303487a1fc78e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3bace0cb9cffcaf002808e11d5892cf

SHA1
543cea30b772036489eab95ec0732065bb7ba8a0

SHA256
2e6e99c0f4949f8efb30b5bcbec26ad5eb0deda2c3a7563f0a3060e38a9bf359

SHA512
852c6f45a9a34b3c6061a98c2490fc9f9cf4f2e2d7b6487f87cd252ce592a14ecd1d9e6b922dcdf5161173299562ed8c71455055a1fd9d651bed07629cc4259a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62fe078df1cc8655dc467b7944826583

SHA1
f4e803d24a0a8b6786855c4a795a6978270658f2

SHA256
a093876203dda0847857b2aff72a81467a2f9338caf13816a92ac60cc8f32eec

SHA512
67fb868d5b10332f78a89709723eb9beb3a3c6463b5501db917b9860deeca5a851d64c44f517ad70744e49ee746e35df45fbaa96af8e85295de77440b107eae3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41fa464fe3e56450e92466a3564e1800

SHA1
fd3e8ec5f6d4f22a24bab4197993ec95575ab4ae

SHA256
f0fe874dbbfe2288baac36f3346473193d2aae9d87393b58e0a9848ce02bd531

SHA512
486fcb540d17481b9fda94dd4d3799ba12392f98e85340cf5a97a6d561993f6bfa4bf397e190b02a032e16916259b3bef0d48e6597b4553ac83a99b4c815115d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02de093523103bb1c5e92d898072578e

SHA1
a7dde8d8cbc635e388cf492c927992614113e992

SHA256
6e4bae5576c56db8fcd55194fe24e6f361cfb96ba69e5d2c1508e1e380ac3e38

SHA512
1b10a987f8e0af178e5ee64bef3cf481bcf652323b898bc2785165033149c03dbdb6d2968b8be99bbddc9ae67df1fa735506e5fd6dd8e9d6374ea7c35923f653

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2ADA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2F7F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit