a21e32915c9a3c01fa54865a49d353e77d31d3100fa8c3def564dcc9d9dbf3d3

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 10:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_8a9a20e75622731dd4d2c801e1b5edd6.html
Size

18KB
MD5

8a9a20e75622731dd4d2c801e1b5edd6
SHA1

091b6349bbad143565842df3080209e1e8e18d75
SHA256

a21e32915c9a3c01fa54865a49d353e77d31d3100fa8c3def564dcc9d9dbf3d3
SHA512

fe7a33d5d174b2ef38d3ace9f716e6075e89b6f900732e523a9dff22db735ed3c7c67675887e6812050796f5ac81ee8fe4a366560629e5d8e280596db271077f
SSDEEP

192:sqFQ0Errba1CC+h+nnfBlHqL6OyboOQ/6wVrcspxfg0XEMFSlZvEXo4hxXdGxj2z:lFQhrrGn+hCfBO63fg9py8EEY6dsxc

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1055de6fcf9fdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007ff9c09b7906ec418a3ad1f3a98d3fcf00000000020000000000106600000001000020000000b2506432148629646581db18c4e4b0ae91cbe0fca6baabd12aeda14066e4b282000000000e80000000020000200000006bfa574f07e8b0a771c7d47a3e2b70816cdcc1039bd62b881c641d4e13fa5dda20000000e6e52399f4a2de0678cfec910b438e7fc4365bdcd98efe70278f64de6d7f1b7840000000f6e1c06bcdd889206c50c6edbc16627844f220f532a584262dee22227d7ae6aa41c998f9e9eea3bedba4469debb72d7af9bc8ff3aa8f1c899755cb2457b72069	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{995AD851-0BC2-11F0-9EA5-F2BBDB1F0DCB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007ff9c09b7906ec418a3ad1f3a98d3fcf0000000002000000000010660000000100002000000000e7a21014edf2669c2ed687bce41565e55396e9b05fe32b130fa736ba437f0e000000000e800000000200002000000052d7cbf011441704ba91f0831b386830752b936b86dfbb37d4a43882c4dafcc490000000e789b5a0e3f1225e2af1c4f5dd0869594d67591d73a946603957a74b7ee63993243e7caabbd6f18b307c53c59eec9a13054dcbdb62f680d19241959ee6c124bd1be1cb8be626aeaae20960d7dad5b48373e57aaa40a293d146df8ecd044af111cbb87a661b1d1b0e56b399e1f8192ad8c0d88b7216ae3488301cebff3cb2aac6b0da00b48bdca5ec43cffeb84408111c400000009bd7e4afe96893f93f5324fd153f2bab8e2f47320201248c5df67fd80c0e2ef3d2202d43d323c0c46e59132a73ff9178db5d83fba1ab266e21adcce15122a4f4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "449320961"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2932	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2376	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2376	iexplore.exe
2376	iexplore.exe
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE
2932	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2932	2376	iexplore.exe	30
PID 2376 wrote to memory of 2932	2376	iexplore.exe	30
PID 2376 wrote to memory of 2932	2376	iexplore.exe	30
PID 2376 wrote to memory of 2932	2376	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a9a20e75622731dd4d2c801e1b5edd6.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8ec520055070243826f34822bfc342e1

SHA1
f5d144a6abece5efbb9eb10147ceacbb895690c9

SHA256
41cffce04650f0376160a93c47f23784abbe4160f5103cdc1d1e233a290bf73b

SHA512
0c15bddafb93bfd333263d57d2f48d20b50ed42510a0901f7bd84a9a16661ef9a30756e3de38dbacc228dc0b5132956954b32fabe8682ae4e14a3d5c4073d6a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
097922e903e7efe1b92f39bc866c0d7b

SHA1
015d83547fc21ac6ecc0c391837ab4ac4f12d010

SHA256
63ea728fe19596e42b5492f9bdc684595be743fdb316d240044a3f08ba77a3d2

SHA512
2358146865df40c64ce653c820438e13cedaefcf439a90edb6c93e9b9cc3db1883dc8b42d941e6bd191f97be0d53252ee0c53f6d576c157f31976f8df2404c27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39283494e0c167a9710d8187bd4488b7

SHA1
68f32a3a4847a10e179f900cd8e876cad0b49b3e

SHA256
18dbf0479f2e4c9fc4a276dc9f61974126746f2c98e2285817959d7890460f31

SHA512
edfb7719ce453470376a7d2f154018afed467c48a008d83f42b0443666ab3c82b73ba482b365b201498a4fffefd4bec3ec6400148687895d46e8697c50f7708c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
149755836f756a48f5f4ca6bc1d286d7

SHA1
f692a6133524c22dac1778d43d11f23c2c200dbb

SHA256
2f79497c8673235a93f14ac6c8c149e2e24ed7c5fe5b5aacde0402a3e88eccfd

SHA512
8b4569ada17f99fcbaf83d694638a8fd79c561b93fe2562432128d2f2dec55778d46141182ee120abc238d2f2587ac070ccddab9b862563a01c9c8da38875bfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f7a17007470c39da7968e3b6a107317

SHA1
22107a7ec5db2f3f7caccbfa3cb2515bf7f19809

SHA256
e90fabad6aa40263e9d71dec6a27ed0326e4194f054450174aaf50f4cf9dda7a

SHA512
1a295c0846f4407072e967deb8fabffdb520f5dc03e0fff1fd988794c0d6a1a08aa9dc3f1757755a48aed85ebe187b49552cef57339d8b264c1c8915af50ed19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5d0ee08a3b51656a650d21491d4d965c

SHA1
882e32a0ab76827a066e7002e2d77b6edfde0968

SHA256
664e02ce8a80e812338001e25731f85fa67af1b5fdbc3c97799c91a32623f20e

SHA512
7362acfbfb2818160ba02f4950145c10e73a494617ac3f8f85988546a4620c452aa48d960a00d5ce1227fa1985c8d12ac9d81d5e7751e7e6f19bdb8460259a9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68ab63f23bd1edbda576d92e6f7ea701

SHA1
17071952763910a56ceb371a7762ad5ce0c12d39

SHA256
0befc99f1c973e6dfedbcc5f1df05c7a2f1073fda76fe3cbb601e50ab8e59162

SHA512
fb52033aabeb7bbf88cc8c6326c58dca6f457dcb01fe9742ce180ee60fb3f1f8a2b52d2763d37adeb89b815d7e9db7d3fa501af67f773cd272ac3caada7d5a9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
66f1d438476bcf4d823c7370d450cddf

SHA1
e015af35c8ef5ceaae63971f862cdf43c16af70c

SHA256
c31b71eee7693da748704dcd1ee5b86036e9c30cfdde2f10572a4d50f255e0ff

SHA512
bfcdcc7f4673c803870e4a5a05670e721b1054f0d3646302033035296b43f7d5e4bdb64b99f95eb708bb75116c4c532e8922fa644c3ec74e478230a54353b2a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c2ed07a7ec2eeafbe049a8c6f3ed0bf4

SHA1
d10fbba6a1178b0caecea27a97c15e6b8d0dce4d

SHA256
d80235b2261303d36890a9d5ecbadf6ef227df70f445a024b69be054da3d60a8

SHA512
0c449ee0cb32737a0c4042a6eb2c1047cd1d04a185b2f651843f96395a6963cba228ea0b5611f57512b2ac5eadc69a345fa82c75c167b2eb6e9a8b01c884fe52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
090f813089905660fd2035006c822e1f

SHA1
3b8e8f617513139cf9a3f31d3a0d13b6fabe118d

SHA256
4143dc5e7e0c3940ade06aaba90dc63c2d385a042be482b82a544e9c931579f4

SHA512
509b9c37c7aafec488fd8b1d7a9aa930b8a00771097b5e1bf5c64b59ac4ddf7a4617e5a9779b2fad20b67195559351f95486d579b78dfc9fe18c0f828279246e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20cd3808795249171e12faf016d86c7e

SHA1
c00d6fa1e426f6761c886ee7a1ee5d22a90b81e5

SHA256
ebb0672009977288ff92b74e69544b25ed8ba6ab02887f868c49050d2f52de69

SHA512
a2ae0f1b30cdd0d46fe021b620003d8a6a62581df12bbae1185b792c9851938f811c05a0baf2b361854634a35a02da3abc971541fb0de3c2b02deafa561abd29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dbf1be287b164dcfbeccca9c320aa7ba

SHA1
15edb4f936440ffffd7b05c4590270c87cafe523

SHA256
990c5a09e846467c2dc732495f1e1f0d1ceed7d52e769f6d675a4b86e2f8ef59

SHA512
130f9eeb4b1dd9ce523e5ff05327e7bc86a9242d107dba052e8374a2ed6539197e45525d05e0d6fe4496c3149ed53135ab4a22da807537c2a5a6c181c37a0bbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6f31d52b2676834578569986c7c0c183

SHA1
13730ef2e88d8dbb07d07577bac9ae04848e2fd1

SHA256
f0c93d44615d3d34b48e4e8fec29665293b54dbc58dbf06e6bf934cf1a8becde

SHA512
32dc8994a4fa0f0415437dca0a998c3edfc1308c2b462d9e56de60c2ed5175801f429b49e2dedf03099ca07d4ca8699534d1b079767d7e0375c55c6363632231

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE708.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE866.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit