Analysis

  • max time kernel
    133s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    25/06/2024, 18:12

General

  • Target

    0f0b83bd556e81c12655b1efb17f7ff6_JaffaCakes118.exe

  • Size

    467KB

  • MD5

    0f0b83bd556e81c12655b1efb17f7ff6

  • SHA1

    eb8988078a6b1796f0679e9c5621eb50e5ce5985

  • SHA256

    2a0a3952558fd1091c689c4e43e6a457c43660282d75215f8d33a211cf045748

  • SHA512

    77c8fb78a23e81e3c9c213a321a5b57a3ef6d0156df2ff29f6ef17f2b2e95079c27d30de57bd3773aa2f1500ae08822b7b51877c935b5c4eea4715d27d5f2931

  • SSDEEP

    12288:Tum/Ep4ofEksE2bol/G1ef8khOYk7BAdM:Jsp46E7EqMf8Lr

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0f0b83bd556e81c12655b1efb17f7ff6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0f0b83bd556e81c12655b1efb17f7ff6_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2348
    • C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE" http://www.baisou123.com/tj.html
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2260
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2260 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2100

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4a2559caddb3f4e739ac154f63091bf6

    SHA1

    93bc3de6d5ca2bf39fecfb4e1b7bcbaac9987e61

    SHA256

    27c122c1dc1bb29f95dc56fac5ad224568971c6e7c4be4458e31930649b7095a

    SHA512

    194730c0cca811e34d38c4f4c6bac063abd8f1562aeca3277fe39f3bfcfd8ef40ceb65de17a7349e97269a4602ad1514498d12aab867606f2fb38ae5214f5f9a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    cbf955ee081ec67a632b75e943e203ac

    SHA1

    976e7e6dff5f0557654468088e752119fcd4780c

    SHA256

    c4cf47730614b375235516eaf5e94a10c88ff25ad39115538b696e62050de9fa

    SHA512

    031215f30482663b0e3faa6a1622c0ab19830d65585a8cf350ea9eaf4be2081cf93e9806590c0d070ed7b5c1de83821cecaf8eb178ffb172d4b0a53fbca38340

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5633fd0ab891d249f74e6659167b85d9

    SHA1

    ee374c22e45bf99b805ca47266a5927e46a45d81

    SHA256

    91569f03714a50f4a28fee9b65a77e51af97111e20b07f40b8e736658d0796ba

    SHA512

    852861f4f0397d864e4e723208c6d804cf5a9b61fd6914757d3eecc73fa904889376724bd5f1a34441de7ee938fa1f227769304d6db732b34c726b8ff6696653

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    03e15aa6e6294f3fa228e80a042e654d

    SHA1

    3a99cf4f75294ad72361266c7dad8e94332b1381

    SHA256

    885369fd3dcb3092a1232a28448c49e7dbb27ef30a9e51651d5adabcca01b799

    SHA512

    ff6fc5188b24e67d01f63abf5ff61d3dc79c1b66ed531f8247e9189e76b662b9594b92c9d837de644bef7888c181190f71e6b7aa7e945c1281826d5408390d49

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9da73a6f0046c5a3ce037438e47f9891

    SHA1

    c1cf4ae68f04dcd5c98ef25fe7ad3fd58516e07b

    SHA256

    45002723c517ee69ee796b4a36fade1272cdae4d81cab50a292cfb432823f729

    SHA512

    34bbdd8521fd78aeb72dbbed89b3add08d3040ab9c2b75772c7fa4b27f8f9b2c32530f32a2c281b59ef7bc5d957306c9204d9344d92184081a72379b6fffa329

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3bff5f6ab262dab73dfe7b734bc1cf77

    SHA1

    57bdccb06254c0c83c9d9f96ed44543eccf6391d

    SHA256

    49372d53427e5242288e90fc92dfdbf8c143b034fa7f8eded3f833403c28a7aa

    SHA512

    7c1999ce025c20a42ec3aa0b0cd8bada83afc954c69d1f35c5ff8f1084860b8c73c9b0e53c5aa61dd1b8a43a1ea7c39eed178d5668b59645e7853524068251c1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0f7745a54164a64ffb725e87e6539a27

    SHA1

    2dc2ec90e0fa9a14dd7375803e9778851ddc80d5

    SHA256

    52faf2748a48941c33c32c82c645f2d1be17f241be5b2f9e4fd9eef40b6901d2

    SHA512

    281f34f5ee27c298879747e1e94f078b46f092add2a1f6f7682fabb0c02e8a156a382a75c0d624a5339df761924bddb44838acd3eb62038f8aec960591d72b5c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2d3224d9f3ee106bf755ffb186d9bee1

    SHA1

    ab9a0518e692c0838fe16f56cfbbc4b2a2373793

    SHA256

    6100110c6704cb55928679a574e99b30373c5f2ef0e4c4aa57b30d2e06bc2ebe

    SHA512

    2a38f1265aa1fc5d189904abe4628274eb291bbbad1e20b852da31844514119ee5be65005f74d957e67eaa6965d8eb24caa11cab2434a9af46735490bd6e9f9d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ab0876f5ae0376182a946709c4f552d9

    SHA1

    d4c023d6639466e1f1e00499238e7192c4385351

    SHA256

    8792e2a8c1967d987b62f1ea54ee56f0ab0ffea96d1232a30fce24c130fd3694

    SHA512

    c4922825cb279e4d202b95b24f8454138911029a42c2dc813a6cfb6d0c9f1d321b7b4403a54725e78d19c2e1596ce0e16919d76d27caeb2874716be0bc7fd04a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    372edb2e10b8ebe1b1bc44ddcfa3f681

    SHA1

    9b10427458912c7171ee85b446ea6c26db26259c

    SHA256

    e3e6ca2d27ba66fad493c9b12261835e5c934dab3eab1e10f3dbf97bce5bd2d9

    SHA512

    6e0e0fff2c7c9767e2baa17639e2c5562a95374ef3a64e643615d213ea130b342a8377f16100c408aaa2db566d2f1052326ab9b0a3f2fa45bcb858553ea92a1b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    52a0dc8ed8802bb4b96bde4e3c5671ac

    SHA1

    f2d508fed99d514e6a368a56ed7e9764e9f676cf

    SHA256

    bcba95a5d03cda4a88d0098933fa46d8472aa62268cbdf82b815f04321554156

    SHA512

    34bb3700420ec03a9ceb9e7068a308e6d1d265516ee637a5795cb332c2332553fce05e3ae8b58328fce49fbbd2de4ba00a600bfd133e027e0291337a645827ae

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d999d5dddf78800fb4f85e0a382a3057

    SHA1

    5f4c3bf42c0b714cb63ae328d469acb65497f91d

    SHA256

    88a013b093698be6e1d2ad915c7a4bee46734271ad59677acb2901246c7260bc

    SHA512

    7c63a3c97c6d39446c3315c0b354fb00ccf7709e98dda8b85765fd348f86b779fee2a5d9721e05a680def07d8d32ba31c1f4e0844d4ed6af65e9ca98c37c96f9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7abc0b8b3fb0fdd02469976eee246c6b

    SHA1

    8e498bdd23416874bdd8dc68a43b2ec80a8472c4

    SHA256

    9156506a37c61e650d2b9ac050720b93771e69ccd150c2e0787fc01605a7f9bf

    SHA512

    da0580f95689ef320a09eaaaf4a2d4b6fbc8171fdaf5bfeceaab985910fd7066392bc2b554a5e03c323d0cfb2ff23e54e1c440d300efb7d3d22529789c32fcb1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    749c3a6b0059b6a87eacd369ff2f741e

    SHA1

    a29f9833aeff875532f8b87018f439176fcdca17

    SHA256

    ad96b8c3ef4477d6eec86d00b46c3dc6b1be5e7a05e464bc2f7858592a8fd52a

    SHA512

    13005ded5f10f5ef7dad10f7f3767f90a797e2dde3d53b97b550e25513daf6fa282ab6dbf0ea3da538171cc453fa97ecb23134ab0f9e2ec3d2a5eafd2d2ded2b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2d517e210e616e0fcb9ea9aec901c180

    SHA1

    885398f5da65b774b3a4575f3e4a8c79a16f44ce

    SHA256

    b0b1a33d014e0743e6c80f14b023ab795765c7a456b2e358fe592919102d7395

    SHA512

    deed88e02111a71d704b21baf493def02961110a68f8b5f382574aaab7c2fa29e14d283dadb250a0182030a599c2e5a38db15ab94f39005aa8b5f95b8ecc4cb8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    dfd8ba552066226dd249727ffcad7cba

    SHA1

    4a2cbfbec436efb8c955dd322ad4dbeaf3d8e8a8

    SHA256

    0d6640ea51ad59d1509eb2ad60677113ef1c98566ee246fb21cc6230b9622210

    SHA512

    219d5f20faaf16295ed94cf2305979ca651dd495ddde0b7c3eabc0649d39a574a4f412901ddd3b70cea4f7b714f59f54831a3e4f2e068589c988bd6562d5a0fb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c8ddd01b9104e29186a7b152bf0a8998

    SHA1

    91ce4b6175637c2d7c05208fa8427071c765af42

    SHA256

    00dd74121fba4f4b10b038c53d77b953126c19629ef55af32adc3519be584385

    SHA512

    dc212d5e3ae409a0a8b439627927d2989e524d007199ea871863cb36bc1ce547d024b77ac1401a0cebea9008112428304a37e971c46dbdbdbde9994dde8defd7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e7e03f8c39c030052ff41d4fcae55cc0

    SHA1

    9c6591661e553bec214daab6cd326468bbf1e006

    SHA256

    adae49a385427651731c2843d84be87833e88e0021587375008438f7c4c4eb47

    SHA512

    6d65cc9e670a80f56d107deb5d4cecb85652e04da4e2c6b3f27ef1a57fa275ceb2e1f37a1cbe5641dfc4a0ac6337d974a5ed0cee51210d3d49b3c78fa417f767

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7a601754760ccb9f49ea403cf408529f

    SHA1

    6a8c2f1c6e33dff76a9b9bc21427e7e3c78b1097

    SHA256

    d4d170c73938af0648387303fd052b13012884313f7ecb1a3e7e2894febfe3a2

    SHA512

    be8b091824530fdf773a362dba4a29a53c137ea4852fa43e0531634f1f4c9c8b6367b0b01efa2ddbf6e639b019527de8bfc5fc5f5ffc7b7b7251364627506baa

  • C:\Users\Admin\AppData\Local\Temp\Cab2425.tmp

    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

  • C:\Users\Admin\AppData\Local\Temp\Tar24CA.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • memory/2348-0-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB

  • memory/2348-1-0x0000000000020000-0x0000000000022000-memory.dmp

    Filesize

    8KB

  • memory/2348-483-0x0000000000400000-0x000000000048A000-memory.dmp

    Filesize

    552KB