9aa4a808cf30f5b05c70f419ea168b9fc7d021c6efc23d928b7cd7c7253b5c83

Analysis

max time kernel
141s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
17/03/2025, 14:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_7e4d8a409cd6ae4d8bd0041d84bc5aa8.exe
Size

621KB
MD5

7e4d8a409cd6ae4d8bd0041d84bc5aa8
SHA1

5d032083f2eb03fd7ee741132e1dfe55f810b7a4
SHA256

9aa4a808cf30f5b05c70f419ea168b9fc7d021c6efc23d928b7cd7c7253b5c83
SHA512

8ab7571bf4a3b4e2afbdc5a2a46da0d24221c7fab6bc918d7e3789d681457320eee31fef0348226eed0c7db5ec9ff3895e5cdc378d93fa957fa63f14ec337194
SSDEEP

12288:0fmtCJuGH3WmV7vWN7iwHQo30veJTv3PdEXS5nLX:0f4GZDk7kRGJTqU

Score

10^/10

google discovery phishing

Malware Config

Signatures

Detected google phishing page 3 IoCs

phishing google

flow	pid	Process
28	4624	svchost.exe
28	4624	svchost.exe
28	4624	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
4624	svchost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
18	sites.google.com
20	sites.google.com

Drops file in System32 directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_C96AFB7E7DD57AEA9355932BA060F2C5	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_C96AFB7E7DD57AEA9355932BA060F2C5	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6DA548C7E5915679F87E910D6581DEF1_D2087A98E456A592CF28D360CB8C903E	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6DA548C7E5915679F87E910D6581DEF1_D2087A98E456A592CF28D360CB8C903E	svchost.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	JaffaCakes118_7e4d8a409cd6ae4d8bd0041d84bc5aa8.exe
File opened for modification	C:\Windows\svchost.exe	JaffaCakes118_7e4d8a409cd6ae4d8bd0041d84bc5aa8.exe
File created	C:\Windows\UNINSTAL.BAT	JaffaCakes118_7e4d8a409cd6ae4d8bd0041d84bc5aa8.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1640	5512	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_7e4d8a409cd6ae4d8bd0041d84bc5aa8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies data under HKEY_USERS 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5512	JaffaCakes118_7e4d8a409cd6ae4d8bd0041d84bc5aa8.exe
Token: SeDebugPrivilege	4624	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4624	svchost.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 4844	4624	svchost.exe	89
PID 4624 wrote to memory of 4844	4624	svchost.exe	89
PID 5512 wrote to memory of 2652	5512	JaffaCakes118_7e4d8a409cd6ae4d8bd0041d84bc5aa8.exe	93
PID 5512 wrote to memory of 2652	5512	JaffaCakes118_7e4d8a409cd6ae4d8bd0041d84bc5aa8.exe	93
PID 5512 wrote to memory of 2652	5512	JaffaCakes118_7e4d8a409cd6ae4d8bd0041d84bc5aa8.exe	93

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e4d8a409cd6ae4d8bd0041d84bc5aa8.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7e4d8a409cd6ae4d8bd0041d84bc5aa8.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5512 -s 704
  2⤵
  - Program crash
  PID:1640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\UNINSTAL.BAT
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2652

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Detected google phishing page
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:4844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 5512 -ip 5512
1⤵
PID:1068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\UNINSTAL.BAT

Filesize
214B

MD5
929fb0f97c65d1521f81f77cf2f2978e

SHA1
dce9c16400f18fd721217eab418068adc1f48dfa

SHA256
c1ca150c777c8aaa81bd3e8487ea47381d2e1842ae09322f0c4dd77a34bb3a2e

SHA512
2f3a92a3bd6d40fa4a05d43db279459a527461194da08aa5fb3e2f492047dbb7d8ea1ed717ceabbcf77ce23b9c0df696fa569cfd169f741f302e4522c21f01f1

Download Submit
C:\Windows\svchost.exe

Filesize
621KB

MD5
7e4d8a409cd6ae4d8bd0041d84bc5aa8

SHA1
5d032083f2eb03fd7ee741132e1dfe55f810b7a4

SHA256
9aa4a808cf30f5b05c70f419ea168b9fc7d021c6efc23d928b7cd7c7253b5c83

SHA512
8ab7571bf4a3b4e2afbdc5a2a46da0d24221c7fab6bc918d7e3789d681457320eee31fef0348226eed0c7db5ec9ff3895e5cdc378d93fa957fa63f14ec337194

Download Submit
memory/4624-91-0x0000000000400000-0x0000000000536400-memory.dmp

Filesize
1.2MB

Download
memory/4624-95-0x0000000000400000-0x0000000000536400-memory.dmp

Filesize
1.2MB

Download
memory/4624-99-0x0000000000400000-0x0000000000536400-memory.dmp

Filesize
1.2MB

Download
memory/4624-103-0x0000000000400000-0x0000000000536400-memory.dmp

Filesize
1.2MB

Download
memory/5512-49-0x0000000002EF0000-0x0000000002EF1000-memory.dmp

Filesize
4KB

Download
memory/5512-42-0x0000000002E60000-0x0000000002E61000-memory.dmp

Filesize
4KB

Download
memory/5512-8-0x00000000024E0000-0x00000000024E1000-memory.dmp

Filesize
4KB

Download
memory/5512-7-0x0000000002A70000-0x0000000002A73000-memory.dmp

Filesize
12KB

Download
memory/5512-6-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/5512-5-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/5512-10-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

Filesize
4KB

Download
memory/5512-16-0x00000000024B0000-0x00000000024B1000-memory.dmp

Filesize
4KB

Download
memory/5512-47-0x0000000002ED0000-0x0000000002ED1000-memory.dmp

Filesize
4KB

Download
memory/5512-20-0x0000000002790000-0x0000000002791000-memory.dmp

Filesize
4KB

Download
memory/5512-19-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download
memory/5512-46-0x0000000002E80000-0x0000000002E81000-memory.dmp

Filesize
4KB

Download
memory/5512-45-0x0000000002E70000-0x0000000002E71000-memory.dmp

Filesize
4KB

Download
memory/5512-59-0x00000000032C0000-0x00000000032C1000-memory.dmp

Filesize
4KB

Download
memory/5512-58-0x0000000002F60000-0x0000000002F61000-memory.dmp

Filesize
4KB

Download
memory/5512-57-0x0000000002F40000-0x0000000002F41000-memory.dmp

Filesize
4KB

Download
memory/5512-70-0x00000000032F0000-0x00000000032F1000-memory.dmp

Filesize
4KB

Download
memory/5512-68-0x0000000003340000-0x0000000003341000-memory.dmp

Filesize
4KB

Download
memory/5512-69-0x00000000032D0000-0x00000000032D1000-memory.dmp

Filesize
4KB

Download
memory/5512-67-0x0000000003320000-0x0000000003321000-memory.dmp

Filesize
4KB

Download
memory/5512-66-0x0000000003330000-0x0000000003331000-memory.dmp

Filesize
4KB

Download
memory/5512-65-0x0000000003300000-0x0000000003301000-memory.dmp

Filesize
4KB

Download
memory/5512-64-0x0000000003310000-0x0000000003311000-memory.dmp

Filesize
4KB

Download
memory/5512-63-0x00000000032E0000-0x00000000032E1000-memory.dmp

Filesize
4KB

Download
memory/5512-62-0x0000000000400000-0x0000000000536400-memory.dmp

Filesize
1.2MB

Download
memory/5512-43-0x0000000002EA0000-0x0000000002EA1000-memory.dmp

Filesize
4KB

Download
memory/5512-55-0x0000000002F50000-0x0000000002F51000-memory.dmp

Filesize
4KB

Download
memory/5512-54-0x0000000002F20000-0x0000000002F21000-memory.dmp

Filesize
4KB

Download
memory/5512-53-0x0000000002F30000-0x0000000002F31000-memory.dmp

Filesize
4KB

Download
memory/5512-52-0x0000000002F00000-0x0000000002F01000-memory.dmp

Filesize
4KB

Download
memory/5512-51-0x0000000002F10000-0x0000000002F11000-memory.dmp

Filesize
4KB

Download
memory/5512-50-0x0000000002EE0000-0x0000000002EE1000-memory.dmp

Filesize
4KB

Download
memory/5512-1-0x0000000002350000-0x000000000239B000-memory.dmp

Filesize
300KB

Download
memory/5512-48-0x0000000002EC0000-0x0000000002EC1000-memory.dmp

Filesize
4KB

Download
memory/5512-21-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

Filesize
4KB

Download
memory/5512-9-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/5512-56-0x0000000002F70000-0x0000000002F71000-memory.dmp

Filesize
4KB

Download
memory/5512-44-0x0000000002E90000-0x0000000002E91000-memory.dmp

Filesize
4KB

Download
memory/5512-41-0x0000000002D10000-0x0000000002D11000-memory.dmp

Filesize
4KB

Download
memory/5512-40-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/5512-39-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

Filesize
4KB

Download
memory/5512-38-0x0000000002D00000-0x0000000002D01000-memory.dmp

Filesize
4KB

Download
memory/5512-37-0x0000000002CD0000-0x0000000002CD1000-memory.dmp

Filesize
4KB

Download
memory/5512-36-0x0000000002CE0000-0x0000000002CE1000-memory.dmp

Filesize
4KB

Download
memory/5512-35-0x0000000002CA0000-0x0000000002CA1000-memory.dmp

Filesize
4KB

Download
memory/5512-34-0x0000000002CB0000-0x0000000002CB1000-memory.dmp

Filesize
4KB

Download
memory/5512-33-0x0000000002C80000-0x0000000002C81000-memory.dmp

Filesize
4KB

Download
memory/5512-32-0x0000000002C90000-0x0000000002C91000-memory.dmp

Filesize
4KB

Download
memory/5512-31-0x0000000002C60000-0x0000000002C61000-memory.dmp

Filesize
4KB

Download
memory/5512-30-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/5512-29-0x0000000002B40000-0x0000000002B41000-memory.dmp

Filesize
4KB

Download
memory/5512-28-0x0000000002B50000-0x0000000002B51000-memory.dmp

Filesize
4KB

Download
memory/5512-27-0x0000000002B20000-0x0000000002B21000-memory.dmp

Filesize
4KB

Download
memory/5512-26-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/5512-25-0x0000000002B00000-0x0000000002B01000-memory.dmp

Filesize
4KB

Download
memory/5512-24-0x0000000002B10000-0x0000000002B11000-memory.dmp

Filesize
4KB

Download
memory/5512-23-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

Filesize
4KB

Download
memory/5512-22-0x0000000002AF0000-0x0000000002AF1000-memory.dmp

Filesize
4KB

Download
memory/5512-18-0x0000000002620000-0x0000000002621000-memory.dmp

Filesize
4KB

Download
memory/5512-17-0x00000000026E0000-0x00000000026E1000-memory.dmp

Filesize
4KB

Download
memory/5512-15-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/5512-14-0x0000000002A90000-0x0000000002A91000-memory.dmp

Filesize
4KB

Download
memory/5512-13-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/5512-12-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/5512-11-0x0000000002A80000-0x0000000002A81000-memory.dmp

Filesize
4KB

Download
memory/5512-4-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/5512-3-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/5512-0-0x0000000000400000-0x0000000000536400-memory.dmp

Filesize
1.2MB

Download
memory/5512-2-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/5512-71-0x0000000002350000-0x000000000239B000-memory.dmp

Filesize
300KB

Download
memory/5512-77-0x0000000002350000-0x000000000239B000-memory.dmp

Filesize
300KB

Download
memory/5512-76-0x0000000000400000-0x0000000000536400-memory.dmp

Filesize
1.2MB

Download