Analysis

  • max time kernel
    142s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    10-05-2024 13:37

General

  • Target

    2f6016a5111a05f46b46cce41c5569b0_JaffaCakes118.html

  • Size

    182KB

  • MD5

    2f6016a5111a05f46b46cce41c5569b0

  • SHA1

    115a1dd06405d2d54c58794a73f1fc2238b3971a

  • SHA256

    268a3aa9f932cc62f868a101dbf930b29396bb21acdead61e9bb0af527e72245

  • SHA512

    308a3cbdc24b4f714abe840cf34bed3d514ea7f8445d175fd2cd40f97abd5e3d03e5f8f87b34646c513251ef7c3db80ef6b3b95f09ff44f5fd85c50cab711838

  • SSDEEP

    3072:hxbjvG83mAGXmNJUz/5UJv58G9J25DHzLkxT:zYXmNJGQ8RW

Score
10/10

Malware Config

Signatures

  • SocGholish

    SocGholish is a JavaScript payload that downloads other malware.

  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2f6016a5111a05f46b46cce41c5569b0_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3000
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3000 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2156

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    1KB

    MD5

    30ba39f0d9dfc242bcf5a13148c65714

    SHA1

    f35a36a5dd87eec68ee6d1e621224995838f30f2

    SHA256

    6cb7722d1559158bb31024e172b224988f0963e043cb8f60065c94c0e9f5b0a8

    SHA512

    bf732a235af263d14562f0f10495e910f18affdf4dd1f1f0507c470de7e9cc0d3f122f4e114962ab3342c434d71b20e97ee78dde7339a42300cb5a394f500a45

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    914B

    MD5

    e4a68ac854ac5242460afd72481b2a44

    SHA1

    df3c24f9bfd666761b268073fe06d1cc8d4f82a4

    SHA256

    cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

    SHA512

    5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_F82FCC341F124F6AC9D153F6ECE89FFA

    Filesize

    472B

    MD5

    43ae1240e82a88c27729aa2e43fdcd18

    SHA1

    d3d075e4a91481cb936b162a4aef36a7ec25ee70

    SHA256

    e3502b118ac5ee1eb32690694f604b973f3d5c4a8bc00c7a41e71c63ed96bdf2

    SHA512

    b41079e60d4fc1c4640a119dc1fa47bec6efadabbc0e5f4e4a3f4c89abb160e74914531088e273feaa670d3a92b00a0e6380fd94fa480913709f34ad1c971a5a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

    Filesize

    724B

    MD5

    ac89a852c2aaa3d389b2d2dd312ad367

    SHA1

    8f421dd6493c61dbda6b839e2debb7b50a20c930

    SHA256

    0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45

    SHA512

    c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_C66311BFC31F329FE5E6FBB46563B719

    Filesize

    472B

    MD5

    8054872b37200a510f4c5402c9bc8613

    SHA1

    3134db147434a201795bb804ff6f71cbe7c60b0d

    SHA256

    b949dfd054405ef3e4d0f1764cf2f14352b53e6bd6e10012681ffc484756c813

    SHA512

    219f3968e6fdc10338973ca4c622ad46d8ef8c566e8ed641b9a2f5c70e5754618a90428db4782b31af99e92573b79a9eba2f1d274d6fa8eaa006ce951cb929f0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    410B

    MD5

    cb53b0039b109b98a67fd18a468bab5e

    SHA1

    6d186e96489850c3808815628702d4859b7b26b6

    SHA256

    9ba581edefe0b810add43e4561b53a9087c38d9b8973b18e7dbb92dbe8a562b1

    SHA512

    692ccca4c50403395a09132fcbd8e71c479bfbc0a4e0c61c5697b58377941f86707e6bb32ca603196a5a4dfe18a2cbe6bdbfe8d98c0ef4912bce71fa37b2e9e2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    252B

    MD5

    bfb1de7166ec9ae9eeec1402eb3b8655

    SHA1

    972f61bd2b9cb817053a02fc420f68a09753b591

    SHA256

    08135d309b40f1ba682f20ca2ec1b54c98883b895965a5625d7738bfdd80e84f

    SHA512

    53a3efc97766803b9e6e6cd5c57c48a2364fdf6306f91d24a12c73b688aa0f2cfc6216d5cf820db3e1a1e397ab2b395681ccf533040f837e778d649bb9db34d5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    93eacbe42ad299696f467c3d693a9bea

    SHA1

    ef33db616ff02868669b3a111d9d9c63406ac054

    SHA256

    b0aca19ce638e96df4b19d5cb71aa882a4f2ebd20f2284f76cc283110b955099

    SHA512

    7dce9d637cfb8e7e82a5b96a64fa7ef2ca90afdb104b5947475f441c8e779871ea187434dde9e8bb4b23f3b26e76cebb08d251c6fb45cdc251016963b8f451a4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    ccceef93bca9aeea869b4e67fe40a888

    SHA1

    0b63d5de0aeaf7ce10c00e8aef73afa75c00517a

    SHA256

    87f5fe530b93ce4c04892a5dbee2b41c2ba49595dbbd80768345abda258c2254

    SHA512

    e0646d0217f38028b768a3a6e6ca651ae0aac7f4ee8c14c851d8ce923b27643cc65b18f9772671482e17d6f2fa0ebe5bea45bdc50ed64a3b6d8de3f11c6a62d9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    84fdc84ce145c467a735a566f3e7d47b

    SHA1

    34ac98fc236e0e6f2c71cc8468683acd5fdcc3dc

    SHA256

    ae96294b5a3be3c83175f3c5aca5759d2a6e5e871f1e8b0c60125956dd325de2

    SHA512

    eef5ba11ac548abbfd3f2d003f9d370551dd674f2d02814f5586567b2386df8f15bb2dfbc69b0af2ef8b41d12d1aaa32a2cae29f9c4620c86faa01abc6fd3c37

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b2d6c2a0ddbb4f786f6e6cd37324d9a1

    SHA1

    01ac2b26c306169a6cd62a57fc87ed7f6824d2d1

    SHA256

    f41dac8871334f4e9ae7c6fb698ff21846d10ab450081a6251d5a8781099cc69

    SHA512

    01fa62b604267f31799bfb682f2ec5dcfb40757d33e7b1ab874d35af169e3bc69c5311da6f2b9522eeac880dccef115fcf41f961d2b298a7eb84d5875a729a63

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    bc94f5dba9881dfad3a0077b4e4b5af7

    SHA1

    631ccb79877ea217a6272cbaf4dcf9eb99e61d60

    SHA256

    8f69c55fe48a6b0f4d12309be671caea589ffb46be7b921004b5cae032e805ed

    SHA512

    74bc39dae632e2e446286e6223407c08075006a4c1776be28bc88a805b02507838a3fd34fa9acaae6288257c77a708a2876492696d07ca62c98f0558d6761e92

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    ae2fcddf52b383f5b1d81715645db92d

    SHA1

    a1f8172d58e433feb2e0c7948902e8f99e953e04

    SHA256

    fe54956071c05db4cbfbe72455a7270a229980ac486305ee4a8cb38817c3c512

    SHA512

    85000a9da7fd2e241825724133c1c4303ea4e4d827393d6522179346e4765bbfe7bb12dd11808536e28ae99a8de7108c765751362f8d4df80e0f5289d098c03c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b986a95708fa5828175347b8c897bf77

    SHA1

    4554b342f4899bd3c95b4a2d9b5aea64e6334bdd

    SHA256

    f832513c28a3c51606270fe6410a573614d2458a6c1282321f775f7a831ddcda

    SHA512

    d70ef2f0c2221d5aaca83415a169778d5d7b00da254e8eb07ece6ce2a28c50eaf4555b80f33058e89f4229fb2c7ee8e5045ec838202d02f10063f0963655273d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    1de1346c6fecc4b30f823d2a952ac8e1

    SHA1

    e65cc4f11e8565e24b07c4de8fee1f026fadd157

    SHA256

    9ef4fc59708417588462e8ef6460ba1ffb1797a39d6d19379ebf4631834d4a5c

    SHA512

    c5b44e06cf1bab95de8b5a54e8c8fba5309ad9439b0bed0533178793308a9de8c8cef4b54b816d652429e76638d44b6f2e622ef53228a5baeeeefa938ad53149

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    d9e5012962c3783dd3c022a6aff84606

    SHA1

    0f615cbe3225e133d0da6935e654497d5c90ddce

    SHA256

    f6a1c7fde691f774150238c0a4ae2ddb819004fddfee271ccfc594c815a15aad

    SHA512

    df724bf854f0153541f4fd9c80fd7ef41c13d40db0e71f227ad94bf71648a33b897775ca0acb785d7b204b809c75794b6a292acccbd55f36d05d4dcb06841e94

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    45d211742f2a17dc97af52f298b26d73

    SHA1

    913db012a5bff22795e9bf78df300f659b83fd6d

    SHA256

    5471cfd9219f96ee35d13a16bd8066831495d80fe7dcd8b7129b59fdde3ab8c3

    SHA512

    24ee4dc487f5613c06732e54d45c0dca15a25da0114dbd4743d0ea26dd7b6b1abf8a96268b9358e86c9d26747ee6cd886b0cbe76997bac20e5028c4c9c4fea85

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    d705187ce2322e6e8c96d2d68bea1010

    SHA1

    d11e9cec54973261e753095cc3c91f60f792522c

    SHA256

    8593b6b04d9dc5df9a6f9f1f4088358976374b382c30d5ed7faa156a1ecad5bf

    SHA512

    1b6374a2b0f68f4a7bbf9ece31c2fce08b9672769331613a012146da56741b7a1a30d0ee2352dac9a3820637c29dd167d096940243a765b87014db6a0ae267e3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    1efec08b5156b985c1210023ba72f010

    SHA1

    2d4dde369e0a108415253cb11cd852ccf5fcce2a

    SHA256

    6590d113f0c9f8b8a70f465b45acfbd160c08c9fcf0ae1a6d118f442d63ba377

    SHA512

    60bddb8e3d0abfafbe0daa1d3aabfe90e1720202bfa74b024fdebbcb8cd464767163b7eef139eea5621bf8b16007dc34a687ab43f787e3fbd13bc12af2987dac

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

    Filesize

    392B

    MD5

    d02d9539c07f8160f0d2216ce159192a

    SHA1

    3476e487089f9684b27386036b1dd80700be9d50

    SHA256

    fdf4e07877e0dfddf4706e5ba8cd7854d5b2ff13a0977010c2e7f1fcc654659b

    SHA512

    6d572a077864c4da31d8d8c2850f40cc90ab13c4941001951de4ad1a76a79fb3f17c2a16b16f09ab6cd065208f70cf9403fc5019d7c7b85d406e09786117d035

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    bcc8a49fc1d9224f3aba2492ec3ca10d

    SHA1

    45ee447a306db578ca634268d46344d0ea8711f5

    SHA256

    57197cdef50f665f599a35e4fb537b6bb3a2a7962593126aa2ef42a9bab7ad0e

    SHA512

    84acdb9d11a5c4f0474ff2e11bc4c34988b7cbdd023ed367f6e7d78c4146e5f591a2a6121cd24433a56439e4b13545468f621fbe62202a7b2bc1d9521a27b788

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPR7YYBV\cb=gapi[2].js

    Filesize

    133KB

    MD5

    4d1bd282f5a3799d4e2880cf69af9269

    SHA1

    2ede61be138a7beaa7d6214aa278479dce258adb

    SHA256

    5e075152b65966c0c6fcd3ee7d9f62550981a7bb4ed47611f4286c16e0d79693

    SHA512

    615556b06959aae4229b228cd023f15526256311b5e06dc3c1b122dcbe1ff2f01863e09f5b86f600bcee885f180b5148e7813fde76d877b3e4a114a73169c349

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPR7YYBV\plusone[1].js

    Filesize

    54KB

    MD5

    fb86282646c76d835cd2e6c49b8625f7

    SHA1

    d1b33142b0ce10c3e883e4799dcb0a2f9ddaa3d0

    SHA256

    638374c6c6251af66fe3f5018eb3ff62b47df830a0137afb51e36ac3279d8109

    SHA512

    07dff3229f08df2d213f24f62a4610f2736b3d1092599b8fc27602330aafbb5bd1cd9039ffee7f76958f4b75796bb75dd7cd483eaa278c9902e712c256a9b7b9

  • C:\Users\Admin\AppData\Local\Temp\Cab279F.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Cab288B.tmp

    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

  • C:\Users\Admin\AppData\Local\Temp\Tar28ED.tmp

    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a