4feb46ada1c5181ebb2fd03a2c7e9ddb3f50e83e6219cb3545eded79e030e6de

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-01-2025 09:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_e298b1f7e379ffa8708be430ffd9ebee.html
Size

7KB
MD5

e298b1f7e379ffa8708be430ffd9ebee
SHA1

12f4535fca981d83ddf25d2c4952944d05efa1c5
SHA256

4feb46ada1c5181ebb2fd03a2c7e9ddb3f50e83e6219cb3545eded79e030e6de
SHA512

9ee70f249fc2570c29cf67e595015120cab1b190e466a2db1d1536d691622b24e959128b199684fb77df05c1255867c5e9a90a829b4661f392cb8bb075de1f50
SSDEEP

96:uzVs+ux75/LLY1k9o84d12ef7CSTUyzf+Ch92UccEZ7ru7f:csz75/AYS/0jb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001aebe2d1d84e86488646426025bb50b00000000002000000000010660000000100002000000053b8a9d0d5abcda65df0265fc600e581eccdeb96163544c97cfb36f72255df93000000000e8000000002000020000000d0f11da22dc11aff31fd75e64349d86f153ff3db3569d33a7430665d2cd110b720000000e0e8a85708349414dd43f0cb09872773b9caa175e5e2676c6c1903570479b5bb4000000076aabe5df9993854ea82d31ae521477674deb303f992a80310c5381bb52c01cf761ee87570fb283479cb1fceb1638d57233f5619530b77749a768a22e06dbe98	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7D410D81-D70E-11EF-9917-D686196AC2C0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001aebe2d1d84e86488646426025bb50b000000000020000000000106600000001000020000000e92c5b272569b2b4a038b4fbe3fcda5545995d40ca5948f8d7a534e9b8acf906000000000e80000000020000200000006d42310cad87df6c8b0abd6b6311db3a73686130f2507b4df9cd417b33f2c87290000000fe10c5b661c92bba210540a578ab5d4e3b3f3b729b1db0f4ac46ea61ccc0a4c21af82fed971bdcd0597ad419428ca122a95285f5e30188756c9faf204e68dc3c7dbdbe20f8a81129ea25be09cd52ab6c939ebe2fab6b43c06d2eec1c34daa02fd3559c965a26f3f2167eadac2a9edb8e67002980f8d7e2da26056ecfb53d6b83a4c413c12918d202b9adc1fd7795e25440000000641da837621b19dbe8468adb1ad004bfc9c2f1008e99138f27aee8ee13b1b87ab6fddb7577865ed27c3ead09bf22a24d3a26a4eba97efd681c7ab01bd939003a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 001247521b6bdb01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "443526137"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2716	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2716	iexplore.exe
2716	iexplore.exe
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE
2284	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 2284	2716	iexplore.exe	30
PID 2716 wrote to memory of 2284	2716	iexplore.exe	30
PID 2716 wrote to memory of 2284	2716	iexplore.exe	30
PID 2716 wrote to memory of 2284	2716	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e298b1f7e379ffa8708be430ffd9ebee.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2716 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a3177f930efb43489e85e888d201154

SHA1
f10f6efdd06e01064857aefeb29f046c689c5d5c

SHA256
45f59b9d9d7414d6ca3b5df799e5164d0ed51efd2b04b255daebb3aa9e83a866

SHA512
2ff65bc66db9ee746c6779b05475f993d8353b7312cd05a1054fec850ce681510037a845c561438bd9557061a2b6d6c9b795082c82a70ca46f873958d7260c53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
545165641784e3f4c780d6a38fc34ee5

SHA1
e1c344c88601cf889f8febf7e34daf475e668894

SHA256
6d05a4369dac2071b64be3385eb77c302ac86ca57e3de93951bb278664bc5ce7

SHA512
8ffad3142ec337e1082b97befb06116f7b235ea7e9b24d79baf9999b734c7ba519b55dc736c8dd70d3c3865437c928f55814204e48905afaee2fbd3a0134a4c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ffa3c5087afba888732ce077d5684da2

SHA1
e9730503fa838d500c160942bab8b442a56e205a

SHA256
d39be593ac7dd3d6ad92ef6e1ac51ec321ba1799856fd1a96b43cb99eb54a926

SHA512
f70c15d4b42079c9157334929e2f53392abae1b7704a529d1ca81b6276734903fca913ccd1201e2cce0d0db2fc9d3e027170f7a4ee934f858a14142b14f98438

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2717fb28445152f83f7dabf82adb69d

SHA1
32c741f72298d5a0727d59733223475a146ecfcd

SHA256
fabadef1a1511dc848e24612e61c85ccbf7d3a639b1ea2d3dbd6351cbc2c5c76

SHA512
06ebaa8a4bf2d4823a3ef635f74e7d9f75dd7880185a944c8bcd7156f6acc937a701e15976b81e544cfe2e0afdeb597dcff92b3ded15807d7d5de150dab58209

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
190e77f4626508d5c2719187f86f4059

SHA1
add2f685242123ca14abe293cd2e08f36fb408f4

SHA256
4f00f7c570b8ff515e1e4668d920b9366eca1573596a0090a5adb6cea16c3dd8

SHA512
67206feb6999f274f1ccfb7bd3192701eb80b6e0662730454f716a9d0dd9ea3e1d6d935e96ba6a9869dc9766872cd40bc9db57485a87f50a52b0b1307b6b44f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a59094885c52eeddb92873c2ee058a8d

SHA1
c069e91277968a974b198631c048ef38c54b1f30

SHA256
39ee805f96b6e6e08d1b6d722d6f6cefcde5391ec44f81d2bd89a5c04623cb64

SHA512
381c87b0a8377b59de785c063ea1230406845c364c626b56f60a4ca55a886e91003922f2342395dae40fcc244885425fd4829fcea0959b43caed958cb6b65cd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08d966a435a075276e1ea0c382260bf4

SHA1
44db6dd29362e8d2c0da2d0c217c1c2e6498d896

SHA256
c795b4d21c3c94adec39592b37a61baa910a15a7292f15a39f15adec048b5ffa

SHA512
4240a9f432fb19147e80f2ac45b8a597f2cbb137456e7e329f2167dd7aa2d2cd88f0069939e74a050e9392398f71d362fbdcb9d0d4035cf42ceb1de9ac74f518

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c60cf24a8b86dde379e25922c61fc01c

SHA1
46468bff92627c03b6314a4a62a47aa3e1bdd4f9

SHA256
3cd914f9d0c69337b00951b65fa2a865e40e441371da451970fb56f3217518bc

SHA512
c6faa13febafa942c4d0b74bca01e9984eab93c13fcc991a5bf27831ebec145fac9eb277def1d042ed1667297b5de1ba80bcf647955516ef9ad5d7de373f6093

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e439f040e38007c6ef1cedde6a7809a5

SHA1
e683d142eba394e82738fffc6a0e91aff300ee00

SHA256
d22d92da475e86880f013c0db42bdc5e779fe98862f48d9b77e2da40d9309d2c

SHA512
e552467f917f53301341f70bdf8b11dbd6f1e07920afeb6516cf40dd5ba2f1a27dca3db76daee029804c1fcf8c6a5eabe39bb1032ae65ba2ceeed2acd0f05271

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc7ae60208cb29fd0716f12158c6e4fb

SHA1
a19d9355461442db6fd71a59426ab608720db572

SHA256
91cb8b0ed0fe4471097ac42ebedc27182e4f5d79f88124c41126d1a5227726d7

SHA512
a7205c41978748bb7df84b2877f567ba2bc150f95f65cafdd1c178d8c3fb8e35a1dea3d83c88859381262d25efc7220496cb7bb91a59130d30b835bad79ea29a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c6ecffa54d9de90ef66f48012c3dd1d

SHA1
9186bf6b5445ff95c8a361a30bd63bcf3fa0a18e

SHA256
ae9ffa921c86053b1ece120a5201b0cf41361856d53ac288039c73fd8ad4751b

SHA512
c2cd199333ea5cd9f6b8ea3fbe20c7d2dadc27d315d23b8e323d6ba8cf2a08b6d3dc3b67b1b69c2a722c8d572472486fe82c4f1abfec970bc694bd0369bfa83a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9479713a014e0f7e31871c0613f10a9

SHA1
32bc7e8e0fbebbb559933800af221419e99022f9

SHA256
9b1bdba560a64699b03f117cf0ca9649d17d53e5ee7f5b834414174f51a27da9

SHA512
2cff22b01f5fa9c66e447e277604565cadb960150f2740b94c102901365bf0dbcd711291362fe4077b532ebe60feddf46ffa63282b062e79b3e168fab7a4a93d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5624067d7dec97c464f4ad59911453f

SHA1
d815716e7029acd1c3ccc52fe818aa2fe380e63e

SHA256
59d53868de6f895f55c13a416877c1f097e880558afe6763ca842abba01f120e

SHA512
46d1c978d5a6f4aa8b13107d720e4225064bc7e61a7760eb189e2068c1f5d17b5a139ba3c778ecf91a6e54d3529260e35beacba7627d6cdfde836c992b8718f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94d853425ec528a66eeabd0acef48f02

SHA1
322d7d7f2f18bd2b7155cf1f367ab76eac2fa8ac

SHA256
c5b87607e992a53e774041ca6c588b6f7e7ba3db3f3e6fe605104fc67a3738d5

SHA512
954247e979f91189233f63dcc1e9b91ca567c571e2137365d88bf6aa81922ecd2b05a1b690f19d7966ee2dd33bba1a6bd8b085165c429673ff1f30ed4fb08f56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88bb84037401b7ce847661f828a74f04

SHA1
b2bc23a3d8b215d09d32fa254f2426e151c998ba

SHA256
fec9b40d40185ed037c22efb82cb05a9c829bcdbc305c022538c268f79deebcf

SHA512
3948fafd7aea4cb860dea0a5681e54e0e63045c225e768f005347a43a6ea5f716866585535c7c99c31bdc77c94d21a17b8ef20a94fbfb33a0593e648a11ba663

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f225193d60aae3e4256ddb2e71bff5eb

SHA1
a51bc7f2371dea916b69e3a5581f8af502b181b6

SHA256
ff99de8393e1bb19d93807e9858abd371fae021d4674c1bef3484d74c6a3e6c2

SHA512
9ae2a11e1ecfddd0f187172a817a150cb10355184ed4b28f44d4e41e782fe59a51cb9dfbac112127022b616435f1019af6a21db91992e99f30435e687d81427b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8DA2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8E41.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit