4912a4ed104f822395d1b75585178e96415c9be718cf2dfd2012e6503372abc6

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 00:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b16eca3a4d9c464b0a5e1f2a58d2371a_JaffaCakes118.html
Size

48KB
MD5

b16eca3a4d9c464b0a5e1f2a58d2371a
SHA1

7fdf9bed651df0af4b023e3d26f2f976e5b30781
SHA256

4912a4ed104f822395d1b75585178e96415c9be718cf2dfd2012e6503372abc6
SHA512

3d0ef506f4c3c03916d7bf2ef66bea2e014116f16d9d02beebd652445b012d209d7af995ad558a8c8fc01a505808258a5a6a22d69a6e503eb533cd73ea2150c0
SSDEEP

384:JC9uc6Pg+LVlpBOC9DznFvAVR2bd717Q+i0/718+O/eYmf+r2y18P+0oZGIDff3j:k9uc6I+LVlpBOkwi8sXFnAx

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1E0929C1-5F53-11EF-9A20-C2007F0630F3} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430361475"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f07e5ef35ff3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf710000000002000000000010660000000100002000000071d18bfae513d1d333fab3372941fea4b7d2f3e3a8ec6701ac8f03f4673b8740000000000e80000000020000200000001747a31ccecb1a9157d95ff11871c5f05cd85bdd75d6708a7899b0f92eb1886490000000d6c3dfd4883fee5e65693a0dee5e08a1b69b1ad2946a063614c3bf409b236391330bd03e52bdd37459697c77122fbc7c15dba0b231cddc30f6af3b89d41026e3d07549a5f4debb1f6acae78fb13229d4238ca198dd63d0864a105b51d11700f93281989dfd3ec5a30f6a51ee7f129c8d3537c1b2954626bc03cff8000ce7b136110ac973ac6532366b8671cad3bd9e5b40000000e7b5b30d892fd162accf18faf9d8acaac6506831ebc0a97d7dba100509fe238ceaf10b0d0d3a8da90dafa8fc021a7f9b4bb3f7074d598c0943c1ec99c7562ab6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf710000000002000000000010660000000100002000000077d42c3a895460606d6b0e0d31b9e6034946e15fbe12290ff5022444c71573d7000000000e800000000200002000000030362cc60aae0c373c983d697bbeb3a4b72ff33497921650c0c60b8655f01959200000002455a2ea846fc5825de85fa3ab8a20c24c73ad7dde02b35e4b6983dc60dab4b0400000009dac2d7ade9b6fb7700fc3ed71682ec29e9a3fd9152ff4dc11eb284c8939243fc97f54187ea08b8cf96d1aea5e23903595b1658db7bc5cc2ead2d281fb260263	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
700	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
700	iexplore.exe
700	iexplore.exe
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 700 wrote to memory of 2640	700	iexplore.exe	30
PID 700 wrote to memory of 2640	700	iexplore.exe	30
PID 700 wrote to memory of 2640	700	iexplore.exe	30
PID 700 wrote to memory of 2640	700	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b16eca3a4d9c464b0a5e1f2a58d2371a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:700
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:700 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
e51817a34888bf0bed9dc911e61a85a6

SHA1
42694638274fa7e35eca6162dcdbf73a29b5747b

SHA256
ea2b43fc3e7e79e279f53388891dc3b89a730bc8dbfc90cef60c71f195d2ba53

SHA512
0aab3e34ca1a931626291dad9303c0439a88ea97d0004d94653ac91aa5b95e3d35d9f91b062f2088153030bd03e3a8c33eaa5dcf061aaa64e5db8053ba932c4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d9884a37711153c5d0e27b728076dbd

SHA1
2c7158ba9524c98e78eb14de6b03b05cfcbd5ce6

SHA256
6bd170334c455e5c60df5471a50bd618a696f6323b66de8aaad24d4ce30b60a7

SHA512
1e1146ff6c9da05008f01886f80748c1385111fba2daf7958257534e0c0a479f1643842a54b7988840727982fa28c30d1f60526961501335fb21e0b1a62f97c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00015bf8e96a2341f7301c67857df927

SHA1
9da2e105be58a577790a9830f3e960717dd9ccbb

SHA256
d07ee11b9c12d372f9777159b58b92fa9e36379df429582d21f5fa891cbcc0aa

SHA512
d2ae31d40eb2e529455d0be0ee25ad27cb270bfce9feaf982b0b0a877c4ca635490f74d46fed3f74ef7271cfa12a0cd360fb103e044fdbb593589fd326b8b52b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e92e5ccb05776865ed6599cd84e2d56

SHA1
c305eb12b198d415dae2ffd9ceff02b24d5fd097

SHA256
6c3fbd5fb7b9cd2fa6942336cb80406a3f0aed3f13636b63cc5e29eb05ea4d8d

SHA512
f19647bc7a8bc1b2fb2f28d944797f8810a0f2783784b798ccb0006a71a7d64e8a1d1c9700210dc3965f6d2d3d3e30bce3514e72c38ebcaea1d487c18639f3b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
baedf3e8a51a3791147eb4a9d50c43b9

SHA1
ea732e61c86643df0dea0fb6e8a3f979f513789c

SHA256
64aa06073f51bfba7f8d030905fcbabe2f0033119c5f5fadca20954e072b800d

SHA512
e8cd787f1c82e0c7fffff0494be247cf4fd01d0467985cf2c679566a9183a3e324ed691797867d6621e7f614f24f964a2b3ce89f761a70ed1f0cbe6f49895912

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42ac2fc6840bc5313cb7495b5f7ac58b

SHA1
03c0815952272797a206863a226e6813d386bc6e

SHA256
fc938185b50454d1f790c1cdf82067eb9fe05bc26d612447c327be7d39ec9d31

SHA512
96c6deaa2b680941061438b99573d6339c5445656329a2f12ca39272a3c4d9c186d36af87f792fbd57044181df33ac4b3af57ffae5e7d1938f23307ddb5cca0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0f7c4690583e534acf94014627719bf

SHA1
5af99ee5c3b00a4c65f4eb899a354c3db1246c76

SHA256
55ebec3314f1f755c187db31c302cb806e965c9d30fd6d3339cb15da3b768d7c

SHA512
24cdb9a84c15bc94ff762f8420fd9dbc7102046b308def3a3a437c04df0cfc569b5716e96605edce6b73b830977447739fc498b0fb70b6956ea070be8369ac9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e37f9717e0830736e589e5cb840ff21

SHA1
9e0ab44b636325c868b64f3798148f7f8e960d99

SHA256
af9cda6d7ca612df465b450c10cf9031a4ef6aff8f4b0098c16bbcc40b3a39e6

SHA512
4b177d648f2e88f2188071210b3ae358a7e8bcd24c48b02d49269d225178d11e679ee00e1ada19ae74db470d22de881a686056ffea021d68962a20bfbb91f03e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e525f65e929432e99dde996e1f7c965

SHA1
81cd1c880e8374a6174cbe2b846d8593273f77c3

SHA256
b5c4d448862f16be59bd3414dc5c3c2c5efdfa86ace938f3f935ed171b05ef40

SHA512
e52b04ecc40576095bb36781456539b264a3116a68954d33cfe7104c84c8fee7fed37e780a60b66571e798795cd77eba1c5ba817c196ebceb6a1e8b8a997b816

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
c4c2c3fc27701f948fa0f073b7484095

SHA1
1b2084777e239fa9c397e48fad121240cc2524ad

SHA256
6c99a61418753d4842453d1ab6a3786452741c49cee92055a9a5b320cacfce05

SHA512
ad82bc0741c755815f4c036612cc5553a87a3c87d8e2bf2c2f32f50e79b0f8a87d9556bff3d086f36dc2b0f7f5759133095acff9d169051d8af3e46c775a19b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB118.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB1C6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit