326c322cfb49f2a52837ddee909d1302fd35df53bb371f878f18f0bf40459a8d

Analysis

max time kernel
141s
max time network
144s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
25-08-2024 13:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0d45dbc75924584b832f79a1ea0dc6b_JaffaCakes118.html
Size

218KB
MD5

c0d45dbc75924584b832f79a1ea0dc6b
SHA1

e5743ff9cdaf31dfddf9bcdca47883e31fb4d8f4
SHA256

326c322cfb49f2a52837ddee909d1302fd35df53bb371f878f18f0bf40459a8d
SHA512

658438eb5d5d1a4d806a76033555bee176bf9a65d7315c8b27ef8cb0f16aa48b6ff7d17e42bfbf1420d4c9935c3b8f84348e1821034dfd88a9c46a5e86c9329d
SSDEEP

3072:SjbfzbNnaI/NzRZuyfkMY+BES09JXAnyrZalI+YQ:SffzbtaI/NFZLsMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb90000000002000000000010660000000100002000000084d9cc6c9ebd664c0c0889396e1b04f0826c7afa20f5b87443de280c5c46154a000000000e800000000200002000000066eae4a5cef7cc7a65816a742dbb0461afe8cf7c32d351d458ad8c2a4867167120000000d1ec60ac7688c872889c2eee890c07ee965f238a270a6e127608ba6efbf5a3dd40000000506ec38dd56272c6ae691bcbe7acd1c8d55bd072e7eb0bd9cd62e682a159fbd6d26961b67afdcd409563dcb5f3b12f80e0a4dd6ca7ce09acca574db504f09269	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0eca4cdf1f6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B6EC6551-62E4-11EF-B856-666B6675A85F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430753864"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb90000000002000000000010660000000100002000000085f0a4f7c92fe02b869ef8b37923e69a03aba9a1d6bc7fa0124db180300dabf5000000000e800000000200002000000022f1d9fd211f3d2fbbb4d282404d1720e4841aacb31f0f1fd1e8b6ec626da0ee900000004c09671d3551d10c8fb1464383a2b91b58a1c1b9a992ae8d69ac140e1e1a355829bc38f86014a1ec833307809cd9274b6341784031bb9661c07690a2119cd0fd977eadfc16208282f5c6f691610774c544a734c9cf615be96a765385c3b00c2e4fbb85b920802b0966bee0e840c2785fc265a3310367b8d121bae8f39d8294204af850791c0e1ccce0691500e206f48340000000b4ef6b4d0e9dadb7cc7e9aa48a6865f41f358f15ae14c6b665b243f5d5f748a165e867974515c0dac7809d97006b982f9374ed005356d46bdf490f054745f9b4	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2380	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2380	iexplore.exe
2380	iexplore.exe
1376	IEXPLORE.EXE
1376	IEXPLORE.EXE
1376	IEXPLORE.EXE
1376	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 1376	2380	iexplore.exe	29
PID 2380 wrote to memory of 1376	2380	iexplore.exe	29
PID 2380 wrote to memory of 1376	2380	iexplore.exe	29
PID 2380 wrote to memory of 1376	2380	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c0d45dbc75924584b832f79a1ea0dc6b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2380 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75c1de43a8cfdbcff2ce484818ed8c39

SHA1
fca354b6261704cb22e91581263828c96194191b

SHA256
8b1c5b232c1bc0de348b3197559ec3d279503cb624c7925a6c8acd849920ce6b

SHA512
dfb4047c573c3e359582758b11ceebba5de800e1d8a3937d55f868ca333f684621ce07220a9d77f292e3680fef2ed55fbb60a8e4ba2673b2398fa1f4dd593b33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2d95df4b529e9ab6f0870924954c5c0

SHA1
d015455c2dd655bf4abe0d8170dd8fee87610cc7

SHA256
13e398cba678640b0baf495c2a33ca8b0813fbf8b82e1df60be1443bb9197964

SHA512
c14bf06effb9c95af50ff26f68c45e166f6eca3108ba839db941b3667b9160051360fc968f53e2f00f92d5c0467c2d282c4a3a5d66f22fae202b15b050f824e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59c757d143a3299dddf5b7334458205c

SHA1
414d60e8949801585d0bebf8b776e42e1af70853

SHA256
2d72f1e73c5e0a1e82bd48e0f5dd0cfaceba98706481697d179f95654911b92c

SHA512
9afabbb677433b938471d5db651c1d0f3707eb266bf6c7523764dc913c9f2f6d6bf07a5eeb3b0a1f44ed4ac9a7b1f2b8a534de77d27526d7771a15fa484979a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9385ecae357afe88e2eb197126a35c8

SHA1
94c151f6e7bfe9d0a08477059039490dd9ab20d5

SHA256
b367e922dd521f300495d94d71d1b95f14ce6cda4ab7475e9c8fa5fa6c463c9d

SHA512
2c8d2bd3f3fbffcfbd61a84d90297f5f15bc409e39ee8cb28f50c0f285091b41cd44dde7d656d6b96d7493599fe77f741ecd19acd209e58cecc7aecd295f6b68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31a2da17ec9ae81fe9aca9da2c8bad63

SHA1
a4ea260524506ead34bbcf42b9e4afabceda509a

SHA256
791eb14a84defd397b03335031137d7ba4d3aba915936e76ae4e4bdf66f9465a

SHA512
f57930cd37efe912405fcf4c2b8b49962129999f0f1b02dd280771f4465bd36ecf444fb8257d5b904d67f746c2979a8723a41cc609a776aa23ccfc29a56df386

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0adf665f3a5142b254160e6174ffffd2

SHA1
f418aadbfa0f500235d2176349d4ecd084bd2b2f

SHA256
f0d7d79a25824727458cb1f612d5135224185ca4f7bf60ac2122961197024de7

SHA512
cb135757a0d2cdb18cb84d1e30fe141640fb5378149cbe12fd11187f57df02d07b1fa8b1df5465b92247c78b5539c5093eaad362e589c180637bb5eea8df36e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9f0c65137b564acf72fa1e654c3c7db

SHA1
53ca22a9f558d76d1ff96b14a04799ac191a4b60

SHA256
295902793088b294b75fe85ed1e69a9146b60c74c5992d7fdf3d9c5be69131db

SHA512
ecf6d46c8ced948b4803f4260206764f2ba8c586503559b7ba6b589e34a49ac3e0228fb7c95585d9305d7a9bb68eb5f1eb1ff88724602ce42b3b61ca134447d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dade25f9b1986fd59e41450016b6a775

SHA1
284393a2dcc327df9cee948ca264a856096130e3

SHA256
80616a7ec5a5185385a638a8e42ef6f96d047fd98d92dee97db50f528fd04104

SHA512
80ae7173d04a3cc7d9c60396ed04af57f7edb0448a5b5830d90f8d8b5c36174623e81941f3af15ccde268370b0e9de8719b56a088d7fdc6b97c2cbc6da3091de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbf0744257bc3e0bcf5ceac55bf8e00c

SHA1
b02bf4853a1373c08194035ed567bcf8b137f205

SHA256
2933bba6627bb3ed553e03bfffe03712ad46216e474608505c70caed21db2588

SHA512
36be927f12bf0b859418188ea3fe63d8874e9b92d58c865bf7b207f37e8d633acb7b1217b2ad26dc7d9bc09f585a62150b2ee8fbe96a24dcde8d20df5e73f336

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
851fb462500550408b985f534eaafbd2

SHA1
2e460582f05aeed96867d6ee59c5e7eec3ce2088

SHA256
f9e96ce470f5c1eaf80e23b0f4015802e5f9d3c686f33637a18121bf69ec1d0c

SHA512
c66d78a515ab56a66feb36b4be7688d0bbcb5a223cfede192b469686992308f8463ed37c0363667d4a4055f81cbab1dfc5bde5171f87bf2d674b25e1e9a8d2f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
edc0f820acc9f829beb5ebd7848afe93

SHA1
2282882de8f80f27ba941dcce503751e5d4d5adf

SHA256
e9b6c01e2e789bd51cccc5287b627df20473bf9a7f655a2e06ee0855db796af8

SHA512
bd46ccdd1f4f490bcaa257f59d2fa93523d45785e4690ccff806750269a2ea9e12f74d5747b07fc51387868b0545effb7ee1c0c3bf926cc3ba74708ee5c333af

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE938.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEB5D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit