130f729c3bc491fab16c3b9aba2b75edcf98bbaa42cbaa5b775ddd776ff5e7c5

Analysis

max time kernel
148s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/03/2025, 18:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_9356f753be4888650256c3937d2c53c2.html
Size

48KB
MD5

9356f753be4888650256c3937d2c53c2
SHA1

34cb4ef76014d75078d73b3954b4fe5860f6ea30
SHA256

130f729c3bc491fab16c3b9aba2b75edcf98bbaa42cbaa5b775ddd776ff5e7c5
SHA512

e44283aa39a77d66ad33db488299e72e2735bdf8925ac3ff126221c4488b359a89d12e6828d178909bce8da76e73c21be927da859277f89920182f658dc972e5
SSDEEP

1536:KGw4IKkhqCOZyP47jFi4o/LzM+W3tyOSX+lSvvxstqJr:KcIuclgtyOSulSHxstqJr

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "449464498"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CFADE7E1-0D10-11F0-9527-EAF82BEC9AF0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2688	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2688	iexplore.exe
2688	iexplore.exe
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE
2664	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2664	2688	iexplore.exe	30
PID 2688 wrote to memory of 2664	2688	iexplore.exe	30
PID 2688 wrote to memory of 2664	2688	iexplore.exe	30
PID 2688 wrote to memory of 2664	2688	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9356f753be4888650256c3937d2c53c2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2688 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
d6e7d0ed9ee61d765cbb28a3080abafa

SHA1
bc09c0b6316e242834e3dda7ea848effdd3a747d

SHA256
1a0a27bc186424b02bcbb17cf427c775f95cc347591f087e99d4173e8de8cc55

SHA512
a08feac784d664e67023eedd9b5ea717c35b03c2efd8c30a99b1c0a2cec87f0527f87a17d485d0d71a6855dbd809aea1b024f1c6af880bb250678412fba7419c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b7641e83b85446a7610c92856091fb8b

SHA1
852b9b9ebe27ee995903aa92cfd113b8bf706116

SHA256
f6ecc9d83e947834cb6acf04ff525373de6e2fdacb1a1434f182e951c75c84a3

SHA512
c6eb845a1d7d11c591cdf7dc0b4e84c29f07be25b38534b655f86b4fd04ae074f9b85ccfab42a9cc7efb9e34554fa6272930ffaa78a0388288e474533ffdf21e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fb5a3fae28bb5e72173207ad15cc667

SHA1
259e9df111ca313bc82381603f2e1eda2b700c36

SHA256
c381df908d762836737099a4c714892b005ac420ca5a4f42aeb05aa9f66691cc

SHA512
0b16dc4fd81e484679e1b242e5e7ad765d5735440dd11161db313dd7432bf50df7d7f4372b0760e229b2632cb8de55c927885a7d0d1e77ca92f759473e160ec4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e4fa8a16bf5efac34b1c87328fc58ee

SHA1
0adce85b01ea7a5ed202d2d6782fd948d978fede

SHA256
d3a1cc98042010362fe6750985d3968ef59c27326bab1332782e9a976ab3f3a6

SHA512
2dd645b9acbe59911a28906e01b4d63edebb9ea409c2437dd4bf2196a31f5863ee312b751e0d06e1f17ace2a7b58799cc1f222e71f882530bb31bb4ede0867b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
47083c90dca0993528ba51770722e8de

SHA1
981a2c22462f1e5c6c89f8324c88ef838ce61a87

SHA256
e06027d974da2243190443f2d1d05866a55a23430591d54ced310abc2df1f39a

SHA512
28433692ace8b0ee84324610cfad60591b3373428bde446760b79f4345e577f2a23074af3ca6d710fe3e54200f665fc95396c9a55e9cb621588fde62c784245f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1db32a03a40dd73f3156d732a8cefd1a

SHA1
ba4075959b563bf13887e0078929f0a5ac603b34

SHA256
ccd33b61d475d983efed0bbe6cd9eec78bebe75351cae15ac5fcc2ad94c2e039

SHA512
fd90e65366003d02135b852759abc5ed6278bccc5dab960b9a23e2932f0138321765a996a3a56e5b27474d43539f1c2b1d58d34e320383597986eef4fc955c98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
69a1681ab4e2eef3f9b88908a2463dff

SHA1
1b1578ed6dc230e0317709908d3ac10e67b9ee50

SHA256
5e355fffab8dd971484f716c6e4eeb945e30bb1104b4f12facf1bfbd682f2a5b

SHA512
d28116608aa6ccfced3c6f09c01f83b560545112445c5f893fdc5c53b27d5c4256d2ab886770783d6956b00bc1f564905eafd41eabaca5892d0b51f83665195f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6db3b9f3a06a8552775e132b80931f56

SHA1
e8243dc3bbc9bf29707f662605c8958b9b90c90b

SHA256
7a3bbb5f7924fd0349de47f8af270f50c9fc7e5857b451b8c9d3d9d9a6d36842

SHA512
f35c5308aa93e6e2461ad9cc9aa6cd11141ce8006b9ae8229b9d139a403f0bf030256f947be1f9e4297671181633aefb4929fd0e4d3c931bf2d624041fec85a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
febf08450f9bae396adf24526b0a0dfe

SHA1
76266e216cff90f5fcf03e0099675af72bbeac46

SHA256
93713285b391b488c2dffd112c9865f93a54928eddca7bc47a32c030c07b0758

SHA512
34951742759cdb9558a0feceba16e59e4ef8a5b96d09763d2709067d418d6ceffcf053d3cb4624ca354e7d0b3f0e568f4cdb96872180060e1080492af06ebe6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9883d5c97598fe1ff0d558eba2fe4557

SHA1
07670dc6e4e0f9c8e66f99a4925b8593366989bc

SHA256
aa559281fb01f689f7ef040c7a58135808213d9dd17f5cd452449c0ea97eeb75

SHA512
64c8db6cb8c14e4d8aef5de3488c0f6128835ca8668a4b0bb24695d6b271a1dfc272bd6c8969cbd8d57b5cbf04b8fb18725ffe8730943a25826ec3457835bb82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40f330336e99de7c2205e51eb5069997

SHA1
77a6328cd61ff385ea98977893880dccfa6d015d

SHA256
b9c98cf8027b741542d05882c63452b0317043dc7c41eb58dafde2afc88d8b48

SHA512
e19730b285210717eaee89f7b40ccda37d2c966727bf6b4a4ee0636a24813e1006eb3feb4b1ad79763878c8f1205392cfc73e8248cce27e37bb1b686f85f54cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6366cc3b4a557ada21f660d1d6066314

SHA1
9b1449678e0595e4f44d2e5279a3fea24064307a

SHA256
8831539bfcc982f3b3a5bc234f39010363d4b416cbebed02c850a03bbb63c621

SHA512
5a95ff9b181373586854b5d3372b34b02e26a45b0ecf96f4b90433416e89cc47773a789722fab134342916b252646bd0dd9dd34192e94718167fd0025e69d729

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
bfce8f8c61296f7aabf2709d81db0738

SHA1
6475287edccafe688e77277d814e17b716395ae2

SHA256
db21b272e92139b7c1f30e0479c397fec32d33a87d46bd1940c89812faef1a47

SHA512
96037534eb049d2e1460d2fd92f46beb7840d0f00df743ae6003c7d34e2a63d07a2f455b1e02995ada826cc6054cbaac3d14d1d091d0d5dfcceec71da635c4f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar62F.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit