Analysis

  • max time kernel
    134s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    13/08/2024, 22:31

General

  • Target

    94ffd1f0a167799dec9acb9f408aace2_JaffaCakes118.html

  • Size

    78KB

  • MD5

    94ffd1f0a167799dec9acb9f408aace2

  • SHA1

    6213bd347fb133266ab45c4045fee69c6593b131

  • SHA256

    ee6275af33a731b31b9257ba27ade8a393db9fd48206ca80b37227e65dabf89e

  • SHA512

    c47176cd1be2d8540d139cc6f0cf4eb1865ee4272558a2e1314001df2783a2ebb45e8a3371f316eedc7573ec3a691b5793efe040ba8b412571636d8a45624abb

  • SSDEEP

    1536:qySYjo39kSbMMo4rYxpQavHrb9kaaqLcbcBwJKo41Esd47B:LgeDx2ab9kaaqLVajsd47B

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\94ffd1f0a167799dec9acb9f408aace2_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3056
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3056 CREDAT:275457 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2852

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199

    Filesize

    854B

    MD5

    e935bc5762068caf3e24a2683b1b8a88

    SHA1

    82b70eb774c0756837fe8d7acbfeec05ecbf5463

    SHA256

    a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d

    SHA512

    bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    1KB

    MD5

    203eebcd8b36613f0b6ac93d0d39352a

    SHA1

    8ff94309fc8f76f7fcd29a51b6b835e63fd7d8df

    SHA256

    56dee0c1fb3cd8e0ab40d11d3b8d43998d7cae7b37da9bf1d93d134b2eaeaf58

    SHA512

    34b99646afa0fbe8e21ed3e758ec68fdee8967b596dfcb87cc6d0ee9de607cd86fb6aab15e34d41ca71cc49372c454f570edcbda7f12f7adf87bfae3b8596e3a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    914B

    MD5

    e4a68ac854ac5242460afd72481b2a44

    SHA1

    df3c24f9bfd666761b268073fe06d1cc8d4f82a4

    SHA256

    cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

    SHA512

    5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    410B

    MD5

    d44c4896ba0dc36400d0e99e64b4c321

    SHA1

    d88a0e4a5d0e5ccbe1f928459c5baf0a30ef4b83

    SHA256

    528297dbcc118c6f451120460d6a216f12245f1a7c6c185dc9337b564c0effc6

    SHA512

    e7aea34a4bd44a0209ca8dd6a490d336a3f9057c499497d4f3b6a3a95b19a3de2e6c27b7499efba4eb35d6be7e9c9af797fdc766f62e05edd465cf0f44887362

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    410B

    MD5

    5bd003f30b680c2dc1aab1e87891049d

    SHA1

    d5d66e2840ebdd7200e6d6fb30f4617953adf0f9

    SHA256

    55a26c2d722de048db71ed04f6644fb13121fbfac7e7474674bc223759d386dc

    SHA512

    77676e34033ab4ddaff24c07c8f3dba38ab793984481af8eebff9fd4c688aa3ac43df4710ac9332db683a65c713d9b0ed94d09189d4dee2bb410c03bbf22b66f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    252B

    MD5

    ed425e3a6c0099e5887fb05ab591a901

    SHA1

    f9409f078565a1bb754fcc9314ce0e5e246234f8

    SHA256

    424b31f8f5b587768fb94c79b70439ba0108a9c28aa0cc437a6f7a6635a4ee7a

    SHA512

    f5759bf71c3284f046d7d16b6e8f1f06a37337ec8d67d9b2acf24f62ffcb53ab4ef6b538ff2498d19cc6be1b93ea89a8de66af60495e37168c7c4194f5291012

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    59d5a204cece2ff373abb0021f687a7f

    SHA1

    3cc58320af53cca9de09e3180d644404705ef16c

    SHA256

    99010a3933e1598c935e07e47fd9c7fdca5ced4aa960641513c1c83aeb650a73

    SHA512

    4e76a0b0192711fb8d8b7b26b51a341f526133b6edac5010dc9aadbecd6814ec91d3067a461631d9d0fd27f284a3bf56e7dcec9fa5ec84a281ba91e4464a357c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    0e101fcaef5c1d3d0f914b69d379ab98

    SHA1

    448c3f57cec3db4d959af50600255fb326b06e12

    SHA256

    62ea53fe679b64a22df6ce261f6b788a0ef0989f82adf3259e075c324565adb5

    SHA512

    3cb9fdcc46f480248c81e1ca198cd58949deb3ceca2efe45b6f1388af97a02a8cd2d1566e7c67b5f7373530a3543a96e2e973fad4e945dae65ef727d11d86671

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    c03aece7814f344ff258f4ce421042dc

    SHA1

    6fab49425d8a83ad4bcedc7489e1b6a7a2239c43

    SHA256

    03ccd891e73d1d9407b640e7944de1a45c1c810de5cc628b06444600096e18c4

    SHA512

    eca9db148dae0ac32a5356200893d331481286b1747a97dff6f3f53a2fe6526054b34c7086b70dbb8ac0fd36f954bd69ca5c0883d7ccd0e025fe02088af47142

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    66244ee456a5f41c17c819ebfaf06195

    SHA1

    f0c40beaa3d9213ed1feff7f04d8bf8eab66c817

    SHA256

    b8576922dcc7d8d44226533a0c76a390563d00a65d1ceb15ade0d16844f6e355

    SHA512

    20a1cbfba6dddaee44cf247e48b6f3d3dce8e2cb2e4c8c4fed8b9b661419a6bee37fdd8d5fb1d16c9604614f2ad877b0c82f959b6ba3f41023ffe4fa15775636

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    f7111aad7c7be2bbdaec13f57bcc172c

    SHA1

    c963396091e375ba9889d341ba63cfef71dba29d

    SHA256

    b7b8b0dc87dbc3c3400d89a7d8fa1c8a5e3ada37c7427bcbfa6927e3be9c5f05

    SHA512

    18f4ea7dd1ebc66d9f924e5514289261e0b827ceef6def38c14a256158b0e5739bffc0340d2b95cf84c30fc90d121b3b0acebd86ca165d515733d275068a3196

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    89354f7d970cf770aa2568c48c7d2f1e

    SHA1

    8e7e3353215f50c34200b1589f7bbfab10456b30

    SHA256

    77ce157dd45c4a1f1e6cfd37718d91fc2002e7f130a79debb1800240b41856df

    SHA512

    bbda0f1d03554d60e50544f7ba437635fb0dfbe95519f2155fa70f30b96b7f5046180c06de0f5ff090d19e3360e8f06902ec1215a652dc88e12574e54f02b2f4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    f35be8aba6ed68e1ab9700dab3f1b450

    SHA1

    2fa1abaeef372bd964f73d7d872732b7f8b8dc50

    SHA256

    25d02a88a8a5e83cae0607aab7e5c7476de3029eeb72065b979a8d862fd8b6fb

    SHA512

    f79044cf2d3ac7c868380c6b28e569d39981290294e0a4e64217e63077d019b52c132cbfb26b791c274c9280e143c0318ec0169c6a48714a98524d1c600dfb54

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    c60228c3521319abec8f260f90cc1089

    SHA1

    7d48c983ffbdc495eac03d680dfd097cf3581ace

    SHA256

    d1a6ff98816d49127c2a279f4980f6cb005209c3d5c116728cfcab869441117c

    SHA512

    e3437b924bc5b593fddea0d7ba5da016cdc9fa29cac7a911b1db68a1f29fb6ad225864f14d57ebc75bfa96ab2f30a6f76cdb14095c655e0763cca5e8b3102989

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    5d86e10056e4dcbb6dd82f7334bb738c

    SHA1

    ae97069982c78dffebc0b7829ea7a361e17977a7

    SHA256

    4f7549d0ea91fc9fd15e1d5343d9d5e3ec073ad14b4c333aa6be9d4e3daca85f

    SHA512

    5a175844e1dab17a22044db073d62427e0dde478ecb64bd397e51c78fe5f1def39cf2ad03330120b1cfdff912c804c6ab3aab6bbcd8a1ad669f002b1a94e163d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    69fb198637d81d23970ff29dbe4b98aa

    SHA1

    03c0986ef59b9910364677bd3797efc94938b345

    SHA256

    b121f2a73f81e9608910b9dd150c7a56d15274bbc947576285be5a524adb17ae

    SHA512

    5a2db7a987889e432f6ac8b62f664bf5bb6947f5623816cfd80858f389912584aeab4f1ef07017567e052d099a1f3c583e439175a8495b43a9d7e8561e136fae

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4UQ4J2DQ\cb=gapi[1].js

    Filesize

    135KB

    MD5

    cb98a2420cd89f7b7b25807f75543061

    SHA1

    b9bc2a7430debbe52bce03aa3c7916bedfd12e44

    SHA256

    bea369fc5bdd5b9b473441583c46b9939232bf1f98c1cedf6bc2241c4f5068d4

    SHA512

    49ccede4596d1e5640a9c8e8be333f9c18812d58f02b2b15adb54172df1387439e9dc5afc4ccd9d8f0f75f092318bed68d3cd577338e88ef4f9373de8a07c44e

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\69P6875H\platform_gapi.iframes.style.common[1].js

    Filesize

    55KB

    MD5

    aada98a5b22ec7188655c2c17a083c57

    SHA1

    7c3c2fb8744e7412d8097e28f588788d91b9cd9b

    SHA256

    f2f09baa213dd3dd95edb5a30c7764e4a44d9a79c0831f90b1ad8ebedec9dab8

    SHA512

    a780aa3b9e36f61be8240487e75c19a96fe26d54abf9006680a00af9d1d394e81e517f0bbbc13edff3a7190679260ecd56fd5cdd7c2d2f416ab8982c3277b953

  • C:\Users\Admin\AppData\Local\Temp\Cab8171.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar8173.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b