Analysis

  • max time kernel
    122s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    14/08/2024, 18:26

General

  • Target

    972d39d6a940bac3c98af8c19aded5dd_JaffaCakes118.exe

  • Size

    1.3MB

  • MD5

    972d39d6a940bac3c98af8c19aded5dd

  • SHA1

    e912d03ac5cb5e718e8474068e28135c0571b9db

  • SHA256

    dd46d8b977c9c14606b408da05c607a075d9ef5d67eab0d4d64df813b008f462

  • SHA512

    73470d8300855980ca3afed523dc7bb070365bbec616523cdb53e9d1316e63a5a0d74de794b9d743f5f854a833dd005c437d392737f7ffdac16a25a39cbb56f8

  • SSDEEP

    24576:MejDKKiDkY2+AhEcy1BirYZqXMrDjUm84QeP3Cqkkkkkkkx:MeUDeyLZqcn3C3

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\972d39d6a940bac3c98af8c19aded5dd_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\972d39d6a940bac3c98af8c19aded5dd_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2700
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://contrev.net/redir385.html
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2308
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2308 CREDAT:275457 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:3012

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    59e72a44a108d8b4ce2099e7338d3bc3

    SHA1

    c83f107cfb378bbcef97f795ada854704ca15b0e

    SHA256

    28e07965c603d2f389d9fc6cee52ed17c7470590c8a4ec1c32ac0b24c0515b21

    SHA512

    0f709a10cba2fe4b9b070ffddf13ffb54bf4e69831b886b1f92efef4db2b3f7db877cb17aca9cff04957817190f8820b380b4f08a7d55fe6adeb0cb17c35c1e2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8cc0ee976d22fbed2260c3e0f273986e

    SHA1

    f4e54e54f5b064d8018968adf179bd2e058f338a

    SHA256

    4bb4ee345b4c5da8111959b5231e1623cedce64533e97f30a756d129277eb44f

    SHA512

    bd4a66921f115fa3684b28d714a9e0593b0cc2d7bcb182ed8bc15da3e27d76d639a7db6a9c8757119aca50ca065c5f2e12ab6dffd6137408391882030d3da517

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    55ce45e886d5d824fb64e3dd47a6aac8

    SHA1

    df029f497686f2e7d5a20444daa635ae770c44ef

    SHA256

    0236bb0ee9c4f7b2045cb03bcc38831548d53bc8ecfb13454b11ca2ecb45335c

    SHA512

    322284ae03f988a0ebc511c8255c42b287c890b6cd15907ec907a4a6337e59859353418db647787d34b33387189f6324523e8c6873b39090f29bdb4be4130446

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f3fd554c276312776f64a4242f698f7c

    SHA1

    436266af161e869deb5a2bd90bef6243d54f837c

    SHA256

    f69f09eb8f47aee235e8a058a4051be0872eb5467261222f6fa4c3de198ce879

    SHA512

    6ae22b2965fc6394d10fa7882ae07753965755d0c88c3be55e847fda7d2ccf65ceee6e6d8536dcbd42e6807500b536dcf0ae74dfc9394b4b7a25bce509ab5598

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fa0df32bf917e1ddf3dcc04622ef51b6

    SHA1

    01a237d0f891b58a55a77690fe45c4c95b3abe54

    SHA256

    532e70a86570971df916fb4ad937bf395786ec7697f94a6cf1160f59721c5f7d

    SHA512

    3e9dc42a17131573885684d297a95d083dd864c0de8f250595f72d155ec3dc44b3c2356968043ce0405ba696b93eb8cb3e182836a2ab17a1e27c6f3616255318

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    51620a80c8730d7bf89a71ba96a620c7

    SHA1

    0335f648f3b655e1778870daaf6238bf9ea304e1

    SHA256

    15ed398b7136ef133ce377f2dfd55b43fbc0fc8b7c4fea4528be6951b9db4e97

    SHA512

    f16230e0989e9b193d7d0276455cbd16e42e49f05a58e0249f2d9bdad83438aadc4e0d0d39b281a23045d6044f24eec76bebce0499f76ef648a60d962cc2a2a1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    38841efe7d9266335c473a31007762f2

    SHA1

    d783f0870c4fde9d55aa24526ea94a1a23aa09b3

    SHA256

    6c48260d34ca6a61a8a306ca7e4aa6c86afb4c791564167d4bfde52840f10e9d

    SHA512

    cc42b512f65c660640e5deab3a8b7a78121750408d2daa7ce00d0208c51fcecc7f8b2a1e01011dbdb7f98be161cf6abbddbb5acc051046421dc4df76966c75d4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    36be93c654f25e4f78f1d70576d4bf48

    SHA1

    8dce67a744ce456e019e948c590e4f2fdf1a441c

    SHA256

    bd3ff2fbb47dda423c9d5816bff787462dd9a84d135eda8b7f350ba748d417e3

    SHA512

    115bc7dba8bd6d8bae15e3667404c6a89b0ca031ea1e3c1e96cead46f875baaa0ebc134699430b8b65b2dacccfc994ba8da045c59e83be950dfac9ea89af9d4b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7d5b495da9f04873d0fe208734cc790e

    SHA1

    825de5b06656c79adc79ec9a3e3ecd699fb5ad99

    SHA256

    53b89d1b0590fd881a91a76d05f60e2b482e06d1ac1d17f751e27e9a3e13d415

    SHA512

    719f13126216105e7520382f38bf128e8741d6ade857ed3c9733f172ee2388941b7edf9ecd58ed263f9db146924edec80c6deecb079a1a3148ffbd37a6fcf7b9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d02e91f8bb54001530ceb879540a6cce

    SHA1

    559b116280f32a25f8a034c675b84aae3598af18

    SHA256

    261d18d526afb1c9a41eaa5acffe907bd8ce0f438cf46c07f194b6459cb5cb97

    SHA512

    5e10889677d117b61cc39190985473b0afe67842bb69d733589f91b7d48e6e43577a3b76a389fa9563e79baf7c583ea33890918408d0b515a01d5b40ae53bc14

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5c9eac7a915f63f15ae75cd2f6e8e64e

    SHA1

    c876e0514ca74dbd01ab6fdac151986ba421d523

    SHA256

    dca856c72ce804fa21a58d81ca0d7fc0fbd95389a50f3fc3642c59b19668f83c

    SHA512

    9b9b13a180b14402834686444da90b708a1f7bddbafc08c7937e252620a179cf6d808b48f2126e707316b5ff95ef05247d01877292685562add1e98b4fdade50

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e169d969c79b0a16c0067e86cb5a203e

    SHA1

    47728cbbd418cce2dcd9bcbf8409a32c2b75b70c

    SHA256

    b718fe4233618b4da58b9db67c039baf7c1b15a67fe88d9ce668bc74d22ba2c9

    SHA512

    35d77bc2b9b31b1d76b935957e8b9824a13d4446c1ba1489529c6a3ff12b5c5a6dfd24278c54d78fffc114b46bcf09ee817088eec9d6c27c94a508666453dc5b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e60996a2c50745e67ecb9b8ff9a7a39f

    SHA1

    593de5863567a720a23c4642a9e96e0f9700688a

    SHA256

    f9561dc2544e1915ec722e77b41e52227c96ff7ab07434aa5139c84a17b8f092

    SHA512

    161d04a6b2160064a3ff3038d8ce6b2ac439fd643ab0a21dd844113e2260f67fb7c04b154384d5e6f322cf73c9ebdd85f9addc065292bb7948e6ce6bfedb9174

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    945da30613f8b20f8aacf5b3e996c9fd

    SHA1

    5c044c3afc98811b1b65af87f969d381d6204f76

    SHA256

    ca8361c275f872fec4c8edacefd5a7dffa0770087e74c7f4b391d28a9e225440

    SHA512

    6e0711ce247de1414535f829cbb273646675791bf3048f202733daf0156a825f66c80db0a2e094a4a692ccbd15407b4f865653f4a5d653612367dfa3ab82601f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    dcbbfaa2391856a9c44470e6f73fc1fd

    SHA1

    71c92a9fb7e0b95abc8a82284f89184b64985de7

    SHA256

    a7ce48b6c8aaec1cf70779a60f3530ab81b8c515aaf784326b3be9abb5fa8f47

    SHA512

    f55b64a1efe76297033820737ee2e18ccec6ba302b0c5a0c574839b55bf80307a263d36a712507b02e362177d0810ba7f4d3a9e4a6c9492fba28f55d381e1a9f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1e99f932969a8fa74f871d00438fd2f1

    SHA1

    8a3809c6b1f5cbbee6f0afcc6e50002c843722d4

    SHA256

    6811f9ebe14d7d6f48aae66abf7be0f8be7ac0ed53c6f289b1c04edb438cc2db

    SHA512

    de073d0b6292b24bdd9c324548cfa08cea1dc5e2071599730c2476b7e58e11443808e1655fc26fe0d6f19c2268bced19c00d32190e164c13faf5f410cb07fa25

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    212e8e03db93e6c5448a95b976a94fc7

    SHA1

    cd65159a921bbce213b3aee5c6320be76c0c4d2f

    SHA256

    922004d24158e19b00862ebce1fa0427216e374eff464dc8f9b32aeb6ce38e11

    SHA512

    23c1e96963ab19a2ccda71545759f7225d1e90b3ebdd2f2ae48b2794fdb13e5bad44f333f766ed1596620ece30870558ff52e861db8c689b745f5d91099f4948

  • C:\Users\Admin\AppData\Local\Temp\Cab3314.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar3336.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b