d24e0fb2874e9aa32b42f47cc177658f103f4da09b7aeafbb18cdb3d15e0a519

Analysis

max time kernel
117s
max time network
149s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 13:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0d87304ecbade1963ee0f6c006d0f57_JaffaCakes118.html
Size

94KB
MD5

c0d87304ecbade1963ee0f6c006d0f57
SHA1

a9798c6d186ed1c8952c3eb856361f732e6a55f2
SHA256

d24e0fb2874e9aa32b42f47cc177658f103f4da09b7aeafbb18cdb3d15e0a519
SHA512

3ce1af1f3843bf42f691c6e1a7239c0e1c040d428d0b4a8b11522326b46376598cf4bce23b3646b074d7b8412a3464493ae2101b6c3875bb9fb5088f9fb8cdf4
SSDEEP

1536:WMLiNc/SFLG8fhenXAT27L10lNKfX4TVyzB4ZmlBdkrY8mgHC+qpEyW:WAiin/BdkrY8mgHC+qpEyW

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430754373"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E51C88A1-62E5-11EF-AB3C-C2666C5B6023} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000c795050246254ee8fabb097f809508ccaa938c40798ef66ea2089ad8affaebdc000000000e8000000002000020000000dbce59ce3735aa25684cb3a00c212b3f675305e96264029d5f3e080a2beb9ec520000000e053e128e6f39d27f461b1604d05eb41b60a6e20c0b90b54e47760dc39df78fb40000000f69faee735fdcb350672699a32f2bba513b3a2b4595f8bb5c3749e2f457ba5384f540c3813f04ded53149ca612b65542722fc08237ab1e36ec62f43cf70d9d61	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e03fd0c1f2f6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000a3f819898ee7d8c2cfc7341d79167e7e3b4ee5e722c23dbdd6e4925acbfd273e000000000e80000000020000200000000f3edd3fa2cc2f20e2d5070edfe6e278c60f71832e041a5508419b1e4d2cda9b90000000272a79cd2f651adca20f5b670e0492d8c0f047c0c72355a9fa33d2674989cb9b9bde85161a14a38cc0b61ac2a2810b4c6132b0546157b030e0d9113227ede7e4f4c055800ab6446a41aae28de53967c785ad35b910958e44f02fdceefacf2e23b71db854748452e32a4d2b41c18162e0c8abfa491904a6ff568e6c720df2296d8709f68b001b79b2550b89857bf2facd40000000453cd8507d6b1f8474ad9444fe5ffdade5c5d8ff1fd52ba0e4f0ea39ea793a6299bd461b6eb72aecda4e2bedfa38418fd0d8ca1e6dcf58de0770ec73f295a628	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2152	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2152	iexplore.exe
2152	iexplore.exe
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2736	2152	iexplore.exe	30
PID 2152 wrote to memory of 2736	2152	iexplore.exe	30
PID 2152 wrote to memory of 2736	2152	iexplore.exe	30
PID 2152 wrote to memory of 2736	2152	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c0d87304ecbade1963ee0f6c006d0f57_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2152 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aef4183ecc875a3d6ed0a196362d8ab0

SHA1
fd36f7a030f0e42585de535d274ef88c12b8a0fc

SHA256
75ee5c12beb5fe5b567c79c11f2f04779d21c2bddcb522e33f43600b5d69f4bf

SHA512
71ed4f5fb8ab63e44e03fffcdede69e77d2baeb4df23bde94cd698e6645769203f87271a13bcb4491b2a3407755faf6400f7bc6ea35a971232a137f701e25532

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24fe6f98c8c1a65985769631195f7af2

SHA1
1eaf1828ef08196dba17e4985aadf49584642711

SHA256
c2e87c67a739e4dc3582a4857b1e74aacd4c954a2b729ecc967ed9c1b690d697

SHA512
0bd196a67e773d8261bf944169f54e4114efd97b560a7e94f5adef9cc1e773c22968254bbaa9695471d26cd5d337f1b18497f531eee3032fff1b0ac681a70134

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebc77405bc703689ada217fcc83aee25

SHA1
33c88b4a80ed75a3f411416744c8937bc71ce4c5

SHA256
4d29272568a53fbec1e35046f42fe072ca5fd784cea2300134733f2ba88ad142

SHA512
cd3d46c299cb214ac8a78f526e1b596af3186011c4224526b5e70889669b3fe029c1c2af81f0f61d09b396605e64e86f3d1154296105f962693a711be5712ffb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9245a0fc409af89aa6cadc0c2dc03201

SHA1
08b26988ec53e0b99d3d45b223b37f66c938599d

SHA256
4690c5a5252e9f7f5f6f3248b1ec358a78b78f8550cc5662bbfb4f999cefd771

SHA512
4494ae203f48a0c8098d2403d87da22870ad435c8e28969d18cda2cf39e4c0590d3d86d5350bff6b7d06f3d70e9d1e38be6a852d0739d6f8f488652352b068f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e455cacdff18e3fd0f8defde07a44b5

SHA1
b386a879e63dcada33eef78a5514707ac6323fef

SHA256
bcf1c6c378074f0040772c6d8619b73c635abbccee6610f3ea4257d56591cb55

SHA512
92e1eb653bc2fa38b6eb02a501df14362a2752d6639778b5f22267e425c039227ed5982e917f931f72bcd735ee21cdbd18b285c02023c36a6efb5fb4db2b9989

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3dd48d930ab8686e86461bbc2c6e9b84

SHA1
bc9b2fc59af4c48ea3dd0a4c10bbdfd7dfb1f012

SHA256
16af55b58065b5e6831bdd39312a58f5a34a040b84ce5617c266bc08795ebb34

SHA512
6d1923158b007fda6233e230cda278061f7926aba20695f99957e11e4cf521c7007b7509c9302549e86e36a6741ccb39ef93c8cf7ac8894716c3db3dff8fa01c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c26decf0607880a98aadc98057953b5

SHA1
341e60e3964eb46fc16429a1ae91950c6108a41a

SHA256
2e2267aa8f63246ef1d014b2120c68caeed6a9a54b05c6cdc3aee820375ed8ff

SHA512
e84a46f0c0e942afafcd1d7374667663d525526d13d3d8d662fe7b7f821ec2983b0b59613548de43f5830e17047471dc7885ec3837aab1ca41250349e459bae1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
027970d01b4a73bdb18a953490a0ff24

SHA1
0668fcd395ad37dfa9c42538fb3bfdf67c2a6a69

SHA256
bc722017db5754833dc6d96d0401a36e2d81754d62b51550166db1ab10a6d933

SHA512
8bc92f1772a244d814f777486edf646c67a0580176906cbb4f553f4084d2cab8043a7e7cb0363290cdee9d4e418385229cbbec085ac5a99148ce4ca8620f0108

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WNZH54VQ\wpml-language-switcher[1].htm

Filesize
162B

MD5
4f8e702cc244ec5d4de32740c0ecbd97

SHA1
3adb1f02d5b6054de0046e367c1d687b6cdf7aff

SHA256
9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

SHA512
21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8568.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar89AF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit