645cc71902b54c88d0f535eb5988148c41c78b59f4750504c14e5b5248d5a277

Analysis

max time kernel
132s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-10-2024 16:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30c04ae8ac0346e31090171f7f54f92a_JaffaCakes118.html
Size

85KB
MD5

30c04ae8ac0346e31090171f7f54f92a
SHA1

f04ffc61dd858cdf5b20d25167f3e468ff502ae8
SHA256

645cc71902b54c88d0f535eb5988148c41c78b59f4750504c14e5b5248d5a277
SHA512

3a6fca9c1278a118f044d54bdb1fbaa58b3e3c312a9c1d5825928f838d12f28cf312f0d1a81d9411fdc3f011f22519154b84145287b6f4d0d3f1714a62626cdf
SSDEEP

1536:8+ipVn1BUNqvLKvr7R/8nV9WCUHSo0mjiMpbqqvmznhKv++nPLB1V+:8BvLKvr7Rg8iyuznhKv++nTB1Y

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D4A3D541-8721-11EF-BB31-7694D31B45CA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434738351"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1800	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1800	iexplore.exe
1800	iexplore.exe
1500	IEXPLORE.EXE
1500	IEXPLORE.EXE
1500	IEXPLORE.EXE
1500	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 1500	1800	iexplore.exe	31
PID 1800 wrote to memory of 1500	1800	iexplore.exe	31
PID 1800 wrote to memory of 1500	1800	iexplore.exe	31
PID 1800 wrote to memory of 1500	1800	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\30c04ae8ac0346e31090171f7f54f92a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1800 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2874882caeb966fc6843d51b8a7a52e3

SHA1
b003ce19ea70fa41f61b3b85333d5e9f0679afd5

SHA256
bc1bf4155b0d900f03118bf30a9465b71f136c14b26d29cd239a88c948c07d7a

SHA512
aea4ed652f1c31ecb8d03866e72a833c90c0f23a6599af0c5032edcfcac93b6fccb4c50b3f9707e60f33d6d18f7468ff6265926c96447774ed11aca31fb142f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84b56309a6107ea78225a69d825d3f92

SHA1
4685eff36a1439874ef767542b097168a22f107d

SHA256
04071373dce6c8029e9ac53dbf7aaf10171840321cb8b31523dc52cdc9b10a93

SHA512
ba0d97519e0f7b77fd92c83480a2afb0432bffc72877a8e781d1d7330e2696f7c097c1e73321c37188842443644ccafeff830625cb881ffff3461a22be2135cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9513930a06d9fdf09d0b12a3d639b37a

SHA1
4f31d8bd0c829117937759daacfdf36202e0fa85

SHA256
d78d2e8d92336ed4854b2ab19d48a018d8839f95173c454d3ecfca63ec7108e0

SHA512
c741354ab44e3f80ede50149dbaf749f309e0672f87f098fd339e12612c9214522a44fb4f12ae14c7793fba2f4574764dba8db120264d90c8ffd795c0480802c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5809e893669229974cda5be5d00c4866

SHA1
8b25869ff0ff03d592ae70d4b7a75b94e5d6f728

SHA256
e1484d71818cceedb57fadc485b6b637d3d5980f14847e1733e28e88c48b41f4

SHA512
06643fd2a2bed1931212b473ebdb0cab2d1dc59ded211d7e69461806f2999f1903ea6fff7ca292fdbb06372dfdd5e9cf22187692c07f0791f146be6802f1c075

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5877142c155cd8d26f891479eaebbb1

SHA1
fb8967e8dfe2374c13fe7cf3c0deacefa3859dd3

SHA256
6a30c0f3623b52d3dbb77f047bcd7fc42754eac176a47aca366df9570cae3cc5

SHA512
d39ceddc2aa919924b0089780af57db423ffa22e6cfa039c5ab349deae3bf813a761867a6e9c69e7eb92cf6aa850bba0efb4d77d9b9a0b8de3bf0b1b8c8ca297

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0aaa902e9201b14434a2bd3582ea226

SHA1
0afb94056c5fd7dc3acc32028c925e14b3be5f97

SHA256
38abefea3708cefedcd9f09b544e9bded51ebd320bb4ca79e1325627e9b77c77

SHA512
0fb1a7a8586685e612b9dfa978f11556e908a93b07cd76b6f7702939d34b764c5e099b21964ab993423bca674f0a72302f0c556c69c7db91d8b491621566de3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d119921c577e4e7c9f6ed64434ae316e

SHA1
512c3e6bfc60d8a62b2bc56c5d9b131fe401e607

SHA256
ef6c118a0ffda2ace1304ad7a424f86a284161f932cb4b9dcd965a2d2ae0229a

SHA512
a76d5c91997806a9ce7c7fc7c1f7676617ba6b2114ff4ebba86bb673f44084c77f0e7f01cb6dd646841e8f206e2e4dc9637de533e78e1d0b356d518eb9daf5e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ccf2e5a61d522bb932efd35bd0d5106a

SHA1
58a25f1ecb654f52e43ee17ece69bf4b1818ba5d

SHA256
b859c292f8228c42b2886d44f45149bc3b8b9ce16c7eaeddb0e307cf2ee66f79

SHA512
fbcaa2d3ad23dc56d0800ed2132937cd6a01a643ae26067786d10c7bf03163ddd4d71eaa5494b934e51daafda7629121e48abc0a2d3dabc69ad12255e4c6a496

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b043975710e9a7fa82436773b55fa3d

SHA1
9b66988a907f6b47a881a2a5706450b2cccc95bb

SHA256
d20bec329881c299ccec061a122df02be53d8406d16030c11bfcbe3d30184230

SHA512
f06b91136a7be05dd7252e6eef0cf9a292837b844f6da9f7f9af5ae9fd97da8070bf19ddba988a189b84853234350d726bf811f00b5e3df0a46b80b430d82702

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD635.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD696.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit