0f835b1419178b5d03bf070649a29509c06018605d3df464c59abc90037595cc

Analysis

max time kernel
148s
max time network
147s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
29/03/2025, 18:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_932c4fcbaf5de3104fe9f15c6db5073b.html
Size

9KB
MD5

932c4fcbaf5de3104fe9f15c6db5073b
SHA1

1cd42f76ad03effba458bf7ec0c7ca156c4fa981
SHA256

0f835b1419178b5d03bf070649a29509c06018605d3df464c59abc90037595cc
SHA512

63b8508536119adc661819474021780411ebf34baccfa150bf60cbcf2a6835cce814c799d201c7da7e3ee6bfc0d462912ed4c5b054108d9a4b830e828f9552b1
SSDEEP

192:C+/6O3zmHE/mZsNxndax7TR+Z2GNWLscQNSkr5xpOQlYBUbjFJcYB:8O3zmHqUYNWLscgrnIU4UvFJDB

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{938E5361-0D12-11F0-9358-7ACF20914AD0} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "449465257"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0e55c6b1fa1db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002d991329a8dc4448881880e6b632f97e00000000020000000000106600000001000020000000097e526a007526ee95707bab134a52473d52005518d2d53d68eccca6180f17cb000000000e80000000020000200000003e0e31be0546f2c77a55d1425ec4b13876723db9bc54ff2bf503931d88a252aa200000006d0ba077762ec38cc3ba2d12d9c424e40d4d4c3d5fffb10f6bc9406de371906740000000259f3f2f20ef1a29d51bb2558d3c43f8d467fca8350716dc9d5e35ec512c4d5b8fdca758260037bae4a06ffeac9eb50ae0509afdfb25ff20152a0453f4816e81	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002d991329a8dc4448881880e6b632f97e0000000002000000000010660000000100002000000023ed995413897d6f792361f4388a62acfa634ae20ff60d5bc4f89ae0812d2b26000000000e80000000020000200000008a54e62ce85818801b2eb7858e5b2f74f2c7860ef9ae42a41778b235e21f2da590000000ebd5b1ed663f7deff2b8ac8e7a6c91383b6141bfbf0adc851126efbfca5bcd4769ac55dce2010223ab580fdf263b4c20e5b6054388c3a9e541032d63470972242e00e68c77c12a67b63e2d098156ffcb9afa453c5d1b1609333521506f774ca0b3dd5612885107abe9fdbfa88353bac39246549311e6b2a3a7f1fdcffdffe0d6afe0d6bd2b54dafb519dc2cb4ed92bb840000000984439d3b02a46b4dc43f6650f3c1f74c172f801339ff111b69de8c197bc1acbea684dc9002f2421e75780ae7eeda46f55b45659a515ddb5c1f9c52e1a5c9e9e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2884	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1952	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1952	iexplore.exe
1952	iexplore.exe
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 2884	1952	iexplore.exe	31
PID 1952 wrote to memory of 2884	1952	iexplore.exe	31
PID 1952 wrote to memory of 2884	1952	iexplore.exe	31
PID 1952 wrote to memory of 2884	1952	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_932c4fcbaf5de3104fe9f15c6db5073b.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1952 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dd00de65622734d2cdeefcc6f5a6e81b

SHA1
835309cae04aa124559c2c008eec773fa6722d63

SHA256
1836beb618ef64b6b69f22722f0168b441729aff85a3cb4b7070f9a7ade3b756

SHA512
7c82dc47356fddbc4674bdbb72e5d1cf2e96d8d3deb3e2948b3e348b7610e8bc9d7bbdf975c248aeb34804444ab532f9a7f382a218767e912a63cbf08f08d9f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cb2ee1048b09c9ac02935998018cb451

SHA1
f7ace0d9d01068da1982113d2241582d2f71b561

SHA256
c7a9871f9b81735989d80db31e6827dc726eb4c34d4c857a8e6f2468099956ab

SHA512
d66d7f9546ae33c55545d61721612f9d03b78b122039293356b707e2bd77c41df1d3f01f1c617e5a8a591c1a0eed4a1726e8ac896d618984c360f83dbc1de39a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a449ebc82cd244a91944e7fdbfbf68a

SHA1
56172925e2f37a60b23cf76b1f6043f48ed90ba4

SHA256
2c273936f7d57c6ee9f454e0469b4bcbf68b6f4ca632b01fdad6a5ddd8a4ad3d

SHA512
e0dcba8a5d7dfc79701e13ff06ccd6290a1f5de347b330327c1e41188b8acf6e4a65e4ecc4f0e34ad15ae522e96c2a4a96db24601bf7c29fad3f7ad45c4c4863

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1a0e3ccf4a8d058a2f3e7fb853f4b545

SHA1
5e374f4ced9db1b371bdd04a668250066422221b

SHA256
38ccc362b9f05433cc0bd43ed209975865a9b1ea83a44a47c2a3b8af21b9fd1b

SHA512
33cc7657615a54f89294f18ab404e0cf5bf750058b2a67d003bfdce8473dc7e59938ebe8c997b0fae12c40e3104845fb33ae9e6d76b44d9a643276edef51ea44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f81297dd4a27fcb40f77d10806399484

SHA1
517eafed95396808b9d820403150e2dd966fc22d

SHA256
620201eaaff4b68099a695d611c72fe508533caab197321c94f152edd944ecff

SHA512
dde65c35f28c2ec6a9cc3383626f2785bb6cae64ac8ec3cd7893d06a95690152003afbafe12f3d9b565d4233caea361e37899a62b6a6df584dc03fcb2a7c4833

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c41dc1e6d6d4027611aa634c911e0d92

SHA1
28c65640e7bf63b92dc23cc8e244c1899ec2448b

SHA256
401db4df5795f06b8092fb3158b35cb20dbedeeed31fbad144b4284d8be9d851

SHA512
d5b74c89b82f26b4e603e1c716e11adda70922d46771bcde0dd7abe6cb38719d0ffd7851a21325af27c525fb7943dd10d9c18dafead6a07553877ac7efe13592

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
888e8de4773e5cf9df49d7b6072e7150

SHA1
1c849ce7f1ac84d26566539527c976f03ab04a0c

SHA256
7084c48a9e9ea7bcc91672240eb82c08a58341e3f615831dc08bf22f6095f3c4

SHA512
917561d93e1e15a042fd93aa500db3418dfbdbdbf549d05a3ecece51b9b48b59103fb597afdbc32127165ed6738a7e953709984587b069f860ce529aad5f9f9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2385a660dbd44b875f0824653f2ad50b

SHA1
013dfd21b17ce16fc0fef2ba7ba22e4a55ba89e4

SHA256
063415e7e4d678b731b59514104d2a506233fe35c16e7f2d6484a2692def58b8

SHA512
a22af9c38513aa3a8e562d29c86873f7a7b0f3d1b668f4cc42e76cb3d98841f6ec8518143a75901f39c2ea82edbb91b96a62d1a19d311af0bd1a1e3b4771a2cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
859ef02fe1d65a94f6f1c4d102e4db58

SHA1
11c164245f96b52ad6436c6ffaa09387b799c277

SHA256
ebf061751d01acfd349d5de971f8482aefd9c13aef38c5fa4666be6b599c8de5

SHA512
aa0685e779c1b77603b4c94805c3dc098faff94a8ce1f02ee22a608c6a42c190916bf51566a4e52fa27d2d9ea678603897d984817e6af0582f48bab634675e6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1fca280c039f2c7e95c624f9454b5556

SHA1
4bcd5fac94d621090465001f1c1487749555ef60

SHA256
76fd986a35a9575659e2315a658b7f01713df47b8e4f66cd92c109af23e426da

SHA512
e0effc1d60db45b85939c474be61e3e1fda66e2fadf6e0b682b05b8fa39eb0bb54e43786a576a7ae0c610812d745c459d8c898ece3d35f6016cd4d5632f720b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fde2d5a916f6783c9f569e24e33be4b

SHA1
06e1617218326f9114ef4a680f0a95c5752951e6

SHA256
0803498e2bbdbf6d7cd754695b7da4b5d9f671908b1090cfa76edd2b4dd21f42

SHA512
7c605f659b8e3fb45040d91454be4c034f5d028ce86c4abfcd3a83d46eccb9359ea053140da7699e750133058daa7c221a6b4b1f1f632ea499c1cb94a97b7791

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f17fa9ff53049c372e46005126487586

SHA1
ac4ef87d32146be7e7c9c57b8951747e226f202c

SHA256
40fe2b85c6d76cb0a86d0b3458fea23857bc380f0d57174edf6f4ca5532ae045

SHA512
7e3fcf5384a10942e2026dc1e158c9ae43f95cbb967cf26173d25359477773d860700e2efc8b8eaab7a223e36941322e3c02ef740f45b8ca23a5684d39d41d03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
35c77992a213704c9e1a6cb024e16ea4

SHA1
d9bdc9a829097b5bc9c1a255160ca7cee1f8066c

SHA256
a64483a2d390177700d4eaaf3d4424609f246bc508a1465d80335a5b3fe65faa

SHA512
3a846c5635bae3274c1af0d97ca96df18fa511b209b0dbfbb9e70286795f367750abe8e1ede98ea6bb92aa37f269cdc1ddf02842e740b2b980b07a242c1d25e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6348e14ec1f9752d917716517a726f0c

SHA1
e64c24bd0d761a371dab398776cf5aceeee25e43

SHA256
1e2dc729299c307e3c10bba7c089db028c8cd403c98069436c9403e894a46b2d

SHA512
f55e2a5d5c0577b292748e5d6e45e17b9a8f73cd15c3c334effceea7abe7cf8cb991051265353b5d14a3022d114812198c065155fa7e6897727954390269d3a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
770d7548648a5a94121a6f34f6225fb8

SHA1
eb7a3c1ba663aa5d2930f3e445178608f59854e1

SHA256
ac94e12d3902cb5f1de79f868aa9cb0d5ae17873e42b51d1cf68f8f7e21716fc

SHA512
7d9dee1917bb80c059c1a8e776db5dfe32a2f96fd295a14994aac3d42cad0fbc1e5afadc3230d8c168363e6564d509899066975537eaafdeb68b5ddb56dcba43

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab342B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar36F2.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit