4c4637b7f46e07e404c3d701e9c740365a8b88fd51be35e5518a33c703b840c3

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20/01/2025, 09:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_e2cf40767866a6cba842bcf2a7a3ac6b.html
Size

29KB
MD5

e2cf40767866a6cba842bcf2a7a3ac6b
SHA1

01ac2d472bb8faa81c07aca79445561308cc272a
SHA256

4c4637b7f46e07e404c3d701e9c740365a8b88fd51be35e5518a33c703b840c3
SHA512

4d843faf1fdee61a409130a29a7d62866572a9fa873f10385d646a4a9e2e7b19fdccb56b321548984e356f900d8272e2aa644bf284d40b2fd14d5a9587ba35e5
SSDEEP

384:SIxOJmLnrvr+fZUZz3qX38FPMNkV1XPWMTgnEZ:S8OJOnbrwU13qXMFftWM88

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "443526721"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D960FCA1-D70F-11EF-B699-EE9D5ADBD8E3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1196	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1196	iexplore.exe
1196	iexplore.exe
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 2124	1196	iexplore.exe	30
PID 1196 wrote to memory of 2124	1196	iexplore.exe	30
PID 1196 wrote to memory of 2124	1196	iexplore.exe	30
PID 1196 wrote to memory of 2124	1196	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_e2cf40767866a6cba842bcf2a7a3ac6b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1196 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
1KB

MD5
c9be626e9715952e9b70f92f912b9787

SHA1
aa2e946d9ad9027172d0d321917942b7562d6abe

SHA256
c13e8d22800c200915f87f71c31185053e4e60ca25de2e41e160e09cd2d815d4

SHA512
7581b7c593785380e9db3ae760af85c1a889f607a3cd2aa5a2695a0e5a0fe8ee751578e88f7d8c997faeda804e2fc2655d859bee2832eace526ed4379edaa3f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

Filesize
436B

MD5
971c514f84bba0785f80aa1c23edfd79

SHA1
732acea710a87530c6b08ecdf32a110d254a54c8

SHA256
f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

SHA512
43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
e8ef322db088315b51f016366f08f21f

SHA1
e70e2dd2e984c9959a203374a47a8a87acf85f2c

SHA256
ccb5fed589647c062c2fea0eaf31e68ac8e29f7a705943b5b97b34616812caa4

SHA512
6d697ea374b0274dfb41ae04e8ef28ece292149dd9756f7cdfe365f4b7b9511f1e0287931e132a1b23e347c84629d7e95060392e7a94610608cfbdac5b66bb5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
174B

MD5
3fcc25d081006dbf487d76722452bad8

SHA1
c9b39a2d7af4a62ab7f392456db7d5100e629eb5

SHA256
0c3709d0f6cc44aec41b2f03a11decdb1eec91021344d124ba635d98c5e526a2

SHA512
2bf145168bd52f39e680da47076838cb1655491dfb86575de837b1f93aa350c3b204f7356df0a5efadc9e265ae838c495c63c4f651a224d4a3792299471f864e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

Filesize
174B

MD5
20945973232f335a564e831164ced9bd

SHA1
104b452da03c1b3fd82de249edfabd63cee55b43

SHA256
db0d4a17d45c252d2f8edc880969a5bcdc066b2ec2d2d33dc0acac9bfd8f6a75

SHA512
1e075c1f64a5f280c01cd39f18af62d47980dfada1be7ae3b23962e6b913f8579922ce1ff16f9869071688749760e22114716110a7bcea017be2da749d8cdb23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6e15eb3807e530f688cc47b5dec80d5

SHA1
fa81da49169e0b03d0967892cb0572dee54a86bd

SHA256
c4217294d6e3ca95d14f939c02be729594494bbfd11a9b21034bdbb664ea7357

SHA512
b1416d99f246786b342b120ad2059556fc79c298334d7d12cd99f3c2aff1b04f2f2c329da209012e2d3bcb449cbbc20d7fe569a039b550f0d78b9aaf09f0933b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c189f6d8ddeb294b1c93ad640b943b21

SHA1
efd9fa45491acbe69e75cf647c8e9ecec3f5bf71

SHA256
d2040f633f837e00ee1ad3b46d2c6ec8a25446cb00b7068ddc39444986d941b1

SHA512
c222dee075c3ea406e646cb7ace93be2a168dc62e8b76ea873b764c625d3255f66debe89fc858aefb7d19bb16f53190533b3826c6e371723edb8a55f8f06337c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5bc9db509881616bc8b86ef823ac6c99

SHA1
a876dce13bffbcf49a722064e11c15899474c425

SHA256
3f4d37a6c0c985e902b533800e671d946c144b9e4f746154f6f4597ed76af2ef

SHA512
2b0769bd62b10065aa16d8a35ba06d9331a892e2231a8ffbecdd0915f4d3dde62ef87e8fcdb95fa96e55eef059847609802370ca90822573a6a130ffc77761f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1781a7dd524172ae1101109f32c8cfa6

SHA1
01b77da64a2ca031b4c868a8a20ef0abff5c4b43

SHA256
629ed5c102ae2da448a963b206ca4fdb40ce5f1b4783931bb8d421ae69bb01de

SHA512
999593a3811009a89d077b289dda05315c37b0f2292e2c35bd2324bb5978896572ebbd30694965a77221de551b9f55caee41ed9606ed380097d7bc5bb558e10c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e4bcfd9122b98037b8bd1f5fb0b698f

SHA1
5f7b0a37bd3911dfa4fb85554c8e3150f1922afb

SHA256
1f5f2a5c6f67494242aefc7fd75b75d3224a16cdaf41a17c9ebc68afa1b7072d

SHA512
c538797dbec6daac475679a7344e4453aecb44035edee9d1f0ccbfaaceddcbead92ef8fa8aa47747d58727b3b0f102cdf04a38254fee84bbaff28c1fb3c3bbb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05f1d501cf83e5691faead03935f21b6

SHA1
794ab254ebb4b1d55185b7d597b14aa58c4a6969

SHA256
21347914d343653e7cb2295a606052ea552a3c51f8f922f81e6508fd7a7afd77

SHA512
3a632c9795c6221dca7acb59b4bc7f5d05bf98861e083cc1706334b31f7687de3168a8945b457cfeadea0bd1c3485575861deb37373cb09687f0791b92f5be28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bcee1c344e585d9595a0b454fd982a2f

SHA1
aa878c8a696a5259a300e9a853c9bee24dd06986

SHA256
5f0b94a4b5c7e6882afacb2627ff244d3a51aff5af66df570aad10a67ea13298

SHA512
e3cb40a4a1778025024d991ef3b638c2ecc60a804e28703b89872c28aec49f1e6e9e79ebc0daa2492ff93ac8b28d4742766f4ad8f39fb7131a9700e3b4b6affd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
959638e661fbba5cbe82c90f31c6130f

SHA1
31af1a7f2c70c1281c1fa51ff2a354d3cc70ca6e

SHA256
16e8c0c8a147e34222f66b7ce54d783066f0225035696c71e384bd3c84e21e04

SHA512
666c2717c546941dfa495d6ed867f95805bfb4ce2839491c38c5d22ba3434347f1d71ad924926e9956c7c37c622443a9d5392996fcc2435907cde6506dbeb337

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be5a112cf8c7aa762d0922dcb53b34e9

SHA1
a1ff6e8af86cb2f655ac4b11e54a052e9de1ffc4

SHA256
955746bd1e8f797f006b3dcf3e6fb1a7a383c19c98d3a9c09c193bec61926de6

SHA512
f4e06f0f5e10a0bc20fff1484dd6fac914e8fb29ef8697d328a6a2463b8fc4161de776e1248a79b5099df353a489c0752531e7ae54e4d1478aab30efdea9422e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

Filesize
170B

MD5
bb169885a90b5538a3faf8c9e9e36553

SHA1
7d4651190d3effe796f0d80573aafd6b8b18a177

SHA256
b1e70db63223db97e4369d6e0c127ddbfd9cd6f49aea7625bb5cf0224cbf1d30

SHA512
46e8bc22fe84eece787f0c3632d3a0754d75f646c6445a4523fe22fd2634c2f6a99e30018ab8b38970f7adab433a5b771a2b74313d5801b354e3990ac372389a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

Filesize
170B

MD5
82e350e5efa0b900095db8bb625e70d9

SHA1
781018aee9147b842a87cff9eb269f3a9005c46e

SHA256
883a3df86c6df7d3d180e6886cb993ddcafebe965c90d0584c5e5404e390568a

SHA512
0a8b7f6645f541f38d0eb0b1663c150647b532cac3be29fe0bba8e4278cc786de96721f4b2b9f3f812cebc558ee4f94f5e71a33e23bf2156e9ade571b59f45c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
7fc34f5d424e0aa8cff79697475e8593

SHA1
49eac26dfe535662967d24255061a1c131883093

SHA256
b7c8379f0e7e98537252d361d35eebb82963b830cc56e31dd33330038a7f23ef

SHA512
48661a6ffb7e56f1da75478d1c9e2a8a78bbe198c319c3a55b872a8dea2ac18250f7a9beef21c2c49f2c7ac126267bb8cf6cf5935c6789345a16c3f2f4cb6738

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\633SXO0D\template_css[1].htm

Filesize
167B

MD5
0104c301c5e02bd6148b8703d19b3a73

SHA1
7436e0b4b1f8c222c38069890b75fa2baf9ca620

SHA256
446a6087825fa73eadb045e5a2e9e2adf7df241b571228187728191d961dda1f

SHA512
84427b656a6234a651a6d8285c103645b861a18a6c5af4abb5cb4f3beb5a4f0df4a74603a0896c7608790fbb886dc40508e92d5709f44dca05dd46c8316d15bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC095.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC0AA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit