a3c76cc1a6684f313626649a08d868035f4472b1e8816581ef5028e489301c9e

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/03/2025, 12:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_70a687d8e6b25d665b48aac0f9b359a2.html
Size

1KB
MD5

70a687d8e6b25d665b48aac0f9b359a2
SHA1

fbb09ed1f8c7614285798c3f425f4d69322fb7d0
SHA256

a3c76cc1a6684f313626649a08d868035f4472b1e8816581ef5028e489301c9e
SHA512

d812de2aff81dea609781bc35660146f65d961f4e05fbde54182a9f7f1a16755e5a628129f6a5787e38e7a6c9d38b60cbf1fd75b9873b81d9e0036cc45af7918

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9AF29461-0009-11F0-BC08-7A9F8CACAEA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c666727642a33a47b64c45e983e4ac95000000000200000000001066000000010000200000008c5d0e71bd18c00f03d78d36c71282c43510d13984c20b38c18819ec99837d0e000000000e8000000002000020000000b0ca96e25e5db104e25e31e06e38c42fc516498c5630ddcc32a6fa9151a7bfa720000000e303421f22b3bbaecbfe440b584e472a88458afe289e8e81ed730fe8d005fe6440000000b7b85a19c8463d21d72380bfb1b0b07c094a1cc0794bff9ed8f4ba9897e8337e80c7295c35eb9ae93fc28ea52eb9fb28680fd57d04cbc87c88ec4a1f4e6c22ed	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50b747741694db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "448032039"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c666727642a33a47b64c45e983e4ac95000000000200000000001066000000010000200000005d16151d7b487c27357aae953a02f5765bb2d02d7a36dfd2107ba09ddbf9b0dc000000000e8000000002000020000000b710de29671ad112b2663dee7c4e7aa36730a770441a4d8f45bc76ad6435ac1a90000000dd170f88cba3fe7208f79cde94d8ddce78f0c0ec34e6ca12c0026015dc54465af0c5d597161bf3aa1d0c082fca612425ee1aafa5b61f6e520f8b284873df9f34cc4fb59c2e39e751113f7844a5da246f2ee7b341a29d5165c0e7fb71f5a4484df2469b573329411ccff7e973e77a1153915d6f407a7f9c4ccdda0db18d1d1415173cefc69840c261add3a930ab61f9b640000000907092b12fd08e78d568ebae3fccdc19d3b06e25c2d21486e3d37ea5dccf05fd447b6b86f051da3c9dece7adbd1110f66f82c4dc975e4c516e9bc4b40d238d5e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2396	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2396	iexplore.exe
2396	iexplore.exe
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE
2516	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2516	2396	iexplore.exe	30
PID 2396 wrote to memory of 2516	2396	iexplore.exe	30
PID 2396 wrote to memory of 2516	2396	iexplore.exe	30
PID 2396 wrote to memory of 2516	2396	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_70a687d8e6b25d665b48aac0f9b359a2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2396 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
49f52f923b6ada8574d293b6fc794be6

SHA1
d22fe2c28c4aed6f94e2363d7005c44a9d4ef3c6

SHA256
5a577c071bfc6c35bd75b95742e21d5ade9deb5fa37f562e485341f062437a21

SHA512
ced97388fa8127a34b46111d5f8ff3fc8e50841fa306ac5216f508bdb807d1626357c1a3555abee901928e38059c90633053d91047150e77b2de50fd59bfaa0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
32c6f336be6d1dff6578940b5fdda94c

SHA1
b73194bba448225b7f2246a16367c2d601626c85

SHA256
6d19a95fdc3ade512e049e9e3ac25f514e30b167aaed27e09df6a7672a160e06

SHA512
83ce654e6b278bde9c55a1987e1d5c7ec41bf89ab533b28112b4c93549f0042ae0f2f04617328793314f55dc8637eb541f3c26fa6a91fc622693e6f42ec0ca35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c162dd671785ca0e773e8dffb48a2640

SHA1
412f99a2ff3879e954a5f28f117736a1a87d04f5

SHA256
8aa246c9f5ff538045acf3b66c054088eb1d4f5f27c6236f6e0eb127cb939cb7

SHA512
daba90bd53b78adbf2d3adf5a61f2712b09949eec26e04371a9426cb12d133490f533de27bf1d3709cef7f33cc26e0d69c63858204d0374667d84d130a132630

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c6b5654c6bebfd8163845fe85a73aada

SHA1
63f9ab56c2e38cb61b6b76c5375a0f8944229210

SHA256
1b6796d99aa458a621fd14a0baa1c720d504cb2ca9db8bb400d779e8a12ac005

SHA512
cae3e33f3d0812df997b8520ae0542268adfd4343e4c4ea3f86361f6238bce44df1cc8ae9b405ce5cb644571813ffb8800b6b44ca287b0708c75de189c2fc754

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15292ba45a0f462a9217f96b9df4d3ef

SHA1
9682b15fcfb857dacb2efbd7656b1202bd44998e

SHA256
8b3380bf4f11ec6d075c6c86474f9033898e2bf7b554222b5ac177afdfdeabb1

SHA512
0cd80bb0d7195f6e9288214494533ea4ac92c0e1ab059d1629aea01d49d13eda81333ee0a83bba757d9c2da610ffd64c6a177886ce8a6c07990ce38d453752eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b4e883418787c16949beb1c25aa0c46

SHA1
e61917c0b4aa5c5adeaddd77f3fd0472a950ff81

SHA256
db9e0aa949103a352ad87aba019895547975a4d3d2bf1f6c507eee357bd457d9

SHA512
3a7f399170b557f38d6f7772dd90cd0419c805ca0647fc69b6a40a693542c0e619b35479fd43ff4bc7557c7eb87985996e099e548f95159d7638371dfc257033

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3145567580978a06657dda7fbaadc24e

SHA1
2b5eaefa2932d9e4fe7fba9579deb9d8539afbce

SHA256
7195b0c60df89ac731e3823aac25a86a5b753f4a32d9e0dffcece7d75e283fcf

SHA512
ac27fb840428a9dda16bde91c6757ba93fdb08d9efced80122cbbda4ef1e33b0988fe51fd4e0dce24866975528be16dc7857cd9292424f5f540ef682dbc11c7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0ae6aa409d4403d51944f29309505847

SHA1
44c31b6f2d179e60bc94470b384d8862f155dd26

SHA256
287357eeb28f24a2372490d442f8d6ebc3fbb4be520345ea815a0aeb29822d39

SHA512
c442e26b78a38ffcdc4b64f768983a735b79fcb0feb437ebd76551f487fd2c36c113c8c7d358af5e4f699fabac55d95280e869d1b722775a9e8f7a3f21176be2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1a6d0d98aee22a54dd11d4565a02ae7

SHA1
8ae712fd717a4a45489acf9ed1406ee90ba3ce71

SHA256
b59ff8d7a6d95bdc049c5897a50e86f52e1e1a22ab354b9329fcef406e123e59

SHA512
dc0a01742864e0598d5a533e83158746644b9364ea8bac878d2702cf935e627bdedb80180efce067bb83578b1f7172fb4aa1f0139d340460c942d33fd4e6bdb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59eaabaf10268c6e5129a387f5897296

SHA1
de85466ab9bafcdc611ffb4a462a4c54575a84e0

SHA256
6bc28a56d928bf278faac7a538f35cc3b3657049d486c12fb3b8ddef270c0a3e

SHA512
e3527b63013ca4e33e9f262a052d6ba631bcded1f0155e2e0335b671e6f43d7ee0a96ff3779d29dea23f741b383842088545f132c7a27e440adad5bd6f8756db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
06b033090cba5b25d31d271c4885b2a0

SHA1
66facb7a6f60cc9b3fb44a1bfdf5f454183c0c63

SHA256
11163e38ae5f05127831e5d8d8600637c2262f4308c5008fe95b55da8278f7b2

SHA512
115155ba44d675a2a4ec75537ec0f876265aab48f86637e32798b87e5fd470c1e4ea15f52b524f1d971d52921b689dc149452dcd7bb596dfa8775fd2372378b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a8cc8fefdcea34284787305ab787f670

SHA1
051c288276d169b9c805f519f8c21e40ecb6250f

SHA256
6b65a360bd99c8f25d31acdf4bf79b51d865ea3749cf5569aef4673ee8df44b1

SHA512
c332b63f916581485c5ed7ec3a497e45290edfb9ca284c6cfc0cc74e1d0600f349cff53c8d324472ce7693a5f7f6b2e90fa888209654134b0b3f0990ecd67e76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5864d4428e452e6232682b8d9374681

SHA1
1e44b60c7422386ecbc09b93550bc18ddd6fe4d7

SHA256
3bfcc8fb28f7823ca58ae84846cf4bf71f6eb56a8251f0aff32d86bc72a39442

SHA512
c776495c4042bb29282c4f1513146369a4333fd9ec0daafffdc429edab0ce1c0ad72ef87fc000a3bbb6119f859e46c39246e7bae9a0cbe55c66000fd4dd5b0a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1e3ef8a2bf1ef6c0da29c198b1309e3c

SHA1
a74d1c9ae56d479c1a48c5b8473a1202a60ce9db

SHA256
0df944b8fd8eb183c827d4e029c85862612082c7a128d9754c99657364149b9d

SHA512
cec16e88e6c02eb673dac820565ca236dc2ae36d7c9a68859d45d2bc677b0383424281f63c8706a5efad78ed173303895bbb905f87f1b3977d1b7e42f229047c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
17e0d1aac19024588034f9a65bbbb589

SHA1
1f5f6d3f9176b6d887f55b76de5cfb6f97f8bc3b

SHA256
94389580fe6cd730c33835498fcf044a4cc79de48ed33cbb68fe467e82e25ec7

SHA512
050256d1ebaad7e42d7e6f340dcbf017a3e2d4cbfc807fa566cd92861a62a3912a773053fe0db93618c2c5ca369adb470870b92dfdbe275cdf79fad5cff48185

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c098ca1e91a9ec1d8e0c0d29ed3efbcb

SHA1
e4793b0ac7f2975f7dc695b5703dbaf10450a95d

SHA256
f22e136ff022ad6a9ec120023346d59715fdf3ce546de9061b2e8d8d698cacac

SHA512
04366420afb3e0448193d97ede9304966452b43d59d1297994f51035377386f1897154b14e45b02a40d47055e193996a47329b4ea4d3286774ce04a5cb48378d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEAB0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEC4C.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit