f9be6a0fbbb0c9ab062604e024d78646bf44d9761afe96a931d24c2984a92a74

Analysis

max time kernel
119s
max time network
136s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 19:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c16e8672fd8cb5ec9765538d8b8216af_JaffaCakes118.html
Size

17KB
MD5

c16e8672fd8cb5ec9765538d8b8216af
SHA1

9c0ca6485be3e5f71bf02b530ab3df638b2bfb09
SHA256

f9be6a0fbbb0c9ab062604e024d78646bf44d9761afe96a931d24c2984a92a74
SHA512

96abb5f7c87aa93fc385eab84e20318b79881aa83446412ea32962cf2388069165a797fb9d9a5c1baf54e2cf1520161e02bf466b7be158af1030418c7d2efe93
SSDEEP

384:WR2Gl+CWDI6ogNCCbixl0tkjYqF0FibkjJOodzANF7hX0z/SSeBgKZo:pM+Ts2eSteYfibkjJJaNFNX91gKZo

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000914bae02451f72c6d6cc6bf0800ff4a94de6151741ee459de6025ea913162ecc000000000e80000000020000200000005a3aae1aea853e1b26b10dd46f5c5a05873c2d68169ff8d0bb165769571c2163200000004c8fc855a57859ce3eda116adfdcbf9092bd2ee91ab0c5777280aedd6961b68540000000afb36b9864806482b5388f97be796d2def8145819b7b54b224811959f4f222bd9ba6aa69f719b77dd55d6c4087c7a71857d7b1f2e918e9d6a2c42bb16bb608a4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430776503"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e01f9b6a26f7da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000d4bcdc861c6e1d454a8fb563925b0267ef4b80b2eed2a993134b6bbaa7d7fa23000000000e800000000200002000000083bed0f126c826ab79dd1043be5807c24c74efca17f32b9e9167d06e7f0a255e900000007c2ed36f01026443a41db057b3e90df10b02b00d82dad10bb7e3a6d85d90b06352afcadedffaf398ce2f969760956c8ea90be26d806c048e46c41ed78c9b1d0a434cb9367ec7d2be68c84b908a0739135a81dc30a3544024929c3bcb112f5505d83a64a6ea226fbdb87914fb6603b96a7b4c4f84043dd0b697631ac2c03862e329fc3da430cbf50bf121907ab638c1b84000000019bf535c2f4e17bc580a91de6b7ab92daf49f937542af48fe21106809ebd4bb93ec7d464f2c1b9882051f40a47d0c2677a50fa624b2f4598ac7e5bd06f536a69	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6E048951-6319-11EF-9982-6A2ECC9B5790} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2700	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2700	iexplore.exe
2700	iexplore.exe
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2716	2700	iexplore.exe	30
PID 2700 wrote to memory of 2716	2700	iexplore.exe	30
PID 2700 wrote to memory of 2716	2700	iexplore.exe	30
PID 2700 wrote to memory of 2716	2700	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c16e8672fd8cb5ec9765538d8b8216af_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2700 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b023e3eb338f75ec9f7c239dab93d93

SHA1
96f1e25685112d1621c3b91f91583c5b72f38f31

SHA256
ddde856d2fa471887280a6a02f5a60908694b957bc3cefca6cd6de07226162b7

SHA512
0f335abb28728f7acc9c8837a73c616b87deda395cc65ecfe51a64daf940cf346e8296f8144f167b54eaadcf4cc302ea7d4f403fc572e62090d211d866bb140d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f16e4d29413b796eff3f52932ac235d9

SHA1
4be7be1d832fb454646da828494d79e3fc0980b9

SHA256
27520feee592464b37f3bd35c5028ae57ce52ef3cb351e03e00891ccc8878a3e

SHA512
05d013618b580d5175b6238176bbd556aec44358e88648f9cbe2e19fba83f3f5d4ab8c1c7642c4cb7897d908a3dfde5d729fd5dd35f374f0adb0b2ecfe08867e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e41dc47399f1f62d2c0fc1bc8e78e29

SHA1
1950a7ec83efbb02e76f553b806e976b32052e39

SHA256
cf95233236d806064ee04fb80faf09b100b4813843ab252add58052781aad001

SHA512
334cec735c1c56f7f0e33299a01279e3b5fabeed83a38c99ea1030dc958a2da2a39e9ef940003109e05970e2ded81511baf559a2ea0abb54c2f1895d7b1082b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f23b6173190aaf3fe14666742fba6ccf

SHA1
ae1bc3dcb70bc6239a4cc398ea712d8e2d38af3c

SHA256
bd59eec1ee8672076624c276e3060ea99d373bc94027388a4b912cde87b3d03e

SHA512
1be3f479abfc829091f2798b2fde27028976c8abf9f9e224231e89343eb85fba71a5474f8d0b5908f5efd75bc7223694f24adc524a5e92999987380acf161cfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f47345a56dc1da39e20109a69b8a113

SHA1
7247192304a02a4f4b3e77625ab6611ad35e3f3b

SHA256
4563b0c99870e17a058d51d4ab7c2c888df319c40f921c0db256b65e768244c6

SHA512
118f4e83fd329becbd6ef746f16f37e6796d9de9499d2f307d945c3432526c4ed9b3c99b79c77ab650038250830bd10a2ffaf8acb33f3d3206b7435735311a4e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a224572606ba118a5f4ff91437145e0b

SHA1
5e818fd1ac1b74cea834c911b305e942dc308630

SHA256
2b8fe40d98b55fcb6c66a203dc95bd808aa5fb76842e05ad8284750adbb36198

SHA512
ea3659f7b97cf419d766e72132905c215cb1136bff826c3ab7e95170bdd7b8c22cceab452b5cb3d138d4681e5a9cfbd4868572680031ec1399207d739920bf80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41946adbf230d1212761d75f937bb0d6

SHA1
4629cb3432e606298198b63a4054bdc479bf9559

SHA256
6ce7c7e0e8c49605ccacedce99032c00bce2aa3530d288cd761fd881e8bc432f

SHA512
3469fa58e426bdae4e7bda7d81fc73aa4470bc7234c6497e5a8bfa56207860a97d40f7131b6795d11a9663e9d92ca0b8f16dbc6a21beafc2002174a79d8ee12f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82a6edff0af2cb9ab183035faaabd0bf

SHA1
1457d12a6079d3ac3d178b43b99dccb0fc5b5175

SHA256
6f7ea131b7ba635c2b20b55ac2e6a5fa71d252bc5ffe6240a8443b93936280ec

SHA512
a9e64a18121b4ef8b7068ea289c071a13657c1bd2fda8413ae2cec290a3200d6bb24bfe2640ca900feb2c5c4b929a1501b2329bd8f3ae164ecff55cd0a209794

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
007a5e37ab98a29c87cbde1b96d7c0e3

SHA1
62f152e967b368b58de3e7b259ff484353c5667a

SHA256
6e39123d90efead5b791d430a5bd535ee2a7422392cbc12bce06cb14193e5565

SHA512
ef748943ffa0cee2d22d992c9f52105e9a1a0270d343211c906e7e22973787c7da4d249e8d5f01f106efa842278b2df774c8ff4b3f3894991d9d5c7194789878

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7daa3b0a16bda572aeb20a36ea1997d8

SHA1
d10f30b2200dacd5e5a6da9283cad8f0bae4f3fb

SHA256
51848634c4d919442e3e3f09e5e6c8d854f9cd90bebdbee4b320dae9e1d6cea5

SHA512
70e3410cca52a51c5f59056dedd0930b26df4220065e03e16b0c5ab2aa1bb194a7414feee766246546b7b8caf79f56fc9ad30208e6536d85d2381ed9a3833fbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0471130709e1fb7d89da0e9841f4c9a8

SHA1
89c6a4ff39122ed9c2e891e4d1d696629aa4e6b1

SHA256
5917735beab4e7f5a8db00d69414bd06e98aaed325438619cfe5697e80fa0f0c

SHA512
0610cb0a8615026e0d1f073eca78db2b4f0eb2205faf1f300dcced1999220492a43fdf2fc8d68abd133d5eaefa04c263cca293dee2c5a50de5599312da3fe9e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
926d3b5e2a3e1fa4e49effab664abdcb

SHA1
e8f4abdbe3992722a02c67a561b729d60a5400ff

SHA256
2f660258eefbcdbaba50e12b2805fcc9fb078d63f77f7f5b9c238cfdbb0cfb2b

SHA512
f122b2362f32a092d771436d46668437089e37f76975e8c9366fa6d659e56fd8a93971b3672b352a914f6093305244073bb4054cb4f026eb31e243b8a01b17cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab34E8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3587.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit